CFE Case Documentation & Evidence Management 3

Question 1

When documenting a digital forensic examination, which element is MOST critical to establish the authenticity of extracted data?

Accepted Answer

Hash values of original and working copies

Answer

Hash values (MD5, SHA-1, or SHA-256) mathematically verify that extracted data is identical to the original, establishing authenticity.

Question 2

A forensic examiner receives evidence in a sealed tamper-evident bag with a broken seal. What is the FIRST action they should take?

Accepted Answer

Document the condition photographically before opening or examining

Answer

The examiner must document the compromised condition with photographs and notes before any further action to preserve the record of the evidence's state upon receipt.

Question 3

Which documentation practice best supports the admissibility of forensic findings in federal court?

Accepted Answer

Maintaining contemporaneous notes recorded during the examination

Answer

Contemporaneous notes made during the examination are the most reliable and defensible form of documentation because they capture real-time observations.

Question 4

In evidence management, 'chain of custody' primarily serves to:

Accepted Answer

Demonstrate that evidence has not been altered or tampered with

Answer

Chain of custody documentation provides a chronological record proving that evidence integrity was maintained from collection through presentation in court.

Question 5

A forensic examiner discovers additional evidence during an examination that was not listed in the original warrant. The BEST course of action is to:

Accepted Answer

Stop, document the discovery, and consult with legal counsel before proceeding

Answer

Examining evidence not covered by the original warrant may constitute an unlawful search; legal guidance must be obtained before proceeding.

(CFE) Certified Forensic Examiner Practice Test

(CFE) Certified Forensic Examiner Practice Test

CFE Case Documentation & Evidence Management 3