Forensic Science and Legal Foundations
What this domain tests
This domain tests whether you can frame technical work in a defensible legal structure: the authority to collect, the standards that govern handling, and the rules a court applies when deciding whether your evidence and your opinion come in.
Core rules and concepts
- Two admissibility gateways. US federal courts assess expert opinion under FRE 702 as interpreted in Daubert: testability, peer review, known error rate, and general acceptance. Frye (general acceptance alone) still governs in a minority of state courts. Know which question each test answers.
- Authentication (FRE 901). The proponent must show an item is what it purports to be; hashes and chain-of-custody records are the usual means for digital exhibits.
- Best evidence rule (FRE 1002/1003). It governs proof of the contents of a writing, recording, or photograph, not the physical device. A verified duplicate is ordinarily admissible.
- Hearsay. Machine-generated records are generally non-hearsay or fall under the FRE 803(6) business-records exception, which requires a custodian or qualified witness to establish regular practice and reliability.
- Standards. ISO/IEC 27037 covers identification, collection, acquisition, and preservation. NIST SP 800-86 sets out collection, examination, analysis, and reporting. The ACPO principles require that no action change the data, that competence be shown, and that an audit trail let a third party reproduce the result.
- Lawful authority. Distinguish warrant, consent, subpoena, and exigency, and remember that scope limits what you may examine and report.
Worked example
Defence counsel argues a timeline tool is unreliable because its algorithm is proprietary. The correct response is not to disclose source code but to demonstrate reliability: validation testing, independent reproduction with a second tool, documented version and error rate, and peer review. If the challenge is instead that the exhibit is not what it claims to be, the answer is FRE 901 authentication through hash values and custody records. Separating the reliability challenge from the authentication challenge is the skill being tested.
Traps that cost marks
- Treating Daubert and Frye as interchangeable or as universally applicable.
- Claiming a hash proves authenticity; it proves the compared objects are identical.
- Asserting the best evidence rule bars image-based testimony.
- Citing Locard's exchange principle as a legal rule rather than a principle of transfer.
- Ignoring authority and scope, which can suppress otherwise sound work.