CFC Evidence Collection & Case Analysis 2 — Questions and Answers
Question 1: When collecting digital evidence from a suspect's smartphone, which technique best preserves data integrity?
- Directly browsing device contents and copying files manually
- Creating a forensic image using write-blocking hardware before any analysis (Correct answer)
- Charging the device and backing it up to iCloud for convenience
- Resetting the device to factory settings after documenting the screen
Correct answer: Creating a forensic image using write-blocking hardware before any analysis
Write-blocking hardware prevents any data from being written to the device during imaging, preserving original evidence integrity.
Question 2: A forensic consultant discovers that a key witness has stored relevant emails on a third-party cloud server outside the U.S. What is the primary legal mechanism for obtaining this data?
- Subpoena issued directly to the witness
- Mutual Legal Assistance Treaty (MLAT) or letters rogatory (Correct answer)
- A domestic search warrant served to the cloud provider's U.S. office
- Informal request to the foreign government via email
Correct answer: Mutual Legal Assistance Treaty (MLAT) or letters rogatory
MLATs and letters rogatory are the proper international legal mechanisms for obtaining evidence stored in foreign jurisdictions.
Question 3: Which of the following BEST describes the 'Locard's Exchange Principle' as applied to forensic evidence collection?
- Every crime scene produces unique DNA evidence that can identify the perpetrator
- Every contact between two objects results in an exchange of material (Correct answer)
- Witnesses always leave behind behavioral impressions at crime scenes
- Physical evidence must be photographed before it can be collected
Correct answer: Every contact between two objects results in an exchange of material
Locard's Exchange Principle states that whenever two objects come into contact, each transfers material to the other.
Question 4: During case analysis, a forensic consultant notes that two independent witnesses provided nearly identical accounts using the same unusual phrasing. What does this suggest?
- The witnesses are telling the truth because their accounts match
- The witnesses may have coordinated their stories or been coached (Correct answer)
- Identical phrasing indicates superior memory recall
- The investigator should dismiss one account as redundant
Correct answer: The witnesses may have coordinated their stories or been coached
Suspiciously identical language between independent witnesses is a red flag that accounts may have been coordinated or rehearsed.
Question 5: In forensic document examination, what is 'indented writing' analysis used to detect?
- Forged signatures on legal contracts
- Impressions left on underlying pages from writing on a page above (Correct answer)
- Alterations made with chemical erasure agents
- Ink composition differences between documents
Correct answer: Impressions left on underlying pages from writing on a page above
Indented writing analysis uses tools like the ESDA to reveal impressions left on paper beneath the sheet that was actually written on.
Question 6: A forensic consultant is asked to reconstruct a fire scene. Which type of evidence would most reliably indicate the fire's point of origin?
- Eyewitness accounts of the direction smoke was traveling
- Char patterns, burn depth variations, and V-shaped burn marks (Correct answer)
- The location where the most firefighters were stationed
- Residual odor of accelerants detected by rescue dogs only
Correct answer: Char patterns, burn depth variations, and V-shaped burn marks
Char patterns, burn depth, and V-shaped burn marks provide physical indicators that help reconstruct fire progression back to its origin.
Question 7: What is the purpose of a 'chain of custody' document in forensic case management?
- To list all investigators who worked on the case for billing purposes
- To chronologically record every person who accessed, handled, or transferred evidence (Correct answer)
- To summarize the legal arguments presented at trial
- To document the sequence of forensic laboratory tests performed
Correct answer: To chronologically record every person who accessed, handled, or transferred evidence
Chain of custody documents create an unbroken record of evidence possession, handling, and transfer to ensure admissibility.
CFC Evidence Collection & Case Analysis 2
When collecting digital evidence from a suspect's smartphone, which technique best preserves data integrity?