CFC Evidence Collection & Case Analysis 3 — Questions and Answers
Question 1: When analyzing blood spatter evidence, a 'cast-off' pattern most likely indicates which type of event?
- Blood dripping from a stationary wound
- Blood flung from a weapon during a backswing or follow-through motion (Correct answer)
- Blood transferred by direct contact with a surface
- Blood projected by arterial pressure from a wound
Correct answer: Blood flung from a weapon during a backswing or follow-through motion
Cast-off patterns are created when blood is flung in an arc from a bloody object such as a weapon being swung.
Question 2: A forensic consultant reviewing financial records notices that expense amounts cluster just below $10,000. What fraudulent scheme does this suggest?
- Embezzlement through payroll manipulation
- Structuring (smurfing) to avoid Bank Secrecy Act reporting thresholds (Correct answer)
- Ponzi scheme disguised as legitimate investment returns
- Check kiting using multiple bank accounts
Correct answer: Structuring (smurfing) to avoid Bank Secrecy Act reporting thresholds
Structuring involves breaking transactions into amounts below $10,000 to avoid mandatory CTR filing under the Bank Secrecy Act.
Question 3: Which forensic technique is used to recover deleted files from a hard drive when file system entries have been overwritten?
- Keyword indexing of the file allocation table
- File carving based on file header and footer signatures (Correct answer)
- Registry hive analysis for recently accessed files
- Metadata extraction from shadow copy backups
Correct answer: File carving based on file header and footer signatures
File carving searches raw disk data for known file signatures (headers/footers) to reconstruct files even when directory entries are gone.
Question 4: In conducting a forensic interview, which technique is MOST consistent with evidence-based best practices for obtaining reliable information?
- Confronting the subject immediately with incriminating evidence
- Using open-ended questions and the cognitive interview method (Correct answer)
- Suggesting specific details to trigger memory recall
- Limiting the interview to yes/no questions to reduce contamination
Correct answer: Using open-ended questions and the cognitive interview method
Cognitive interview techniques using open-ended questions are empirically validated to produce more accurate and complete recall.
Question 5: A forensic consultant must testify about digital timestamps found in metadata. Which limitation must the expert disclose to the court?
- Metadata timestamps cannot be used as evidence in federal court
- System clocks can be inaccurate or deliberately manipulated, affecting timestamp reliability (Correct answer)
- Timestamps are only reliable for files created after 2010
- Only government-certified examiners may testify about metadata
Correct answer: System clocks can be inaccurate or deliberately manipulated, affecting timestamp reliability
System clocks may be incorrect or intentionally altered, so metadata timestamps should be corroborated with other evidence rather than treated as absolute.
Question 6: When a forensic case involves both civil and criminal proceedings simultaneously, what is the primary concern for evidence sharing between parties?
- Civil proceedings always take precedence over criminal investigations
- Fifth Amendment protections and potential prejudice to the criminal case from civil discovery (Correct answer)
- Only the party who collected the evidence may use it in both proceedings
- Evidence collected for civil cases is automatically admissible in criminal court
Correct answer: Fifth Amendment protections and potential prejudice to the criminal case from civil discovery
Civil discovery can compel disclosures that implicate Fifth Amendment rights and may compromise a parallel criminal prosecution strategy.
Question 7: A forensic analyst is comparing two questioned signatures against known exemplars. What is the minimum number of known exemplar signatures generally recommended for a reliable comparison?
- One clear original signature
- At least 10-20 known exemplars from the same time period (Correct answer)
- Three signatures from any time period will suffice
- Exactly five signatures per year of the document's date
Correct answer: At least 10-20 known exemplars from the same time period
Forensic document examiners typically require a minimum of 10-20 known exemplars to account for natural variation in an individual's signature.
CFC Evidence Collection & Case Analysis 3
When analyzing blood spatter evidence, a 'cast-off' pattern most likely indicates which type of event?