Case Documentation & Evidence Management Flashcards
7 cards from real CFE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Case Documentation & Evidence Management flashcards as text
When documenting a digital forensic examination, which element is MOST critical to establish the authenticity of extracted data?
Answer: Hash values of original and working copies
Hash values (MD5, SHA-1, or SHA-256) mathematically verify that extracted data is identical to the original, establishing authenticity.
A forensic examiner receives evidence in a sealed tamper-evident bag with a broken seal. What is the FIRST action they should take?
Answer: Document the condition photographically before opening or examining
The examiner must document the compromised condition with photographs and notes before any further action to preserve the record of the evidence's state upon receipt.
Which documentation practice best supports the admissibility of forensic findings in federal court?
Answer: Maintaining contemporaneous notes recorded during the examination
Contemporaneous notes made during the examination are the most reliable and defensible form of documentation because they capture real-time observations.
In evidence management, 'chain of custody' primarily serves to:
Answer: Demonstrate that evidence has not been altered or tampered with
Chain of custody documentation provides a chronological record proving that evidence integrity was maintained from collection through presentation in court.
A forensic examiner discovers additional evidence during an examination that was not listed in the original warrant. The BEST course of action is to:
Answer: Stop, document the discovery, and consult with legal counsel before proceeding
Examining evidence not covered by the original warrant may constitute an unlawful search; legal guidance must be obtained before proceeding.
When preparing an evidence log for court, which information is LEAST essential to include for each item?
Answer: Estimated replacement value of the item
The replacement value of an evidence item is generally irrelevant to establishing chain of custody or evidentiary integrity.
Which standard best describes the documentation requirement for a forensic examiner's case notes?
Answer: Notes should be written so that another qualified examiner could reproduce the examination steps
Reproducibility is a cornerstone of forensic science; documentation must be detailed enough for another examiner to replicate the process and verify results.