CFE Case Documentation & Evidence Management 5 — Questions and Answers
Question 1: A forensic examiner receives two hard drives submitted as evidence but labeled identically. What is the IMMEDIATE documentation priority?
- Begin imaging both drives simultaneously to save time
- Assign unique identifiers to each drive and document distinguishing physical characteristics (Correct answer)
- Return one drive to the submitting agency as a duplicate
- Image only the drive with the most recent creation date
Correct answer: Assign unique identifiers to each drive and document distinguishing physical characteristics
Unique identifiers must be assigned immediately to prevent confusion between items and ensure each piece of evidence can be tracked independently throughout the case.
Question 2: What is the significance of documenting the 'scope of examination' in a forensic case file?
- It justifies the examiner's billing rate for the case
- It establishes what was and was not examined, protecting against later allegations of incompleteness (Correct answer)
- It speeds up the examination by limiting what needs to be analyzed
- It is required only for cases involving government agencies
Correct answer: It establishes what was and was not examined, protecting against later allegations of incompleteness
Documenting the examination scope creates a clear record of what was authorized, attempted, and accomplished, providing a defense against claims of oversight or negligence.
Question 3: Which principle governs how long law enforcement agencies must retain physical evidence from an unresolved criminal case?
- Evidence may be disposed of after 90 days if no charges are filed
- Retention is governed by applicable statutes of limitations and agency policy (Correct answer)
- Evidence must be retained indefinitely regardless of case status
- Evidence may be returned to the owner after the initial examination is complete
Correct answer: Retention is governed by applicable statutes of limitations and agency policy
Evidence retention requirements are governed by applicable statutes of limitations for the offense, jurisdiction-specific laws, and agency policies.
Question 4: When transferring custody of evidence between two examiners, which action is MANDATORY to maintain chain of custody?
- Both parties must sign and date a transfer log documenting the handoff (Correct answer)
- The receiving examiner must verify the evidence by opening all containers
- The transferring examiner must photograph the receiving examiner accepting the evidence
- A supervisor must be present to witness all evidence transfers
Correct answer: Both parties must sign and date a transfer log documenting the handoff
A signed and dated transfer log is the minimum documentation required to establish an unbroken chain of custody during any evidence handoff.
Question 5: A forensic examiner is asked to re-examine evidence that was previously analyzed by another examiner. Which document is MOST important to review first?
- The original examiner's personal notes not included in the official report
- The prior examination report, case file, and chain of custody records (Correct answer)
- The requesting attorney's legal brief summarizing the case
- The lab's standard operating procedures manual
Correct answer: The prior examination report, case file, and chain of custody records
The prior examination report, case file, and chain of custody records provide essential context about what was previously done and the history of evidence handling.
Question 6: Under what circumstance is it acceptable to examine original evidence rather than a forensic copy?
- When the examiner believes the copy quality may be inferior
- When time constraints require faster access to the evidence
- When the evidence cannot be duplicated, such as certain legacy media formats (Correct answer)
- Whenever the requesting attorney specifically requests original examination
Correct answer: When the evidence cannot be duplicated, such as certain legacy media formats
Original evidence should only be examined when duplication is technically impossible, such as with obsolete media that cannot be forensically imaged.
Question 7: Which element of a forensic case file provides the legal authority for the examiner to conduct the examination?
- The examiner's professional certification credentials
- The case number assigned by the submitting agency
- The search warrant, court order, or signed consent form (Correct answer)
- The chain of custody log showing receipt of evidence
Correct answer: The search warrant, court order, or signed consent form
The legal authority to examine evidence must come from a search warrant, court order, or valid consent form that authorizes access to the specific evidence.
CFE Case Documentation & Evidence Management 5
A forensic examiner receives two hard drives submitted as evidence but labeled identically.
What is the IMMEDIATE documentation priority?