If a computer is running, it might be appropriate for a trained digital forensic examiner to conduct live evidence collection when the needed evidence exists only as volatile data. Volatile data, such as information in RAM, active network connections, running processes, or encryption keys, can disappear when the system is powered down. However, live collection should be performed carefully because interacting with the system can alter evidence. Option A is wrong because a computer that is off generally should be left off. Option C is too broad because a graceful shutdown can alter files and destroy volatile evidence. Option D is also incorrect because turning on an off computer can change evidence. Therefore, option B is the most accurate statement.

The correct answer is B. False. The key issue is that the legal protection against unreasonable search and seizure generally applies to government action, not purely private conduct. In this question, Charlie is an investigator employed by Victorian Inc., a private company, and he acted at the direction of company management rather than as a government officer. Therefore, the normal constitutional requirement for a search warrant would generally not apply to his workplace search.
This conclusion is strengthened by the fact that the item searched was Lorna's company-issued laptop, which is employer property and usually carries a lower expectation of privacy than a purely personal device. In workplace-fraud matters, private employers are often permitted to examine company systems, devices, and records, particularly when investigating suspected misconduct. The later fact that Charlie turned the evidence over to law enforcement does not automatically transform his original search into a government search requiring a warrant, unless he was acting as an agent of the government when the search occurred.
Accordingly, Charlie did not violate Lorna's rights merely by failing to obtain a search warrant before searching the employer's laptop. That is why the statement is false.

Cross-examination in adversarial systems is designed to test and challenge a witness's testimony. The Fraud Examiners Manual explains that opposing counsel may attempt to control the witness, ask leading or complex questions, exploit weaknesses, and use prior statements or testimony to challenge credibility. A key goal is impeachment, which often involves showing that the witness has contradicted earlier statements or is otherwise unreliable. Option A is more consistent with direct examination, where background information is commonly developed. Option B is incorrect because opposing counsel usually does not ask questions unless the answers will help its case. Option C is wrong because a witness should not evade questions; if a question is complex, the witness should ask that it be rephrased.

This question tests your knowledge of Domain 5.
In the context of Money Laundering, specifically relating to money laundering, anti-money laundering, FATF, the question asks about EXCEPT, FATF.
The correct answer is C: Require financial institutions to monitor their customers ' political affiliations..
This question addresses money laundering concepts. The correct answer correctly identifies the stage, method, or regulatory framework related to money laundering or anti-money laundering efforts. Understanding these processes is critical for fraud examiners working to detect and prevent financial crimes.
References:
- CFE Exam Content Outline: Domain 5: Money Laundering
- money laundering
- anti-money laundering
- FATF
- Fraud Examiners Manual, Law Section

The Fraud Examiners Manual and CFE Prep emphasize:
"Generally, documentary evidence, including digital evidence, will not be admitted in a legal proceeding unless it is established as authentic... Consequently, fraud examiners who collect evidence from social media must capture, download, and preserve any useful information as soon as they discover it, and they must memorialize each step of the collection process".
Thus, preservation for authenticity is the key.