Forensic Image Metadata & Authentication Flashcards
7 cards from real CFP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Forensic Image Metadata & Authentication flashcards as text
What device should a forensic photographer use when transferring images from a camera's memory card to a computer to prevent unintentional modification of original files?
Answer: A hardware write blocker
A hardware write blocker prevents any write operations to the source media during transfer, ensuring the original files cannot be modified, overwritten, or have their metadata updated.
Which EXIF metadata field records the precise date and time a forensic photograph was originally captured?
Answer: DateTimeOriginal
The DateTimeOriginal EXIF field records the exact date and time the image was captured in-camera, which is critical for establishing a verifiable forensic timeline.
In digital forensics terminology, what is a 'forensic image' distinct from a crime scene photograph?
Answer: A bit-for-bit exact duplicate of a digital storage device preserving all data
In digital forensics, a 'forensic image' specifically means a bit-for-bit exact duplicate of a storage device, preserving all data including deleted files and file system metadata.
What type of log should forensic photographers maintain alongside their image files to document post-processing steps?
Answer: A processing notes log documenting all adjustments applied to images
Any post-processing adjustments must be documented in a processing notes log so courts can evaluate how original images were modified and whether modifications are permissible.
What does 'non-destructive editing' mean in the context of forensic image processing?
Answer: Processing that preserves the original image file while storing adjustments separately
Non-destructive editing preserves the original image data unmodified while any adjustments are stored in a separate layer or sidecar file, ensuring the original can always be verified.
Which ongoing practice best ensures forensic image files remain authentic during long-term storage?
Answer: Periodically recomputing and verifying hash values against the original recorded baselines
Periodically recomputing and verifying hash values against the original baselines confirms stored images have not been corrupted or altered over time, maintaining evidentiary integrity.
What is the purpose of maintaining a 'working copy' of forensic photographs separate from the original evidence files?
Answer: To allow examination and analysis while keeping the original evidence untouched
A working copy allows investigators to examine, enhance, and annotate images without risking any modification to the original evidence file, which must remain pristine.