I85PREP
⌘ K
CCFH study materials
CCFH study resources

CCFH practice questions

One question at a time. Build your CCFH understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Forensic Science and Legal Foundations

Under the Daubert framework as later consolidated in Kumho Tire, a trial judge's gatekeeping obligation for expert testimony applies to which category of evidence?

  1. All expert testimony, including experience-based and technical testimony Correct answer.
  2. Only testimony offered by prosecution experts in criminal cases
  3. Only testimony based on scientific methodology
  4. Only testimony where the parties have requested a pretrial hearing

Explanation

Kumho Tire extended the trial court's gatekeeping duty beyond strictly scientific evidence to all expert testimony, including skill- or experience-based testimony. The judge may use the Daubert factors where they fit but retains discretion to tailor the reliability inquiry.

Question 2Forensic Science and Legal Foundations

In forensic science, the term 'individualization' most precisely refers to which of the following?

  1. Documenting the chain of custody for an evidence item
  2. Determining that a particular item is the unique source of a trace Correct answer.
  3. Establishing that a sample belongs to a broad class of materials
  4. Estimating the frequency of a genetic marker in a population

Explanation

Individualization is the inference that a trace originated from one specific source to the exclusion of all others, distinguishing it from classification into a group. Class association places an item in a category, while individualization asserts uniqueness of source.

Question 3Forensic Science and Legal Foundations

A forensic laboratory reports a likelihood ratio of 1,000 for a DNA comparison. Which statement correctly interprets this value?

  1. The suspect's profile matches the evidence with 99.9% certainty
  2. The chance of a random match in the population is one in 1,000
  3. The observed profile is 1,000 times more probable under the prosecution hypothesis than under the defense hypothesis Correct answer.
  4. There is a 99.9% probability that the suspect is the source of the sample

Explanation

A likelihood ratio compares the probability of the evidence under two competing propositions, not the probability that a proposition is true. The value of 1,000 means the evidence is 1,000 times more likely under one hypothesis than the other. Converting it into a probability of guilt requires prior odds via Bayes' theorem.

Question 4Forensic Science and Legal Foundations

Which best describes the 'prosecutor's fallacy' in presenting forensic statistics?

  1. Presenting a statistical result without qualifying the analyst as an expert
  2. Failing to disclose exculpatory laboratory results to the defense
  3. Treating the random match probability as the probability that the defendant is innocent Correct answer.
  4. Overstating the discriminating power of a test in closing argument

Explanation

The prosecutor's fallacy transposes the conditional probability, equating the chance of a coincidental match with the chance the defendant is innocent. The correct interpretation compares the evidence under competing propositions rather than assigning a probability of guilt directly from a match statistic.

Question 5Forensic Science and Legal Foundations

Under Federal Rule of Evidence 702, which requirement was clarified by the 2000 amendment regarding the basis of an expert's opinion?

  1. The expert must personally have examined the physical evidence
  2. The expert must publish peer-reviewed research on the technique used
  3. The testimony must be based on sufficient facts or data and reliable principles and methods reliably applied Correct answer.
  4. The expert must be licensed in the jurisdiction where the case is tried

Explanation

The amended Rule 702 codifies the reliability inquiry: the testimony must rest on sufficient facts or data, be the product of reliable principles and methods, and reflect a reliable application of those methods to the facts. It does not demand personal examination, licensure, or publication.

Question 6Forensic Science and Legal Foundations

A defense expert seeks to testify that the defendant's confession was coerced. How do most U.S. courts treat such proposed expert testimony?

  1. It is generally excluded because it addresses the ultimate issue of voluntariness reserved to the jury Correct answer.
  2. It is admissible only if the expert is a licensed psychologist
  3. It is admissible only in federal court under Rule 704
  4. It is freely admissible because the defense may present any relevant expert opinion

Explanation

Courts commonly exclude expert testimony on the voluntariness of a confession because it invades the jury's province to assess credibility and the ultimate legal issue. Rule 704 permits opinions on ultimate issues generally, but courts carve out testimony that merely tells the jury what result to reach on confession reliability.

Question 7Forensic Science and Legal Foundations

What is the primary purpose of establishing a chain of custody for physical evidence?

