SY0-301 · Question #185
Which of the following is a best practice when a mistake is made during a forensics examination?
The correct answer is C. The examiner should document the mistake and workaround the problem.. In forensic examinations, best practice requires documenting every mistake and working around it to preserve chain of custody and maintain the credibility of findings.
Question
Which of the following is a best practice when a mistake is made during a forensics examination?
Options
- AThe examiner should verify the tools before, during, and after an examination.
- BThe examiner should attempt to hide the mistake during cross-examination.
- CThe examiner should document the mistake and workaround the problem.
- DThe examiner should disclose the mistake and assess another area of the disc.
How the community answered
(20 responses)- A5% (1)
- B5% (1)
- C90% (18)
Why each option
In forensic examinations, best practice requires documenting every mistake and working around it to preserve chain of custody and maintain the credibility of findings.
Verifying tools is a best practice for ensuring reliability before and after an examination, but it does not address the procedural response required when a mistake actually occurs.
Attempting to hide a mistake is unethical, violates forensic standards, and could constitute obstruction if the case reaches litigation.
Forensic integrity depends on meticulous documentation of all actions, including errors. By recording the mistake and implementing a workaround, the examiner preserves chain of custody, allows peer review of the issue, and ensures the error can be disclosed and explained if the evidence is challenged in court.
Simply moving to another area of the disc without documenting the mistake fails to maintain a complete and accurate record of the examination process.
Concept tested: Digital forensics chain of custody and error documentation
Source: https://www.nist.gov/system/files/documents/2017/04/28/SP800-86.pdf
Topics
Community Discussion
No community discussion yet for this question.