DF Unit 3

Digital evidence is treated by U.S. courts as:

• A virtual object with no physical existence
  
  
  

• Tangible physical evidence similar to a weapon or paper document

• A theoretical representation only

• Hearsay evidence

Which of the following is not part of the general tasks investigators perform with digital evidence?

• Identify artifacts that can be used as evidence
  
  
  

• Destroy unreliable digital artifacts

• Collect, preserve, and document evidence

• Analyze, identify, and organize evidence

The best evidence rule requires that:

• Evidence be presented only in printed form
  
  
  

• The original digital record is preferred, but accurate duplicates are acceptable

• Witness testimony replaces digital records

• Only duplicates can be used in court

Which type of digital record is usually considered an exception to the hearsay rule?

• Cloud-based storage records

• Computer-generated records (e.g., system logs, proxy logs)

• Computer-stored records (e.g., documents, emails)
  
  
  

• Printed copies of files

If an original drive crashes after creating one valid forensic image:

• The examiner must reconstruct the original drive

• The case must be dismissed

• The evidence becomes invalid
  
  

• The first successful image can serve as secondary evidence

Computer-stored records are admissible mainly if they meet the:

• Duplicate evidence rule

• Business record exception and authenticity requirements

• Metadata verification rule
  

• Original evidence standard only

A key difference between computer-generated and computer-stored records is:

• Computer-generated records require user input, computer-stored do not

• 
  Computer-generated are created automatically by systems, while computer-stored are created and saved by people
  
  

• Computer-stored records never require authenticity checks

• Computer-generated are inadmissible, computer-stored are always admissible

During a murder investigation, police recover emails from the suspect’s laptop. The defense argues that the emails cannot be admitted because no one can prove the suspect himself typed them. Which rule applies here?

• Best Evidence Rule
  
  
  

• Hearsay Rule

• Metadata Exception

• Business Record Exception

Investigators in three countries seize hundreds of devices during a cartel investigation. The admissibility of this evidence across jurisdictions depends on:

• Each examiner using different methods

• Applying the highest control standard consistently across all jurisdictions

• Using the least restrictive collection procedures in each country

• Presenting only printed versions in court

In a digital forensics case, a defense attorney claims that a digital file was altered after it was created. Which principle is most relevant to establishing the integrity of the evidence?

• Best Evidence Rule

• Authentication Requirement

• Chain of Custody
  
  
  

• Hearsay Rule