  1. To establish the qualifications of the forensic analyst
  2. To determine the admissibility of the defendant's statements
  3. To prove that the evidence is relevant to the charged offense
  4. To document continuous control and account for any changes to the item Correct answer.

Explanation

A chain of custody documents each transfer and storage of an item so the court can assess whether the evidence is in substantially the same condition as when collected. Gaps or unexplained changes can support an objection that the item has been altered or tampered with.

Question 8Forensic Science and Legal Foundations

In the United States, which standard governs the admissibility of scientific evidence in federal courts following Daubert?

  1. The unanimous agreement of a peer review panel
  2. The trial judge's discretionary reliability determination Correct answer.
  3. A statutory list of approved forensic techniques
  4. The general acceptance standard of Frye

Explanation

Daubert replaced Frye's general acceptance test in federal courts with a flexible reliability inquiry entrusted to the trial judge's discretion. General acceptance remains one factor among several rather than the controlling standard.

Question 9Forensic Science and Legal Foundations

Which of the following best characterizes the difference between a forensic 'class characteristic' and an 'individual characteristic'?

  1. Class characteristics apply only to biological evidence, while individual characteristics apply only to trace evidence
  2. Class characteristics are unique to one source, while individual characteristics are shared by groups
  3. Class characteristics require statistical analysis, while individual characteristics require none
  4. Class characteristics are shared by a group, while individual characteristics tend to narrow to a single source Correct answer.

Explanation

Class characteristics place an item in a group of items sharing features such as manufacturing type or model. Individual characteristics are features that, in combination, tend to distinguish one specific source from others.

Question 10Forensic Science and Legal Foundations

An examiner opines that two bullets 'were fired from the same firearm to the exclusion of all other firearms.' Which criticism of this statement is most consistent with current forensic science scholarship?

  1. It overstates certainty because the underlying comparison relies on subjective feature assessment without known error rates Correct answer.
  2. It is improper because the examiner did not personally fire the weapon
  3. It is improper because only class characteristics may be reported in firearms cases
  4. It is improper because firearms examinations can never associate a bullet with a firearm

Explanation

Critics argue that source-attribution conclusions stated as absolute overstate the strength of subjective pattern comparisons whose error rates are not well established. Many laboratories have moved toward reporting the strength of association in more measured terms.

Question 11Forensic Science and Legal Foundations

Which legal doctrine allows a party to obtain an opposing expert's draft reports and communications with counsel only in limited circumstances?

  1. The work-product doctrine as applied to testifying experts Correct answer.
  2. The doctrine of chances
  3. The best evidence rule
  4. The rule of completeness

Explanation

Federal Rule of Civil Procedure 26 generally protects draft expert reports and most attorney-expert communications as work product, while requiring disclosure of the expert's opinions and the facts or data considered. The protection balances discovery of the expert's substantive basis against counsel's litigation preparation.

Question 12Forensic Science and Legal Foundations

In a criminal case, the defense requests funding for a forensic expert to rebut the prosecution's DNA evidence. Which constitutional principle is most directly implicated?

  1. The right to due process and a fair opportunity to present a defense Correct answer.
  2. The right to a public trial
  3. The right against self-incrimination
  4. The right to a speedy trial

Explanation

Ake v. Oklahoma recognized that due process may require the state to provide expert assistance when an indigent defendant's defense hinges on a scientific issue the state has the resources to contest. Denial of such assistance can deprive the defendant of a fair opportunity to present a defense.

Question 13Forensic Science and Legal Foundations

Forensic anthropologists estimating ancestry from skeletal remains should be most cautious about which issue?

  1. Ancestry estimates describe population affinities and do not establish race or identity Correct answer.
  2. Ancestry can only be estimated from dental evidence
  3. Ancestry estimation is prohibited in forensic casework
  4. Skeletal measurements cannot be taken reliably

Explanation

Ancestry estimation in forensic anthropology reflects statistical population affinity based on skeletal traits, not a biological category of race. Overstating the meaning of ancestry estimates can mislead investigations and jurors.

Question 14Forensic Science and Legal Foundations

Which statement accurately describes the concept of 'contextual bias' in forensic examination?

