CHFI Computer Forensics Fundamentals and Process Practice Question
A forensic examiner is preparing to testify as an expert witness. Which THREE of the following qualities are essential for the examiner's testimony to be admissible under the Daubert standard? (Select THREE)
⚠ Common exam trap
EC-Council CHFI often tests the misconception that personal qualifications (e.g., degrees or experience) are Daubert factors, when in fact the standard focuses strictly on the scientific reliability of the methodology itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The methods used have been tested and are subject to peer review
Under Daubert v. Merrell Dow Pharmaceuticals, the trial judge acts as gatekeeper and assesses scientific testimony using several factors, three of which are reflected here. Option A is correct because Daubert explicitly considers whether the theory or technique can be (and has been) tested and whether it has been subjected to peer review and publication. Option B is correct because general acceptance in the relevant scientific or forensic community, though originally the Frye test, remains a Daubert factor the court may weigh. Option E is correct because Daubert requires consideration of the known or potential error rate of the methodology, along with the existence and maintenance of standards controlling its operation. Option C is not required, since Daubert focuses on the reliability of the methodology rather than a specific academic degree, and Option D is not required because prior testimony experience is not one of the Daubert reliability factors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The methods used have been tested and are subject to peer review
Why this is correct
Under the Daubert standard, the core inquiry is whether a methodology can be empirically tested and has survived scrutiny through publication and peer review. For forensic techniques such as disk imaging or hash function validation, this means the underlying procedure can be replicated and falsified, ensuring its reliability. The examiner's personal qualifications or prior case experience cannot compensate for a lack of scientific validity in the method itself.
- ✓
The techniques used are generally accepted within the forensic community
Why this is correct
General acceptance, derived from the older Frye standard, remains an important Daubert factor. In digital forensics, this means the methods—such as using a write-blocker for acquisition or following a validated pattern-matching algorithm—are endorsed by a substantial segment of the practitioner community. Courts often look for references in peer-reviewed literature, inclusion in NIST guidelines, or adoption by certification bodies to evidence such acceptance. This factor complements but is distinct from the emphasis on empirical testing and known error rates.
- ✗
The examiner holds a degree in computer science
Why it's wrong here
While a computer science degree may indicate foundational technical knowledge, it is not a requirement under Daubert. Courts have admitted experts who lack such a degree but possess extensive practical experience, and conversely, a degree alone does not guarantee that the techniques used in a given case are scientifically valid. The admissibility analysis centers on the reliability of the methodology and its proper application, not on the witness's academic credentials.
- ✗
The examiner has testified in at least ten previous cases
Why it's wrong here
Prior testimony in a certain number of cases can bolster an expert's credibility, but Daubert does not mandate a minimum count for admissibility. What matters is whether the witness's knowledge, skill, experience, and training are directly relevant to the specific facts and techniques involved in the present case. A scientifically sound methodology used by a less experienced examiner may be more reliable than a flawed technique used by someone who has testified many times.
- ✓
The potential error rate of the methodology is known
Why this is correct
A known error rate allows the court to quantify the probability that a forensic examination produced a false positive or inconclusive result, which is crucial for weight-of-evidence determinations. In digital forensics, this might involve documenting the failure rate of a particular software tool under controlled conditions or the inter-observer variability in subjective analyses such as pattern matching. This statistical transparency helps the trier of fact understand the limits of the examiner's conclusions, making it an essential Daubert factor.
Go deeper
Related to this question
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.