CFE Case Documentation & Evidence Management 3 — Questions and Answers
Question 1: When documenting a digital forensic examination, which element is MOST critical to establish the authenticity of extracted data?
- Examiner's years of experience
- Hash values of original and working copies (Correct answer)
- The brand of forensic software used
- Number of witnesses present during extraction
Correct answer: Hash values of original and working copies
Hash values (MD5, SHA-1, or SHA-256) mathematically verify that extracted data is identical to the original, establishing authenticity.
Question 2: A forensic examiner receives evidence in a sealed tamper-evident bag with a broken seal. What is the FIRST action they should take?
- Proceed with examination and note the broken seal in the report
- Document the condition photographically before opening or examining (Correct answer)
- Return the evidence immediately to the submitting agency
- Contact the prosecutor to determine whether to proceed
Correct answer: Document the condition photographically before opening or examining
The examiner must document the compromised condition with photographs and notes before any further action to preserve the record of the evidence's state upon receipt.
Question 3: Which documentation practice best supports the admissibility of forensic findings in federal court?
- Completing all reports from memory after the examination is finished
- Maintaining contemporaneous notes recorded during the examination (Correct answer)
- Using only standardized checklists without narrative description
- Relying solely on automated software-generated logs
Correct answer: Maintaining contemporaneous notes recorded during the examination
Contemporaneous notes made during the examination are the most reliable and defensible form of documentation because they capture real-time observations.
Question 4: In evidence management, 'chain of custody' primarily serves to:
- Limit the number of people who can access the evidence
- Demonstrate that evidence has not been altered or tampered with (Correct answer)
- Reduce the cost of storing physical evidence
- Speed up the process of evidence analysis
Correct answer: Demonstrate that evidence has not been altered or tampered with
Chain of custody documentation provides a chronological record proving that evidence integrity was maintained from collection through presentation in court.
Question 5: A forensic examiner discovers additional evidence during an examination that was not listed in the original warrant. The BEST course of action is to:
- Seize and analyze it immediately since it is within the scope of the case
- Stop, document the discovery, and consult with legal counsel before proceeding (Correct answer)
- Ignore it to avoid complicating the case
- Photograph it only without seizing or documenting in the case file
Correct answer: Stop, document the discovery, and consult with legal counsel before proceeding
Examining evidence not covered by the original warrant may constitute an unlawful search; legal guidance must be obtained before proceeding.
Question 6: When preparing an evidence log for court, which information is LEAST essential to include for each item?
- Date and time of collection
- Name of the collecting officer
- Estimated replacement value of the item (Correct answer)
- Unique identifier or evidence tag number
Correct answer: Estimated replacement value of the item
The replacement value of an evidence item is generally irrelevant to establishing chain of custody or evidentiary integrity.
Question 7: Which standard best describes the documentation requirement for a forensic examiner's case notes?
- Notes should be written so that another qualified examiner could reproduce the examination steps (Correct answer)
- Notes only need to capture the final conclusions reached
- Notes should be kept confidential and never shared with opposing counsel
- Notes are optional if the forensic software generates automated reports
Correct answer: Notes should be written so that another qualified examiner could reproduce the examination steps
Reproducibility is a cornerstone of forensic science; documentation must be detailed enough for another examiner to replicate the process and verify results.
CFE Case Documentation & Evidence Management 3
When documenting a digital forensic examination, which element is MOST critical to establish the authenticity of extracted data?