  1. It refers to the effect of laboratory temperature on test results
  2. It refers to the influence of extraneous case information on an examiner's judgments Correct answer.
  3. It refers to the tendency of juries to overvalue eyewitness testimony
  4. It refers to the tendency of examiners to work faster under deadline pressure

Explanation

Contextual bias occurs when information outside the physical evidence, such as a suspect confession or investigator expectations, influences an examiner's interpretation. Linear sequential unmasking and blind verification are procedural safeguards intended to limit such influence.

Question 15Forensic Science and Legal Foundations

A court excludes a novel forensic technique because it has never been subjected to controlled studies and no published error rate exists. Which Daubert factor most directly supports the exclusion?

  1. Whether the technique was developed for litigation
  2. Whether the expert has a financial interest in the outcome
  3. Whether the technique can be and has been tested Correct answer.
  4. Whether the technique enjoys general acceptance

Explanation

Testability is a core Daubert factor, and a technique lacking controlled testing and known error rates is vulnerable to exclusion on that ground. The absence of validation studies undercuts the reliability showing the proponent must make.

Question 16Forensic Science and Legal Foundations

Which of the following is the most accurate statement about the role of the forensic examiner as a witness?

  1. The examiner's duty is to present findings impartially to the trier of fact Correct answer.
  2. The examiner should advocate for the side that retained them
  3. The examiner should withhold findings that weaken the retaining party's case
  4. The examiner should offer legal conclusions about guilt or innocence

Explanation

Forensic examiners owe a duty of impartiality to the court and should report findings, including limitations and exculpatory results, regardless of which party retained them. Offering legal conclusions exceeds the proper scope of expert testimony.

Question 17Forensic Science and Legal Foundations

Under the 'corpus delicti' rule, what must the prosecution establish independently of a defendant's confession?

  1. That the defendant was advised of Miranda rights
  2. That the offense charged actually occurred Correct answer.
  3. That the defendant had a motive to commit the offense
  4. That physical evidence links the defendant to the scene

Explanation

The corpus delicti rule requires independent evidence that the crime charged was committed before a confession may be admitted or relied upon. It guards against convicting a defendant based solely on an uncorroborated admission.

Question 18Forensic Science and Legal Foundations

What does the term 'triage' refer to in forensic laboratory casework?

  1. The process of destroying evidence after a case is closed
  2. The process of prioritizing cases and evidence for examination based on investigative and legal needs Correct answer.
  3. The process of calibrating laboratory instruments
  4. The process of certifying examiners for courtroom testimony

Explanation

Triage is the systematic prioritization of submissions so that limited laboratory resources address the most probative or time-sensitive evidence first. It is a management practice that should be documented and applied consistently.

Question 19Forensic Science and Legal Foundations

Which principle underlies the requirement that forensic laboratories follow validated standard operating procedures?

  1. Ensuring that results are reproducible and defensible across analysts and cases Correct answer.
  2. Allowing examiners to exercise unrestricted discretion
  3. Reducing the cost of laboratory supplies
  4. Eliminating the need for expert testimony in court

Explanation

Validated procedures promote consistency and reproducibility so that conclusions do not depend on the idiosyncrasies of a particular analyst. They also make the basis of results transparent and reviewable when challenged in court.

Question 20Forensic Science and Legal Foundations

A forensic report states an opinion of 'match' without any statement of the limitations or the basis for the conclusion. Which professional standard is most directly implicated?

  1. The requirement that reports be written by an attorney
  2. The requirement that reports be complete, accurate, and transparent about limitations Correct answer.
  3. The requirement that reports be filed within twenty-four hours
  4. The requirement that reports be notarized

Explanation

Professional reporting standards require examiners to state the basis, results, and limitations of their conclusions so the report can be evaluated fairly. An unqualified 'match' without disclosed limitations is misleading and undermines reviewability.

Question 21Forensic Science and Legal Foundations

In the context of forensic testimony, what does 'ultimate issue' refer to?

  1. The final laboratory test performed on an item
  2. The last exhibit introduced at trial
  3. The final question the jury must decide, such as guilt or the identity of the source Correct answer.
  4. The closing argument delivered by counsel

Explanation

The ultimate issue is the question reserved for the trier of fact, such as whether the defendant is guilty or whether a particular person is the source. Expert testimony may inform that question but should not simply answer it for the jury.

