CHFI Computer Forensics Fundamentals and Process Practice Question
An expert witness is preparing to testify in a computer forensics case. Which of the following is a key requirement for the expert's testimony to be admissible under the Daubert standard?
⚠ Common exam trap
The CHFI exam often tests the distinction between the Daubert and Frye standards, and the trap here is that candidates mistakenly choose 'general acceptance' (Option A) because it was the historical standard, but Daubert requires a more rigorous focus on the reliability and scientific validity of the methodology itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The expert's techniques must be based on reliable principles and methods
Under the Daubert standard, the admissibility of expert testimony hinges on whether the expert's techniques are based on reliable principles and methods, not merely on general acceptance. This standard, established in Daubert v. Merrell Dow Pharmaceuticals, requires the trial judge to act as a gatekeeper, evaluating the scientific validity and reliability of the methodology used. In computer forensics, this means the expert must demonstrate that their acquisition, preservation, and analysis methods (e.g., using write-blockers, cryptographic hashing like SHA-256, and chain-of-custody documentation) are scientifically sound and consistently applied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The expert's methods must be generally accepted in the scientific community
Why it's wrong here
The Frye standard requires that scientific techniques be generally accepted in the relevant scientific community, but in federal courts and most state courts, Daubert v. Merrell Dow Pharmaceuticals has superseded it. Under Daubert, general acceptance is merely one of several factors—along with testability, peer review, error rates, and standards—that a judge considers when assessing the reliability and relevance of expert testimony. This means that even a novel but scientifically sound method can be admitted if it satisfies the broader Daubert criteria, and the absence of general acceptance alone is not disqualifying. Thus, this statement is incorrect as a definitive requirement.
- ✓
The expert's techniques must be based on reliable principles and methods
Why this is correct
Under Federal Rule of Evidence 702 and the Supreme Court’s Daubert ruling, an expert’s testimony must be grounded in reliable principles and methods, which are then applied reliably to the facts of the case. The court evaluates reliability through factors such as whether the technique has been empirically tested, subjected to peer review, has a known or potential error rate, and is governed by standards controlling its operation. This gatekeeping role ensures that the jury receives only scientifically valid and relevant expert testimony, making this statement the correct standard for admissibility.
- ✗
The expert must have personally examined all evidence
Why it's wrong here
An expert may properly base an opinion on data, findings, or observations gathered by other investigators or technicians, as long as the expert reasonably relies on such information in forming opinions, per Federal Rule of Evidence 703. The rule explicitly permits opinions based on facts or data made known to the expert at trial, even if inadmissible, if they are of a type reasonably relied upon by experts in the field. Therefore, the expert is not required to personally examine every piece of evidence; the critical requirement is that the expert’s analysis is methodologically sound and anchored in the case record, not that the expert personally collected all exhibits.
- ✗
The expert must have a law degree
Why it's wrong here
Expert witnesses are qualified under Rule 702 by virtue of their "knowledge, skill, experience, training, or education," which can be entirely technical, scientific, or practical without any legal education. A law degree is neither necessary nor sufficient to establish expertise in forensic computer analysis, as the court’s sole concern is whether the proffered witness possesses genuine expertise that will assist the trier of fact. In fact, requiring a law degree would improperly exclude competent engineers, scientists, and technicians whose technical credentials are what genuinely inform the court on specialized matters. Thus, the absence of a law degree does not undermine an expert’s qualification.
Go deeper
Related to this question
Learn chapter
Overview of Computer Forensics and Investigation Process
Key term
Memory Acquisition
Memory acquisition is the process of capturing the contents of a computer's volatile memory to preserve data for forensic analysis and incident response.
Key term
Forensic Evidence Collection
Forensic evidence collection is the process of identifying, preserving, and gathering digital data from computers and devices in a way that keeps it valid for use in legal investigations or internal incident response.
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.