CSL CSL Digital Evidence & Forensics Law 1 — Questions and Answers
Question 1: Under the Federal Rules of Evidence, which standard governs the admissibility of digital evidence in U.S. federal courts?
- Daubert standard (Correct answer)
- Frye standard
- Exclusionary rule
- Chain of custody rule
Correct answer: Daubert standard
The Daubert standard requires that expert testimony and scientific evidence, including digital forensics, be based on sufficient facts and reliable methodology.
Question 2: What legal doctrine requires investigators to document every person who had access to digital evidence from collection through trial?
- Best evidence rule
- Chain of custody (Correct answer)
- Work product doctrine
- Spoliation doctrine
Correct answer: Chain of custody
Chain of custody documents every handler of evidence to prove it was not tampered with between collection and presentation in court.
Question 3: Which federal statute makes it a crime to intentionally destroy evidence that may be relevant to a federal investigation?
- 18 U.S.C. § 1030
- 18 U.S.C. § 1519 (Correct answer)
- 18 U.S.C. § 2511
- 18 U.S.C. § 1343
Correct answer: 18 U.S.C. § 1519
18 U.S.C. § 1519 criminalizes knowingly altering, destroying, or concealing records to impede a federal investigation.
Question 4: What is the legal term for the obligation to preserve evidence once litigation is reasonably anticipated?
- Discovery hold
- Litigation hold (Correct answer)
- Preservation order
- Evidence freeze
Correct answer: Litigation hold
A litigation hold is a legal obligation requiring organizations to preserve all potentially relevant evidence once litigation is reasonably anticipated.
Question 5: Under the Electronic Communications Privacy Act (ECPA), what is required before law enforcement can access stored electronic communications older than 180 days?
- Subpoena only
- Search warrant (Correct answer)
- Court order under 18 U.S.C. § 2703(d)
- Written consent of the provider
Correct answer: Search warrant
Following the Sixth Circuit's Warshak decision and DOJ policy, a search warrant based on probable cause is required to access stored email content regardless of age.
Question 6: Which forensic principle holds that every contact between two items leaves a trace that can be used as evidence?
- Locard's Exchange Principle (Correct answer)
- Best evidence rule
- Digital provenance theory
- Inkulsky's theorem
Correct answer: Locard's Exchange Principle
Locard's Exchange Principle, developed by forensic scientist Edmond Locard, states that every contact leaves a trace transferable between objects.
CSL CSL Digital Evidence & Forensics Law 1
Under the Federal Rules of Evidence, which standard governs the admissibility of digital evidence in U.S. federal courts?