Question 22Forensic Science and Legal Foundations

Which of the following best explains why forensic laboratories participate in proficiency testing?

  1. To replace the need for case review
  2. To generate revenue from external agencies
  3. To satisfy insurance requirements
  4. To evaluate examiner performance against known-result samples and identify systematic errors Correct answer.

Explanation

Proficiency testing provides external samples with known results so that a laboratory can detect examiner or method errors and take corrective action. It is a central component of quality assurance and accreditation.

Question 23Forensic Science and Legal Foundations

A judge must decide whether to admit testimony about a technique that has been used for decades but never subjected to empirical validation. Which approach best reflects the Daubert inquiry?

  1. Defer entirely to the examiner's professional opinion
  2. Exclude automatically because validation is absent
  3. Admit automatically because long use proves reliability
  4. Weigh the absence of validation against other factors such as peer review and known error rates Correct answer.

Explanation

Daubert requires a flexible, case-specific balancing of factors rather than automatic admission or exclusion. Long use without validation may weaken the reliability showing, but the court should consider the full set of factors.

Question 24Forensic Science and Legal Foundations

What is the primary function of a technical review in forensic casework?

  1. To confirm the billing accuracy of the case
  2. To schedule the case for trial
  3. To determine the defendant's guilt or innocence
  4. To verify the scientific basis and conclusions of a case before release Correct answer.

Explanation

Technical review is an independent evaluation of the analytical work and conclusions by a qualified examiner before the report is released. It helps catch errors and ensures the conclusions are supported by the data.

Question 25Digital Evidence Handling and Chain of Custody

During a forensic examination, an investigator photographs a laptop exactly as found on the desk, then documents its position, connected cables, and visible screen state before touching it. Which chain-of-custody principle does this action primarily support?

  1. Documenting the scene and item state before any alteration Correct answer.
  2. Verifying the device's storage capacity before imaging
  3. Confirming the device is powered off for safe transport
  4. Establishing the suspect's motive through physical positioning

Explanation

Chain of custody depends on a documented, unaltered record of the item's condition and location at each stage. Photographing and noting the as-found state before handling preserves evidence of the original scene and guards against later challenges that the item was changed.

Question 26Digital Evidence Handling and Chain of Custody

A seized smartphone must be transported to the lab. Which practice best preserves both the evidence and its custody record?

  1. Remove the SIM card at the scene and discard it to prevent network access
  2. Place it in a shielded bag, seal it, and record the seal identifier and handler on the custody form Correct answer.
  3. Wrap it in a plain envelope and hand it to any available officer without paperwork
  4. Leave it connected to a charger in the vehicle so the battery does not drain

Explanation

Isolation from radio networks plus a documented, tamper-evident seal preserves both the data and the accountability trail. Recording the seal number and each handler allows any later break in the seal to be detected and attributed.

Question 27Digital Evidence Handling and Chain of Custody

What is the primary purpose of maintaining a chain of custody for digital evidence?

  1. To replace the need for a written forensic examination report
  2. To guarantee that the suspect will plead guilty at trial
  3. To demonstrate that the evidence is authentic and has not been altered Correct answer.
  4. To reduce the amount of storage needed for forensic images

Explanation

A chain of custody is the documented history of who handled an item, when, and under what conditions. It supports authentication by showing the evidence presented is the same item collected and that opportunities for tampering were controlled.

Question 28Digital Evidence Handling and Chain of Custody

An examiner receives a sealed evidence bag whose seal is intact and matches the number on the transfer form. What is the correct next step before opening it?

  1. Open the bag immediately and begin imaging to save time
  2. Photograph the bag and then discard the transfer form as redundant
  3. Record the receipt, seal number, date, and receiving examiner on the custody form Correct answer.
  4. Return the bag unopened because seals must never be broken

Explanation

Receipt must be documented in the custody record before the seal is broken, capturing seal integrity and the identity of the receiver. This creates a continuous, auditable transition between the transferring and receiving parties.

Question 29Digital Evidence Handling and Chain of Custody

Which item is the best choice for recording the unique identity of a seized hard drive in the custody documentation?

  1. The color of the drive's label
  2. The name of the retail store that sold the drive
  3. The drive's serial number and manufacturer model Correct answer.
  4. The physical weight of the drive in grams

Explanation

Serial number and model provide a stable, verifiable identifier that distinguishes this drive from others of the same type. This identifier is what allows later verification that the examined item is the seized item.

