Communication & Documentation Flashcards
7 cards from real ACE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Communication & Documentation flashcards as text
When documenting volatile data collection, which piece of information is most critical to capture first?
Answer: The system date and time
Recording the system date and time at the start of volatile data collection establishes a temporal reference for all subsequent documentation.
A subpoena requires production of forensic reports. Which version must be produced?
Answer: All versions including drafts, notes, and final report
Legal discovery typically requires production of all versions of documents including drafts and notes, so examiners must retain all working documents.
In forensic documentation, 'artifacts' should be described as:
Answer: Remnants of system activity that may indicate user behavior
Digital artifacts are remnants of system or user activity that may indicate behavior, but their interpretation must be qualified and not overstated.
An examiner's report contains a factual error discovered before submission. The correct course of action is to:
Answer: Correct the error and document the correction with versioning
Errors should be corrected with proper versioning notation so the correction itself is documented and traceable, maintaining report integrity.
Which of the following best describes 'peer review' in the context of forensic reporting?
Answer: Having another qualified examiner review the report for technical accuracy and completeness
Peer review by another qualified forensic examiner helps identify technical errors, improve clarity, and validate findings before final submission.
When communicating forensic findings verbally to law enforcement, the examiner should:
Answer: Summarize findings objectively and recommend next investigative steps
Examiners provide objective factual summaries and may suggest investigative leads, but determining legal conclusions is the role of attorneys and courts.
The FTK 'Report Wizard' allows examiners to include which of the following in a report?
Answer: Bookmarked items, case information, and selected file categories
FTK's Report Wizard supports inclusion of bookmarked items, case metadata, graphics, file categories, and other selected artifacts in the generated report.