CFC Evidence Collection & Case Analysis 2

Question 1

When collecting digital evidence from a suspect's smartphone, which technique best preserves data integrity?

Accepted Answer

Creating a forensic image using write-blocking hardware before any analysis

Answer

Write-blocking hardware prevents any data from being written to the device during imaging, preserving original evidence integrity.

Question 2

A forensic consultant discovers that a key witness has stored relevant emails on a third-party cloud server outside the U.S. What is the primary legal mechanism for obtaining this data?

Accepted Answer

Mutual Legal Assistance Treaty (MLAT) or letters rogatory

Answer

MLATs and letters rogatory are the proper international legal mechanisms for obtaining evidence stored in foreign jurisdictions.

Question 3

Which of the following BEST describes the 'Locard's Exchange Principle' as applied to forensic evidence collection?

Accepted Answer

Every contact between two objects results in an exchange of material

Answer

Locard's Exchange Principle states that whenever two objects come into contact, each transfers material to the other.

Question 4

During case analysis, a forensic consultant notes that two independent witnesses provided nearly identical accounts using the same unusual phrasing. What does this suggest?

Accepted Answer

The witnesses may have coordinated their stories or been coached

Answer

Suspiciously identical language between independent witnesses is a red flag that accounts may have been coordinated or rehearsed.

Question 5

In forensic document examination, what is 'indented writing' analysis used to detect?

Accepted Answer

Impressions left on underlying pages from writing on a page above

Answer

Indented writing analysis uses tools like the ESDA to reveal impressions left on paper beneath the sheet that was actually written on.

(CFC) Certified Forensic Consultant Practice Test

(CFC) Certified Forensic Consultant Practice Test

CFC Evidence Collection & Case Analysis 2