CHFI Computer Forensics Fundamentals and Process Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Evidence must be reliable

  Why this is correct

  Reliability for digital evidence means the court can trust the accuracy and integrity of the data, which requires proving that the evidence is authentic, unaltered, and traceable through a verifiable chain of custody. Under standards such as Daubert or FRE 901, the proponent must show that the forensic tools and methods used were generally accepted and correctly applied. If the data's integrity cannot be demonstrated, the evidence is inadmissible no matter how pertinent it may be to the case.

• ✗

  Evidence must be encrypted

  Why it's wrong here

  Encryption is a confidentiality measure that protects data during storage or transmission, but it has no bearing on whether evidence meets the rules of admissibility. The legal requirements center on relevance, authenticity, and reliability, not on whether the evidence was secured with cryptographic measures. In fact, encrypted evidence can complicate proceedings if the encryption keys are unavailable, whereas a completely unencrypted drive can be perfectly admissible if its integrity is established through hashing and proper documentation.

• ✗

  Evidence must be stored on a write-blocked drive

  Why it's wrong here

  Using a write-blocked drive is a best practice to preserve the integrity of a source device, but admissibility is not conditioned on the specific hardware used to acquire evidence. Courts evaluate whether the acquisition method preserved the original and produced an accurate copy, which can be demonstrated through cryptographic hashes and documented procedures. A write-blocked drive alone does not make evidence admissible if other foundational requirements such as relevance and reliability are missing, and the absence of a write blocker does not automatically disqualify evidence.

• ✗

  Evidence must be obtained by the police

  Why it's wrong here

  Evidence may be collected by any authorized person with the legal right to access and preserve the data, such as a private forensic examiner, a corporate security team, or a civilian witness, not exclusively by police officers. The critical factors are the lawfulness of the acquisition—whether it was based on a warrant, consent, or statute—and the soundness of the methods used. If a private individual gathers evidence illegally, it may still be suppressed, so the profession of the collector is not the determining factor.

• ✓

  Evidence must be relevant

  Why this is correct

  Relevance requires that the evidence has any tendency to make a fact of consequence in the case more or less probable, and it must relate to a material issue under rules like FRE 401. Without this logical connection to the contested facts, the evidence is inadmissible regardless of how authentic or reliable it may be. Relevance also involves a balancing test under FRE 403, where the probative value must not be substantially outweighed by unfair prejudice, though this is a separate and distinct inquiry from authenticity.

Go deeper

Related to this question