ACE Legal, Ethical & Reporting Standards 2 — Questions and Answers
Question 1: Under the Federal Rules of Evidence (FRE) Rule 901, what must a forensic examiner establish before digital evidence is admissible?
- Chain of custody only
- Authentication that the evidence is what it purports to be (Correct answer)
- The evidence was collected by law enforcement
- A court-approved hash algorithm was used
Correct answer: Authentication that the evidence is what it purports to be
FRE Rule 901 requires authentication—demonstrating that the evidence is what the proponent claims it to be.
Question 2: A forensic examiner discovers child exploitation material during a civil litigation investigation. What is the correct course of action?
- Continue the civil investigation and note the finding in the final report
- Immediately delete the material to protect the victim
- Stop examination and report to law enforcement per mandatory reporting obligations (Correct answer)
- Inform only the retaining attorney and await instructions
Correct answer: Stop examination and report to law enforcement per mandatory reporting obligations
Discovery of CSAM triggers mandatory reporting obligations under 18 U.S.C. § 2258A; examiners must stop and report to law enforcement.
Question 3: Which doctrine allows a court to exclude evidence obtained through unlawful means, even if the evidence itself is valid?
- Best Evidence Rule
- Exclusionary Rule (Fruit of the Poisonous Tree) (Correct answer)
- Chain of Custody Doctrine
- Work Product Privilege
Correct answer: Exclusionary Rule (Fruit of the Poisonous Tree)
The Exclusionary Rule, including the 'fruit of the poisonous tree' doctrine, bars admission of evidence derived from unconstitutional searches.
Question 4: When writing a forensic report, an examiner should attribute findings to:
- Personal opinion based on years of experience
- The suspect's known behavior patterns
- Objectively observed artifacts and data with supporting technical detail (Correct answer)
- Information provided by the retaining attorney
Correct answer: Objectively observed artifacts and data with supporting technical detail
Reports must be objective, attributing conclusions to verifiable artifacts and technical findings rather than speculation or hearsay.
Question 5: The Stored Communications Act (18 U.S.C. § 2701) primarily governs:
- Physical search of computing devices at the border
- Law enforcement access to emails and data stored by third-party service providers (Correct answer)
- Chain of custody for cloud-based evidence
- Encryption standards for forensic tools
Correct answer: Law enforcement access to emails and data stored by third-party service providers
The SCA regulates how and when government entities may compel electronic communications providers to disclose stored communications.
Question 6: An examiner working for the defense discovers evidence that clearly inculpates the defendant. Ethically, the examiner should:
- Destroy or withhold the evidence to protect the client
- Disclose the finding to the retaining defense attorney only
- Immediately contact the prosecution directly
- Include the finding in the report and let the attorney decide on disclosure strategy (Correct answer)
Correct answer: Include the finding in the report and let the attorney decide on disclosure strategy
The examiner's ethical duty is to report findings accurately to the retaining counsel; legal strategy decisions belong to the attorney.
Question 7: Which type of legal hold notice is typically issued to preserve electronically stored information (ESI) in anticipation of litigation?
- Search warrant
- Litigation hold (preservation letter) (Correct answer)
- Subpoena duces tecum
- Ex parte order
Correct answer: Litigation hold (preservation letter)
A litigation hold directs parties to preserve potentially relevant ESI once litigation is reasonably anticipated, as required by Federal Rules of Civil Procedure.
ACE Legal, Ethical & Reporting Standards 2
Under the Federal Rules of Evidence (FRE) Rule 901, what must a forensic examiner establish before digital evidence is admissible?