Which option illustrates a key capability local agencies lack when handling cyber evidence?

Which option illustrates a key capability local agencies lack when handling cyber evidence?

• A. Decrypting encrypted computer evidence
• B. Phishing detection
• C. Malware analysis
• D. Social engineering awareness

Answer: (A)

Accessing data locked behind strong encryption is a major roadblock in cyber investigations. When a device or storage is encrypted, the contents remain inaccessible even after seizure unless the investigators have the cryptographic keys or a way to legally compel disclosure, or they can apply advanced cryptanalysis. Local agencies often lack the specialized resources, tooling, and authority needed to break modern encryption, so decrypting encrypted evidence becomes the capability that’s most commonly missing. Phishing detection, malware analysis, and social engineering awareness are areas that can be developed with training, standard procedures, and collaborations, whereas breaking or bypassing strong encryption typically requires resources and legal mechanisms that local agencies may not readily have. That makes decrypting encrypted computer evidence the best fit for what local agencies often struggle with.

Accessing data locked behind strong encryption is a major roadblock in cyber investigations. When a device or storage is encrypted, the contents remain inaccessible even after seizure unless the investigators have the cryptographic keys or a way to legally compel disclosure, or they can apply advanced cryptanalysis. Local agencies often lack the specialized resources, tooling, and authority needed to break modern encryption, so decrypting encrypted evidence becomes the capability that’s most commonly missing.

Phishing detection, malware analysis, and social engineering awareness are areas that can be developed with training, standard procedures, and collaborations, whereas breaking or bypassing strong encryption typically requires resources and legal mechanisms that local agencies may not readily have. That makes decrypting encrypted computer evidence the best fit for what local agencies often struggle with.