CFP Forensic Image Metadata & Authentication 1 — Questions and Answers
Question 1: What does EXIF data embedded in a forensic photograph typically contain?
- Only the photographer's name and badge number
- Camera make/model, date/time, GPS coordinates, and camera settings (Correct answer)
- Only the file size and resolution
- Encryption keys and access permissions
Correct answer: Camera make/model, date/time, GPS coordinates, and camera settings
EXIF (Exchangeable Image File Format) data stores technical metadata including camera make/model, date/time of capture, GPS location, aperture, shutter speed, and ISO.
Question 2: Which cryptographic function is most commonly used to verify the integrity of forensic digital images?
- AES-256 encryption algorithm
- MD5 or SHA-256 hash algorithm (Correct answer)
- RSA public-key algorithm
- ZIP compression checksum
Correct answer: MD5 or SHA-256 hash algorithm
MD5 and SHA-256 are hash algorithms that generate a unique fixed-length value from image data; any alteration to the file changes its hash, detecting tampering.
Question 3: What is the primary purpose of computing a hash value immediately after capturing forensic images?
- To compress the image for faster transfer to the evidence lab
- To establish a baseline for detecting any subsequent alterations to the file (Correct answer)
- To automatically back up the image to cloud storage
- To convert the image to a court-admissible file format
Correct answer: To establish a baseline for detecting any subsequent alterations to the file
Computing a hash immediately after capture creates a baseline value; if the image is later altered, its recalculated hash will differ, proving tampering occurred.
Question 4: Which file format is generally preferred for storing forensic photographs because it preserves all original data without lossy compression?
- JPEG, because it is universally compatible with court systems
- GIF, because it supports lossless animation frames
- RAW or TIFF, because they use lossless or no compression (Correct answer)
- BMP without metadata to reduce file size
Correct answer: RAW or TIFF, because they use lossless or no compression
RAW and TIFF formats use lossless or no compression, preserving all original pixel data and embedded metadata, making them the preferred choice for forensic documentation.
Question 5: What term describes the chronological record documenting who possessed forensic photographic evidence and when?
- Evidence manifest
- Chain of custody (Correct answer)
- Forensic audit trail
- Image provenance log
Correct answer: Chain of custody
Chain of custody is the chronological documentation showing who collected, handled, transferred, and examined evidence, ensuring its integrity and admissibility in court.
Question 6: When is the optimal time to record the hash value of a forensic photograph?
- After all images have been reviewed and selected for submission
- Immediately after capture, before any file transfer or processing (Correct answer)
- When submitting the evidence package to the court clerk
- After the investigation has been formally closed
Correct answer: Immediately after capture, before any file transfer or processing
Hash values must be recorded immediately after capture before any file transfer or processing to ensure the baseline represents the original, unaltered image.
Question 7: What is the evidentiary significance of GPS metadata embedded in forensic photographs?
- It determines the correct white balance setting for the scene
- It provides verifiable location data that can corroborate crime scene geography (Correct answer)
- It automatically adjusts exposure compensation for outdoor conditions
- It links the image file to the photographer's professional license number
Correct answer: It provides verifiable location data that can corroborate crime scene geography
GPS metadata embeds geographic coordinates in the image file, providing verifiable documentation of where the photograph was taken, which can corroborate scene geography in court.
CFP Forensic Image Metadata & Authentication 1
What does EXIF data embedded in a forensic photograph typically contain?