Chapter 26 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and a scoring band are at the bottom — try the whole set before you look.

Multiple choice

Q1. Which section of a forensic report is written last but read first, must stand alone in plain language, and is the one busy decision-makers most often study? - A) The methodology section - B) The executive summary - C) The evidence inventory - D) The appendices

Q2. The report's anatomy puts the most important findings early and the densest technical proof late. This deliberate ordering follows the inverted-pyramid principle because: - A) Courts require alphabetical section ordering - B) Longer sections must always go at the end - C) Decision-makers read top-down and stop when satisfied, while skeptical verifiers dig bottom-up — one structure serves both - D) It makes the report look longer than it is

Q3. In U.S. federal civil litigation, a retained testifying expert's report must comply with: - A) 18 U.S.C. §2258A - B) The Fourth Amendment - C) Federal Rule of Civil Procedure 26(a)(2)(B) - D) ISO/IEC 27037 only

Q4. A matching acquisition hash between the source and your image proves: - A) Who authored the data - B) That the data is genuine evidence of a crime - C) The integrity of the bytes — that they did not change between two moments — but not authorship, origin, time of creation, or intent - D) That the suspect owned the device

Q5. Listed from the most verifiable rung to the most interpretive, the interpretive ladder runs: - A) Opinion → inference → fact/observation - B) Fact/observation → inference → opinion - C) Inference → fact/observation → opinion - D) Opinion → fact/observation → inference

Q6. Writing "The defendant stole the proprietary data" as a conclusion in a forensic report is improper because it: - A) Is too short to be a conclusion - B) Should appear in the executive summary instead - C) Is a legal verdict that imports intent the bytes cannot show and belongs to the trier of fact, not the examiner - D) Uses the wrong timezone format

Q7. You searched the image for anti-forensic tools and malware and found none. In the report you should: - A) Omit it — only positive findings belong in a report - B) Mention it only if the defense asks first - C) Document it as a negative finding, because absence of a trace is itself evidence and demonstrates a thorough, impartial examination - D) Put it in a footnote so it does not weaken the case

Q8. Of the three readers a report serves, the one who wants exact tool versions, byte offsets, complete exhibit hashes, and a fully replayable methodology — so they can reproduce and attack your work — is: - A) The attorney / decision-maker - B) The judge or jury (lay reader) - C) The opposing expert - D) The court reporter

Q9. Which Federal Rule of Evidence permits a summary of voluminous data to be admitted — the rule your executive summary and findings tables effectively rely on, because the full data sits behind them in the appendices? - A) FRE 702 - B) FRE 1006 - C) FRE 401 - D) FRE 802

Q10. The safest way to ensure the exhibit hash list in your appendix cannot disagree with the findings that cite it is to: - A) Type each hash carefully by hand and proofread twice - B) Generate the exhibit hash list mechanically (e.g., with hashdeep) from the exhibit files themselves - C) Round each hash to its first and last few characters - D) Cite hashes only in the inventory, never in the findings

True/False

Q11. If the evidence identifies the user account jokafor as active when a file was created, the report should state that the suspect, J. Okafor, personally created the file. (True / False)

Q12. "The evidence is insufficient to reach a conclusion on this question" is a complete, professional finding and is often a stronger position than a conclusion you cannot defend. (True / False)

Short answer

Q13. Name the four parts of a single defensible finding, in order, and state in a few words what each part contributes.

Q14. A report should pass both technical review and editorial review before release. In one or two sentences, state what each review verifies and why a report can pass one while failing the other.

---

Answer key

Q1 — B. The executive summary is one page of plain language, written after the rest of the report (when you actually know what it concludes) and read first by judges, partners, and executives. It must stand alone, because for many readers it is the only part they study closely.

Q2 — C. The inverted pyramid puts conclusions where the first reader looks and proof where the second reader digs. Busy decision-makers read top-down and stop when they have what they need; skeptical verifiers (the opposing expert) read the appendices bottom-up to check the work. One structure serves both audiences.

