CCE Legal & Ethical Issues in Digital Forensics 3 — Questions and Answers
Question 1: Which exception to the warrant requirement allows law enforcement to conduct a warrantless search to prevent imminent destruction of evidence?
- Good faith exception
- Exigent circumstances (Correct answer)
- Inevitable discovery
- Consent exception
Correct answer: Exigent circumstances
The exigent circumstances exception permits warrantless searches when evidence would likely be destroyed before a warrant could be obtained.
Question 2: Under the Stored Communications Act (SCA), service providers are generally prohibited from:
- Providing subscriber information to law enforcement with a subpoena
- Voluntarily disclosing the contents of stored communications to third parties (Correct answer)
- Complying with court orders for metadata
- Storing user data beyond 90 days
Correct answer: Voluntarily disclosing the contents of stored communications to third parties
The SCA prohibits voluntary disclosure of stored communication contents to non-government entities without legal process.
Question 3: A forensic examiner is asked by an attorney to alter a forensic report to support a client's position. The examiner should:
- Comply if the attorney is paying for the work
- Refuse and report the request to the appropriate ethics board (Correct answer)
- Alter only minor details that won't affect the outcome
- Comply if the request is in writing
Correct answer: Refuse and report the request to the appropriate ethics board
Altering forensic reports is unethical and potentially criminal; examiners must refuse and report such requests per professional standards.
Question 4: The 'fruit of the poisonous tree' doctrine means that:
- Digital evidence stored on encrypted drives is inadmissible
- Evidence obtained through an unlawful search may be inadmissible along with subsequent evidence it led to (Correct answer)
- Evidence collected without expert testimony is excluded
- Metadata derived from documents is inadmissible hearsay
Correct answer: Evidence obtained through an unlawful search may be inadmissible along with subsequent evidence it led to
This doctrine excludes evidence discovered as a result of an illegal search, as it is tainted by the original constitutional violation.
Question 5: Which type of legal process generally requires the LEAST judicial oversight when obtaining digital records from a third-party provider?
- Search warrant
- Court order under 18 U.S.C. § 2703(d)
- Grand jury subpoena (Correct answer)
- Emergency disclosure request
Correct answer: Grand jury subpoena
A grand jury subpoena requires no judicial approval before issuance, making it the process with the least pre-issuance oversight.
Question 6: In the context of digital forensics, 'spoliation' refers to:
- The encryption of evidence by suspects
- The intentional or negligent destruction or alteration of evidence (Correct answer)
- The accidental corruption of files during acquisition
- Unauthorized access to a forensic lab
Correct answer: The intentional or negligent destruction or alteration of evidence
Spoliation is the destruction or material alteration of evidence, which can result in adverse inference instructions against the responsible party.
Question 7: Which standard governs the admissibility of expert scientific testimony in federal courts?
- Frye standard
- Daubert standard (Correct answer)
- Brady standard
- Kumho standard
Correct answer: Daubert standard
The Daubert standard, established in Daubert v. Merrell Dow Pharmaceuticals (1993), requires federal judges to assess the reliability and relevance of expert testimony.
