Case Documentation & Evidence Management Flashcards
7 cards from real CFE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Case Documentation & Evidence Management flashcards as text
A forensic examiner receives two hard drives submitted as evidence but labeled identically. What is the IMMEDIATE documentation priority?
Answer: Assign unique identifiers to each drive and document distinguishing physical characteristics
Unique identifiers must be assigned immediately to prevent confusion between items and ensure each piece of evidence can be tracked independently throughout the case.
What is the significance of documenting the 'scope of examination' in a forensic case file?
Answer: It establishes what was and was not examined, protecting against later allegations of incompleteness
Documenting the examination scope creates a clear record of what was authorized, attempted, and accomplished, providing a defense against claims of oversight or negligence.
Which principle governs how long law enforcement agencies must retain physical evidence from an unresolved criminal case?
Answer: Retention is governed by applicable statutes of limitations and agency policy
Evidence retention requirements are governed by applicable statutes of limitations for the offense, jurisdiction-specific laws, and agency policies.
When transferring custody of evidence between two examiners, which action is MANDATORY to maintain chain of custody?
Answer: Both parties must sign and date a transfer log documenting the handoff
A signed and dated transfer log is the minimum documentation required to establish an unbroken chain of custody during any evidence handoff.
A forensic examiner is asked to re-examine evidence that was previously analyzed by another examiner. Which document is MOST important to review first?
Answer: The prior examination report, case file, and chain of custody records
The prior examination report, case file, and chain of custody records provide essential context about what was previously done and the history of evidence handling.
Under what circumstance is it acceptable to examine original evidence rather than a forensic copy?
Answer: When the evidence cannot be duplicated, such as certain legacy media formats
Original evidence should only be examined when duplication is technically impossible, such as with obsolete media that cannot be forensically imaged.
Which element of a forensic case file provides the legal authority for the examiner to conduct the examination?
Answer: The search warrant, court order, or signed consent form
The legal authority to examine evidence must come from a search warrant, court order, or valid consent form that authorizes access to the specific evidence.