Question 30Digital Evidence Handling and Chain of Custody

A custody form shows the evidence transferred from Officer A to Examiner B on Monday, then from Examiner B to storage on Wednesday, with no entry for Tuesday. What does this gap most directly affect?

  1. The admissibility of the suspect's statements
  2. The continuity of the record, which must be explained or resolved Correct answer.
  3. The file system type of the examined device
  4. The hash value of the forensic image

Explanation

A missing interval leaves a period in which the location and handling of the item are undocumented. Continuity requires an unbroken account, so the gap must be explained, for example by showing the item was secured and untouched.

Question 31Digital Evidence Handling and Chain of Custody

Which action correctly creates a tamper-evident seal on a package of digital evidence?

  1. Taping the box closed with clear tape and writing initials on the tape
  2. Placing the box in a locker and telling a colleague where it is
  3. Stapling the box shut and noting the date on a separate sticky note
  4. Applying a uniquely numbered seal across the closure and recording that number on the custody form Correct answer.

Explanation

A tamper-evident seal must be uniquely identifiable and its identifier recorded so any later break can be detected and traced. Writing the number on the custody form links the physical seal to the documentary record.

Question 32Digital Evidence Handling and Chain of Custody

Why should a forensic examiner avoid working directly on original digital evidence media?

  1. Working on a verified copy preserves the original for re-examination and rebuttal Correct answer.
  2. Original media cannot be read by forensic tools
  3. Originals must remain powered on at all times
  4. Copies are always smaller and easier to store

Explanation

Analysis on a verified duplicate leaves the original untouched so it can be re-examined or produced later if findings are challenged. The verification step ensures the copy is a faithful representation of the original.

Question 33Digital Evidence Handling and Chain of Custody

An examiner images a suspect drive and computes a SHA-256 hash of the source and the image, which match. What does this matching hash primarily demonstrate?

  1. The image can be edited without affecting the hash
  2. The suspect used the drive within the last 24 hours
  3. The image is a bit-for-bit duplicate of the source at the time of acquisition Correct answer.
  4. The source drive contained no deleted files

Explanation

A matching cryptographic hash across source and image shows the acquired data is identical to the original at acquisition time. Hash verification is the standard integrity check recorded in custody and examination documentation.

Question 34Digital Evidence Handling and Chain of Custody

A defense challenge alleges the forensic image was altered after acquisition. Which record best rebuts this by showing the image remained unchanged through analysis?

  1. Producing the original packaging photographs
  2. Re-computing the image hash at each transfer and comparing it to the acquisition hash Correct answer.
  3. Showing the examiner's professional certification
  4. Listing the tools installed on the examination workstation

Explanation

Repeated hash verification at handoffs demonstrates the image data stayed identical throughout the custody period. Comparison against the acquisition hash anchors each later check to the verified original.

Question 35Digital Evidence Handling and Chain of Custody

During acquisition, the write blocker reports a write attempt from the imaging workstation. What is the most appropriate response?

  1. Power cycle the suspect drive to clear the error
  2. Stop, document the event, verify the source was not modified, and re-establish a proper write-blocked connection Correct answer.
  3. Continue imaging and note the event only if the hash later fails
  4. Ignore the message because write blockers always log false alarms

Explanation

An unexpected write attempt is a potential integrity event that must be halted, recorded, and investigated before proceeding. Confirming the source was not modified, for example by hash comparison, protects the evidence and the record.

Question 36Digital Evidence Handling and Chain of Custody

An investigator needs to collect volatile data from a running server that cannot be shut down. How should the custody record reflect this?

  1. Defer all documentation until after the server is decommissioned
  2. Note that no custody record is needed because the system stayed running
  3. Record only the final report date, since volatile data cannot be evidence
  4. Document the collection order, commands used, timestamps, and the reason the system could not be powered down Correct answer.

Explanation

Live collection alters system state, so the record must capture what was done, in what order, and why live acquisition was necessary. This contemporaneous detail lets others assess how the collection may have affected the data.

Question 37Digital Evidence Handling and Chain of Custody

Two examiners must both access the same evidence image over several days. Which practice best maintains accountability?

