Which of the following is NOT a best practice for obtaining a signed statement?

• A. Prepare separate statements for unrelated offenses
• B. Have the suspect write out the entire statement in their own handwriting
• C. Add subsequent facts to the statement as an addendum.
• D. Have two individuals witness the signing of the document when possible.

Christopher, a fraud examiner, is conducting an admission-seeking interview with Jennifer, an employee suspected of stealing cash. Which of the following is the LEAST EFFECTIVE phrasing for Christopher to use when posing an admission-seeking question to Jennifer?

• A. 'What did you do with the money?"
• B. "Did you steal the money?"
• C. "Why did you take the money?"
• D. "How much of the money do you have left?"

Nobles, a digital forensic examiner for a government agency, is conducting a criminal investigation of Lucas, a construction company executive, for alleged bribery of foreign officials Nobles obtains a court order authorizing him to seize Lucas's personal computer for forensic examination. Which of the following is the MOST ACCURATE statement?

• A. If Lucas's computer is running. Nobles may retrieve data from the computer directly via its normal interface 4 the evidence that he needs exists only in the form of volatile data
• B. If Lucas's computer is off and Nobles needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer's normal interlace.
• C. If Lucas's computer is running. Nobles should perform a graceful shutdown by turning it off using the normal shutdown process
• D. If Lucas's computer is off. Nobles should not turn it on unless he plans to use an encryption device that can guarantee that the system's hard drive will not be accessed during startup.

If you are seizing a computer for forensic analysis, why is it generally necessary to seize any copiers connected to it?

• A. Many copiers have internal hard drives that might contain information relevant to a fraud examination
• B. Most copiers store, process, and transmit data m a cloud environment
• C. Many copiers connect via parallel cables, which store and transmit copy job data.
• D. Most copiers today are nonimpact copiers, meaning that they store copied images indefinitely.

Lmdsey, a Certified Fraud Examiner (CFE). has been retained to investigate allegations of bribery and kickbacks allegedly committed by a member of an organization's procurement department. Lindsey conducts an interview during which one of the accused's colleagues states that they overheard the accused discussing a free tnp received from one of the organization's vendors. Which type of evidence would the interviewee's statement be considered?

• A. Documentary evidence
• B. Verbal evidence
• C. Testimonial evidence
• D. Inconclusive evidence