CFE Case Documentation & Evidence Management 4 — Questions and Answers
Question 1: A forensic examiner is testifying and is challenged about a gap in the chain of custody log. The BEST way to address this challenge is to:
- Claim the evidence was never out of control
- Explain what is known and acknowledge the gap while demonstrating overall integrity (Correct answer)
- Refuse to answer and defer all questions to the lead investigator
- Argue that chain of custody is not legally required in this jurisdiction
Correct answer: Explain what is known and acknowledge the gap while demonstrating overall integrity
Honest acknowledgment of a gap, combined with evidence showing overall integrity, is more credible and defensible than denial or deflection.
Question 2: Which type of report is typically provided to the retaining attorney summarizing forensic findings in non-technical language?
- Technical examination report
- Affidavit of authenticity
- Executive summary report (Correct answer)
- Evidence intake form
Correct answer: Executive summary report
An executive summary translates technical forensic findings into accessible language suitable for attorneys, judges, and juries who lack technical expertise.
Question 3: Evidence stored in a property room at incorrect temperature and humidity conditions is MOST problematic for which type of evidence?
- Metal firearms
- Biological and DNA evidence (Correct answer)
- Paper documents with ballpoint ink
- Hard drive platters
Correct answer: Biological and DNA evidence
Biological evidence degrades rapidly under improper temperature and humidity conditions, potentially destroying DNA that is critical to a case.
Question 4: Under Federal Rules of Evidence Rule 803(6), business records may be admitted as an exception to hearsay if they were:
- Created by a government agency rather than a private business
- Made at or near the time of the recorded act by a person with knowledge in the regular course of business (Correct answer)
- Verified by a notary public before submission
- Stored in an unaltered digital format for at least five years
Correct answer: Made at or near the time of the recorded act by a person with knowledge in the regular course of business
FRE 803(6) requires that business records be made contemporaneously by a knowledgeable person as part of a regular business practice.
Question 5: Which documentation element distinguishes a forensic report from a standard investigative report?
- Inclusion of the examiner's personal opinion about guilt or innocence
- Objective methodology, limitations of findings, and reproducible procedures (Correct answer)
- A summary of all investigative leads developed during the case
- Witness statements collected during interviews
Correct answer: Objective methodology, limitations of findings, and reproducible procedures
Forensic reports must detail objective methods, acknowledge limitations, and describe procedures in enough detail to allow independent verification.
Question 6: When an examiner makes an error in a written case report, the CORRECT way to correct it is to:
- Use correction fluid (white-out) to cover the error neatly
- Completely rewrite the document from scratch
- Draw a single line through the error, write the correction, and initial and date it (Correct answer)
- Delete the original document and replace it with a corrected version
Correct answer: Draw a single line through the error, write the correction, and initial and date it
A single strikethrough with initials and date maintains the original text's visibility and creates a transparent, auditable correction record.
Question 7: In digital forensics, a 'write blocker' is primarily documented in case notes because it:
- Speeds up the forensic imaging process significantly
- Prevents any modification to the original evidence during acquisition (Correct answer)
- Compresses the forensic image to save storage space
- Automatically generates a chain of custody log
Correct answer: Prevents any modification to the original evidence during acquisition
Write blockers prevent any data from being written to original evidence media, preserving its integrity during the acquisition process.
CFE Case Documentation & Evidence Management 4
A forensic examiner is testifying and is challenged about a gap in the chain of custody log.
The BEST way to address this challenge is to: