CFC Evidence Collection & Case Analysis 5 — Questions and Answers
Question 1: A forensic consultant is analyzing a questioned will to determine if it was backdated. Which physical evidence would be MOST probative?
- The number of witnesses who signed the document
- Ink chemistry analysis showing ink components not commercially available until after the document's stated date (Correct answer)
- The paper color and general appearance of aging
- Testimony from the attorney who drafted the will
Correct answer: Ink chemistry analysis showing ink components not commercially available until after the document's stated date
Ink dating using chemical analysis can identify components introduced to the market after a document's purported date, proving backdating.
Question 2: During an autopsy-linked forensic investigation, a consultant needs to determine if injuries are consistent with a fall or a beating. Which characteristic BEST differentiates defensive wounds from impact injuries?
- Defensive wounds are always deeper than offensive injuries
- Defensive wounds typically appear on forearms, hands, and outer aspects of arms from protective posturing (Correct answer)
- Defensive wounds are always located on the back of the victim
- Only blunt force trauma produces defensive wounds
Correct answer: Defensive wounds typically appear on forearms, hands, and outer aspects of arms from protective posturing
Defensive wounds occur on the forearms, palms, and outer arms because victims instinctively raise their arms to protect themselves from blows.
Question 3: A forensic consultant analyzing network intrusion evidence discovers logs showing repeated failed login attempts followed by a successful login. What attack pattern does this indicate?
- SQL injection targeting the authentication database
- Brute-force or credential stuffing attack (Correct answer)
- Man-in-the-middle interception of credentials in transit
- Phishing attack that harvested credentials externally
Correct answer: Brute-force or credential stuffing attack
Multiple failed login attempts followed by success is the hallmark signature of a brute-force or credential stuffing attack.
Question 4: In forensic accounting, the 'net worth method' for detecting unreported income compares which two factors?
- Gross income against adjusted gross income across tax years
- Increase in net worth plus personal living expenses against known legitimate income sources (Correct answer)
- Business revenue against industry average profit margins
- Total assets against total declared liabilities on a balance sheet
Correct answer: Increase in net worth plus personal living expenses against known legitimate income sources
The net worth method detects unreported income by showing that a taxpayer's wealth increased and expenses were incurred beyond what their reported income could explain.
Question 5: A forensic consultant is asked to review surveillance footage as evidence. Which factor would MOST undermine the footage's evidentiary value?
- The footage was recorded in color rather than black and white
- A gap in the recording timestamp sequence suggesting possible deletion or editing (Correct answer)
- The camera used a wide-angle lens that distorts proportions
- The footage was stored on a proprietary format requiring special software to view
Correct answer: A gap in the recording timestamp sequence suggesting possible deletion or editing
Timestamp gaps in surveillance footage suggest potential tampering, raising serious questions about the recording's authenticity and completeness.
Question 6: When a forensic consultant performs a scene reconstruction, which principle requires that the reconstruction be consistent with ALL physical evidence rather than selectively applied?
- Principle of uniqueness — each scene has one true reconstruction
- Principle of parsimony — the simplest explanation consistent with all evidence is preferred (Correct answer)
- Principle of exclusion — alternative scenarios must be tested and eliminated
- Principle of corroboration — every finding must be confirmed by a second analyst
Correct answer: Principle of parsimony — the simplest explanation consistent with all evidence is preferred
The principle of parsimony (Occam's Razor) directs forensic analysts to prefer the simplest explanation that accounts for all observed evidence without unnecessary assumptions.
Question 7: A forensic consultant working a vehicular accident case needs to determine vehicle speed at impact. Which type of physical evidence provides the MOST reliable pre-braking speed calculation?
- Eyewitness estimates of how fast the vehicle appeared to be moving
- Tire skid mark length combined with road surface friction coefficient (Correct answer)
- Damage to the vehicle's front bumper and hood
- The posted speed limit on the road where the accident occurred
Correct answer: Tire skid mark length combined with road surface friction coefficient
Skid mark length combined with known road surface friction coefficients can be used in standard deceleration formulas to calculate minimum pre-braking speed.
CFC Evidence Collection & Case Analysis 5
A forensic consultant is analyzing a questioned will to determine if it was backdated.
Which physical evidence would be MOST probative?