Forensic Image Metadata & Authentication Flashcards
7 cards from real CFP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Forensic Image Metadata & Authentication flashcards as text
What does EXIF data embedded in a forensic photograph typically contain?
Answer: Camera make/model, date/time, GPS coordinates, and camera settings
EXIF (Exchangeable Image File Format) data stores technical metadata including camera make/model, date/time of capture, GPS location, aperture, shutter speed, and ISO.
Which cryptographic function is most commonly used to verify the integrity of forensic digital images?
Answer: MD5 or SHA-256 hash algorithm
MD5 and SHA-256 are hash algorithms that generate a unique fixed-length value from image data; any alteration to the file changes its hash, detecting tampering.
What is the primary purpose of computing a hash value immediately after capturing forensic images?
Answer: To establish a baseline for detecting any subsequent alterations to the file
Computing a hash immediately after capture creates a baseline value; if the image is later altered, its recalculated hash will differ, proving tampering occurred.
Which file format is generally preferred for storing forensic photographs because it preserves all original data without lossy compression?
Answer: RAW or TIFF, because they use lossless or no compression
RAW and TIFF formats use lossless or no compression, preserving all original pixel data and embedded metadata, making them the preferred choice for forensic documentation.
What term describes the chronological record documenting who possessed forensic photographic evidence and when?
Answer: Chain of custody
Chain of custody is the chronological documentation showing who collected, handled, transferred, and examined evidence, ensuring its integrity and admissibility in court.
When is the optimal time to record the hash value of a forensic photograph?
Answer: Immediately after capture, before any file transfer or processing
Hash values must be recorded immediately after capture before any file transfer or processing to ensure the baseline represents the original, unaltered image.
What is the evidentiary significance of GPS metadata embedded in forensic photographs?
Answer: It provides verifiable location data that can corroborate crime scene geography
GPS metadata embeds geographic coordinates in the image file, providing verifiable documentation of where the photograph was taken, which can corroborate scene geography in court.