Q3 — C. FRCP 26(a)(2)(B) mandates the testifying expert's report contents: all opinions and their bases and reasons, the facts or data considered, exhibits, qualifications including ten years of publications, all cases testified in over the previous four years, and the compensation. (§2258A is mandatory CSAM reporting; the Fourth Amendment governs search; ISO 27037 is an acquisition standard.)

Q4 — C. A hash proves integrity — that the bytes did not change between two moments — and nothing more. It does not prove who wrote the data, when the content first existed, that a device belonged to a person, or that anyone intended anything. State each finding for exactly what it shows.

Q5 — B. From most verifiable to most interpretive: fact/observation (anyone with the image and tools reproduces it) → inference (a reasoned reading of the facts) → opinion (an expert judgment requiring your training). Below "fact" sits the raw data (the artifact itself); keep every rung distinct and labeled.

Q6 — C. Guilt, innocence, and liability are the trier of fact's verdicts, not the examiner's findings; "stole" also imports intent that bytes cannot establish. The defensible conclusion stays inside the fence the evidence builds — e.g., "consistent with copying of the dataset to a removable device on [date]."

Q7 — C. Negative findings document what you looked for and did not find. Their absence is meaningful (theme: the absence of a trace is itself a trace); they prove the examination was thorough, pre-empt the "did you even check for X?" cross-examination, and discharge the duty to seek exculpatory as well as inculpatory evidence.

Q8 — C. The opposing expert wants maximum technical detail to recompute your hashes, re-run your tools, and probe every inference. You serve this reader with rigor — exact versions, offsets, methods, and complete exhibit hashes — and writing for the adversary makes the report stronger for everyone.

Q9 — B. FRE 1006 allows a summary of voluminous records to be admitted; your executive summary and findings tables are that summary, admissible precisely because the full data sits behind them in the appendices. (FRE 702 governs expert testimony — the lay-reader layer; 703/705 govern the bases of opinion — the opposing-expert layer.)

Q10 — B. Generating the exhibit hash list mechanically from the exhibits themselves (e.g., hashdeep -c md5,sha256 -r) means the appendix is produced from the files you report on and cannot drift from the findings that cite them. A single mismatched hash, even a typo, is a cross-examination gift.

Q11 — False. The evidence ties activity to a user account, device, or session — not to a pair of hands. Another person could have used an unlocked session, credentials could have been shared, and in rare cases an automated process could be responsible. Write "the file was created within the jokafor user profile" (fact) and qualify any further claim as an honestly limited opinion.

Q12 — True. Overreach is the most dangerous failure in the field, and the pressure to deliver a definitive answer is real. Stating that the evidence is insufficient is a valid, professional finding and a far stronger position than a conclusion that collapses under cross-examination.

Q13. (1) Observation — the verifiable fact, what the data shows. (2) Supporting artifacts — the paths, offsets, hashes, and timestamps that let anyone confirm it. (3) Interpretation — the supported inference or opinion, honestly qualified. (4) Limitation — what this finding does not establish. Full credit for all four in order; skipping any one makes the finding wobble.

Q14. Technical review (by a second qualified examiner) verifies the substance: are the findings reproducible, do the hashes match across the report, is every conclusion supported, are negative findings documented, is anything overstated — ideally re-examining key findings on the image. Editorial review verifies the communication: is it clear to a lay reader, are terms defined, is the language neutral and free of speculation, is every section present and the executive summary standalone. A finding can be technically impeccable yet fail in court because a juror could not follow it — which is why both reviews are needed.

Scoring: Count the 12 objective questions (Q1–Q12) plus your self-graded short answers. 13–14: report-ready — you could write a document an opposing expert cannot dismantle and defend its structure on the stand. 10–12: solid; re-read "The anatomy of a forensic report" and "Facts, inferences, and opinions." 7–9: review the three-readers/layering section and "What to leave out — and the discipline of negative findings" before the case studies. Below 7: re-read the chapter, especially the interpretive ladder and the anatomy of a single defensible finding, then retake.