  1. Log each access with examiner identity, date, time, purpose, and the hash verified at access Correct answer.
  2. Restrict access to one examiner and forbid any second review
  3. Copy the image to personal drives for each examiner without records
  4. Allow access without logging because the image is read-only

Explanation

Even read-only access should be tracked so the history of who examined the data and when is reconstructable. Recording a verified hash at access time also confirms the data was unchanged between sessions.

Question 38Digital Evidence Handling and Chain of Custody

A courier delivers a sealed evidence package to the laboratory. The receiving technician notices the seal number differs from the one on the accompanying transfer form. What should the technician do first?

  1. Refuse the package and send it back with no written record
  2. Open the package to check whether the contents look correct
  3. Quarantine the package, document the discrepancy, and notify the sender before opening Correct answer.
  4. Overwrite the form with the new seal number to match the package

Explanation

A seal mismatch is a documented integrity concern that must be preserved and escalated, not resolved informally. Quarantining and notifying the sender keeps the discrepancy visible and protects any subsequent investigation.

Question 39Digital Evidence Handling and Chain of Custody

Which entry belongs on a properly maintained chain-of-custody form for a seized USB drive?

  1. The examiner's opinion about the suspect's guilt
  2. A summary of every file found on the drive
  3. Date and time of each transfer, releasing and receiving person, purpose, and storage location Correct answer.
  4. The retail price of the drive when purchased

Explanation

The custody form records the movement and accountability of the item: who released it, who received it, when, and where it was kept. Analytical findings and opinions belong in the examination report, not the custody log.

Question 40Digital Evidence Handling and Chain of Custody

An examiner discovers that a prior handler stored the evidence in an unlocked cabinet overnight. How should this be addressed in the documentation?

  1. Replace the prior handler's name on the form with the examiner's
  2. Record the facts of the storage deviation and any verification performed to confirm integrity Correct answer.
  3. Omit the detail because the seal remained intact
  4. State that storage was secure to avoid complicating the case

Explanation

Deviations from proper storage must be documented factually so their significance can be assessed, along with any checks confirming the evidence was not disturbed. Concealing or misstating the deviation undermines the credibility of the entire record.

Question 41Digital Evidence Handling and Chain of Custody

A forensic laboratory uses a LIMS to track evidence. What is the key control that keeps the digital record trustworthy?

  1. Weekly deletion of old log entries to save space
  2. Audit trails that log each user action with identity and timestamp and cannot be edited Correct answer.
  3. Shared login accounts so any analyst can update any record
  4. Allowing analysts to backdate entries when they forget to log

Explanation

An uneditable audit trail ties each action to an identified user and time, making the electronic record verifiable. Shared accounts and backdating remove the attribution and contemporaneity that give the record its value.

Question 42Digital Evidence Handling and Chain of Custody

An investigator collects a mobile phone at a scene and must decide whether to isolate it from the network. Which consideration most directly supports placing it in a Faraday bag?

  1. Making the device easier to photograph at the lab
  2. Allowing the device to receive updates that aid examination
  3. Preventing remote commands or messages from altering or wiping the device data Correct answer.
  4. Improving the phone's battery life during transport

Explanation

Network isolation blocks remote access that could delete data, change settings, or otherwise alter the evidence. Preserving the device state as seized is part of maintaining the integrity of the item from collection onward.

Question 43Digital Evidence Handling and Chain of Custody

An examiner produces a report stating that a specific file was created on a given date based on file system timestamps. What should the examiner also disclose about those timestamps?

  1. That timestamps are irrelevant and should be excluded from reports
  2. That timestamps prove who was at the keyboard at that moment
  3. That timestamps are always accurate to the second and cannot be changed
  4. That timestamps can be affected by system clock settings and are not absolute proof of user action Correct answer.

Explanation

File system timestamps record what the system clock reported, which can be wrong or manipulated, and they do not identify a person. Disclosing these limitations lets the finder of fact weigh the conclusion properly.

Question 44Digital Evidence Handling and Chain of Custody

A defense expert requests access to the original seized media rather than the verified image. Under typical evidence-handling practice, what is the appropriate response?

