nerdexam
GIAC

GCFA · Question #306

You work as a Forensic Investigator. Which of the following rules will you follow while working on a case? Each correct answer represents a part of the solution. Choose all that apply.

The correct answer is A. Prepare a chain of custody and handle the evidence carefully. B. Examine original evidence and never rely on the duplicate evidence. C. Never exceed the knowledge base of the forensic investigation. D. Follow the rules of evidence and never temper with the evidence.. All four options represent foundational principles that forensic investigators must follow to ensure evidence integrity, legal admissibility, and investigative credibility. Each rule addresses a distinct and essential aspect of proper forensic procedure.

Advanced Incident Response & Digital Forensics Fundamentals

Question

You work as a Forensic Investigator. Which of the following rules will you follow while working on a case? Each correct answer represents a part of the solution. Choose all that apply.

Options

  • APrepare a chain of custody and handle the evidence carefully.
  • BExamine original evidence and never rely on the duplicate evidence.
  • CNever exceed the knowledge base of the forensic investigation.
  • DFollow the rules of evidence and never temper with the evidence.

How the community answered

(65 responses)
  • A
    100% (65)

Why each option

All four options represent foundational principles that forensic investigators must follow to ensure evidence integrity, legal admissibility, and investigative credibility. Each rule addresses a distinct and essential aspect of proper forensic procedure.

APrepare a chain of custody and handle the evidence carefully.Correct

Preparing a chain of custody and handling evidence carefully creates an auditable, unbroken record of who accessed evidence and when, which is legally required to establish admissibility and prevent claims of tampering.

BExamine original evidence and never rely on the duplicate evidence.Correct

Examining original evidence ensures no data is lost due to imaging errors or incomplete duplication, and in some legal contexts investigators must demonstrate familiarity with the original to validate their findings.

CNever exceed the knowledge base of the forensic investigation.Correct

Staying within one's forensic knowledge base prevents invalid conclusions, preserves expert witness credibility, and ensures that findings can withstand legal scrutiny without being undermined by competency challenges.

DFollow the rules of evidence and never temper with the evidence.Correct

Following rules of evidence and never tampering with evidence is a legal and ethical obligation that preserves the integrity of the investigation and ensures findings are not rendered inadmissible due to mishandling.

Concept tested: Core digital forensic investigation principles and evidence handling

Source: https://csrc.nist.gov/publications/detail/sp/800-86/final

Topics

#chain of custody#evidence handling#forensic rules#investigation procedures

Community Discussion

No community discussion yet for this question.

Full GCFA Practice