Start Here
Five practice stations plus a knowledge check, each a different way to work through Chapter 1. Take them in any order. Nothing here is graded or stored, so use it as many times as you like before the quiz or lab.
What this chapter asked you to be able to do
- Describe the forensic examination lifecycle and explain how each phase supports evidentiary integrity.
- Apply the IACIS Code of Ethics to realistic examination scenarios, including conflicts of interest and the duty to report exculpatory evidence.
- Identify the admissibility requirements for digital evidence and the Federal Rules of Evidence that govern them.
- Explain what the Daubert standard asks of an examiner and why methodology documentation answers it.
- Configure and document a forensically sound examination environment, including write-blocker validation and baseline documentation.
- Apply the order of volatility and proper handling procedures to physical and volatile evidence.
- Identify the evidential potential of common hardware and small-scale digital devices.
Your progress this session
These counters update as you check answers on each station. They reset when you reload the page.
Key Terms Flashcards
Select a card to reveal its definition, then select again to flip it back. Try to state the definition before you flip. The counter tracks how many distinct cards you have opened.
Admissibility, Federal Rules, and Legal Authority
Three short sets covering what makes digital evidence admissible, which rule governs each question, and where the authority to search comes from in the first place.
A. Which admissibility requirement is at issue?
Each challenge below attacks one of the three foundational requirements.
B. Which rule or standard governs?
Match each situation to the Federal Rule of Evidence or standard that applies.
C. Where does the legal authority come from?
Choose the source of authority that permits the examination described.
Applying the IACIS Code of Ethics
The code sets four core obligations and requires disclosure when a conflict of interest exists. For each scenario, name the principle at stake and choose the action the code requires.
Ordering Evidence by Volatility
When a live examination is necessary, the most volatile data is captured first because it disappears fastest. Give each tier its position, from 1 (most volatile, capture first) to 7 (least volatile), then check the sequence.
The Examination Environment and Hardware Recognition
A forensically sound environment rests on physical controls, verified tools, and documentation. Work through the workstation requirements, then the forensic implications of the hardware you are likely to encounter.
A. Which lab control addresses this risk?
Match each risk to the control that answers it.
B. What is the leading forensic consideration for this device?
Choose the consideration that most shapes how you acquire each device.
Reference: validating a write-blocker
- Connect a test drive with known content through the write-blocker to the workstation.
- Compute the hash of the test drive’s contents.
- Run an operation that would normally modify the drive, such as a formatting tool.
- Power down cleanly and reconnect the test drive without the write-blocker.
- Recompute the hash of the test drive’s contents.
- Compare the hashes. Matching hashes show the blocker dropped the writes.
Document the process and the results. The validation record becomes part of your baseline and is cited in case reports.
Knowledge Check
Ten multiple-choice questions across the whole chapter. Answer them all, then select Score my answers for feedback and a final total.