  1. Hand over the original without any record of the transfer
  2. Destroy the original to prevent any challenge to the image
  3. Refuse all access because only the prosecution may examine evidence
  4. Provide supervised access under documented custody controls, or explain why the verified image suffices Correct answer.

Explanation

Evidence must remain available for independent examination, but access is managed through documented custody controls to protect integrity. If the verified image is a faithful duplicate, that may satisfy the request with the reasons explained.

Question 45Digital Evidence Handling and Chain of Custody

An examiner images a drive, verifies the hash, and returns the original to the owner but keeps the image. Months later the owner disputes the image's authenticity. Which fact is most important to have preserved?

  1. The number of files the examiner expected to find
  2. The brand of the imaging workstation's monitor
  3. The acquisition log showing hash values, tool versions, and the examiner's verification at the time of imaging Correct answer.
  4. The owner's verbal assurance that the drive was unmodified

Explanation

Once the original is released, the acquisition record is the primary evidence that the image faithfully represents the source. Detailed hash values, tool versions, and verification steps let others reproduce and assess the acquisition.

Question 46Digital Evidence Handling and Chain of Custody

A defense motion argues that a two-hour period exists where no custody entry accounts for the evidence. Which response most effectively addresses this challenge?

  1. Assert that the hash value alone proves the evidence was secure during that period
  2. Argue that custody records are optional for digital evidence
  3. Produce corroborating records such as sealed-storage logs, access-control data, or witness testimony covering the interval Correct answer.
  4. Claim the missing entry was a clerical error without supporting evidence

Explanation

A gap is best addressed with independent corroboration that shows the item was secured and undisturbed during the interval. A hash proves data integrity, not physical custody, so it cannot by itself close a handling gap.

Question 47Digital Evidence Handling and Chain of Custody

An examiner must document the imaging of a drive with bad sectors that could not be read. What is the most defensible documentation practice?

  1. Re-image repeatedly until a full copy is obtained regardless of hardware errors
  2. Record the imaging tool's error log, the sectors not acquired, and how the hash of the acquired image is characterized Correct answer.
  3. Report the image as a complete bit-for-bit copy without qualification
  4. Omit the unreadable sectors so the report is simpler

Explanation

When portions of media cannot be read, the record must disclose what was not acquired and how that affects the image's completeness. Characterizing the hash accurately prevents overstating that the image equals the entire source.

Question 48Digital Evidence Handling and Chain of Custody

A laboratory wants to demonstrate that its digital evidence handling meets recognized quality expectations. Which combination best supports that claim?

  1. A single experienced examiner working without written procedures
  2. Written procedures, trained personnel, documented custody records, and periodic audits or accreditation review Correct answer.
  3. Reliance on vendor marketing claims about forensic tools
  4. Storing all evidence in one unlocked room for easy access

Explanation

Quality in evidence handling rests on documented procedures, competent staff, consistent records, and independent review such as audits or accreditation. Together these show the process is controlled and verifiable rather than dependent on individual habit.

Question 49Digital Evidence Handling and Chain of Custody

An examiner finds that a colleague's custody entry was made a day after the actual transfer and reflects an incorrect time. What is the proper corrective action?

  1. Delete the entire custody form and create a new one from memory
  2. Leave the error uncorrected to avoid drawing attention to it
  3. Erase the original entry and write the correct time as if it were the original record
  4. Document the correction with the original entry retained, the reason for change, the correct information, and who made the change Correct answer.

Explanation

Corrections must preserve the original entry and clearly show what changed, why, and by whom, so the record remains transparent and trustworthy. Erasing or recreating records conceals the error and damages credibility.

Question 50Digital Evidence Handling and Chain of Custody

Which property of a cryptographic hash makes it suitable for demonstrating that a forensic image is a faithful copy of the source media?

  1. It records the date and time at which each sector was read
  2. It produces a fixed-length value that changes if any bit of the input changes Correct answer.
  3. It encrypts the image so that only the examiner can read its contents
  4. It compresses the image so it occupies less storage space than the original

Explanation

A cryptographic hash is a one-way function whose output is deterministic for a given input; altering even a single bit produces a completely different digest. Because of this, matching digests computed over the source and the image support the claim that the copy is bit-for-bit identical. Hash values are not encryption keys, do not compress data, and carry no timestamp information.