Explanation with Extracts = The Fraud Examiners Manual explains:
"Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging the data... allows a fraud examiner to view and analyse the contents of a computer without altering the original data in any way".
Imaging creates an exact, sector-by-sector copy of the drive.
Thus, imaging protects original data integrity.

This question tests your knowledge of Domain 11.
In the context of Testifying, specifically relating to expert witness, testimony, the question asks about examinations of expert witnesses in most inquisitorial jurisdictions is accurate.
The correct answer is B: Both the parties and the judge may question an expert ' s credibility..
This question relates to expert witness testimony. The correct answer accurately describes the role, qualifications, or techniques for effective expert testimony. Fraud examiners often serve as expert witnesses and must understand these principles. In adversarial systems, opposing parties present their cases before a neutral judge or jury, while in inquisitorial systems, judges take a more active role in investigating cases.
Expert witnesses provide specialized knowledge to help the fact finder understand complex issues. Their testimony must be relevant, reliable, and based on sufficient facts or data.
References:
- CFE Exam Content Outline: Domain 11: Testifying
- expert witness
- testimony
- Fraud Examiners Manual, Law Section

Both the Manual and CFE Prep guides emphasize that forensic imaging is essential because:
"Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging... allows a fraud examiner to view and analyse... without altering the original data in any way".
A forensic image is an exact, sector-by-sector copy of the drive. Thus, imaging preserves evidence integrity.

The most relevant factor is whether the social media page or profile is publicly available. Fraud examiners may generally search and extract information from a subject's page if it is open to the public. However, privacy settings and privacy laws limit what information may be accessed. Examiners should avoid pretexting, password cracking, social engineering, or other unethical means to access restricted material. Platform ownership and the likelihood of finding incriminating evidence do not determine legality. The type of content might affect relevance, but legality turns primarily on whether the information was lawfully available to the public or obtained through proper legal process.
Therefore, option B is the best answer.

The digital forensics section of the Fraud Examiners Manual stresses:
No single forensic tool can recover everything.
Each has strengths and weaknesses.
Therefore, it is best to use a combination of tools during analysis.
Additionally, the examiner must look for both inculpatory and exculpatory evidence, while maintaining data integrity.
This aligns exactly with answer B.