Chapter 27 — Exercises

A mix of concept checks, courtroom-judgment questions, and hands-on labs — write the plain-language explanation, calculate and verify the morning-of-trial hash, build the corroborated timeline that answers the timestamp wedge, draft the qualifications proffer, and red-team your own report. Groups A–G follow the arc of the chapter: what kind of witness you are → getting through the gate → teaching on direct → withstanding cross → the cardinal rule → preparation and the stand → judgment and the progressive project. Several items ask you to write the strong answer that holds beside the weak answer that loses, the way the chapter's drill does — because the only way to make the strong answers reflex is to write them out before a lawyer makes you say them. (answer in Appendix) marks problems with a worked solution in Answers to Selected Exercises. ⭐ marks a stretch problem. Throughout, obey the cardinal rule even in your written answers: state the finding, name the gap, and stop.

Group A — Two kinds of witness and the privilege

27.1 In your own words, distinguish a fact (lay) witness from an expert witness, naming the Federal Rule of Evidence that governs each. (a) Give one sentence a digital examiner could say only as a fact witness, and one sentence the same examiner could say only as an expert. (b) The chapter says you will "wear both hats in the same case" — explain why, and why knowing which hat you wear at each moment keeps you inside what you are permitted to say. (c) State, in one sentence, the duty that attaches to the expert's privilege, and why a competent cross-examiner spends the afternoon trying to prove you forgot it. (answer in Appendix)

27.2 Classify each statement as fact testimony, permissible expert opinion, or impermissible overreach, and say why: (a) "I attached the drive to a Tableau write-blocker and confirmed it read-only." (b) "The matching SHA-256 establishes the image is a bit-for-bit copy of the original." (c) "The defendant deliberately deleted these files to hide them." (d) "Files recovered from unallocated space are consistent with deletion after creation." (e) "In my opinion the defendant is guilty." For each overreach, rewrite it into the strongest claim your examination could support. Then (f) explain why (b) is expert testimony even though it sounds like a plain statement of fact — what specialized knowledge is doing the work in the verb "establishes," and why could a fact witness not say it?

27.3 ⭐ Under Federal Rule of Evidence 701, a lay witness's opinions are limited to those "rationally based on the witness's perception" and not resting on specialized knowledge. A first responder wants to testify that "the deleted files were obviously put there on purpose." (a) Explain why Rule 701 bars that opinion from a fact witness. (b) Explain why even an expert should not say it. (c) Construct the boundary case: what can the first responder say about the deletion, and where exactly does the line fall between perception and expertise?

Group B — The gate: Daubert, Frye, and Rule 702

27.4 Take a core digital-forensic method — acquire a drive through a write-blocker, image it, and verify with SHA-256 — and walk it through all five Daubert factors (testability, peer review/publication, known or potential error rate, standards controlling the technique, general acceptance). Give a concrete one-sentence answer for each factor, naming a real standard, program, or body where you can (NIST CFTT, SWGDE, ISO/IEC 17025, the open hash-function literature). Then answer: which single factor is digital forensics' strongest, and which is the one a judge can accept while still excluding your opinion? (answer in Appendix)

27.5 Match each case in the Daubert trilogy to its holding and to the cross-examination attack it most directly empowers: (a) Daubert v. Merrell Dow (1993); (b) Kumho Tire v. Carmichael (1999); (c) General Electric v. Joiner (1997). Holdings: (i) the gatekeeping duty reaches technical and other specialized knowledge, not just "science"; (ii) a court may exclude an opinion connected to the data only by the ipse dixit of the expert — too great an analytical gap; (iii) the judge is the gatekeeper who weighs reliability factors. Then explain, in one sentence, why Kumho Tire means you cannot escape scrutiny by calling your work "merely technical."

27.6 ⭐ Your jurisdiction's standard is not something to discover "on the courthouse steps." (a) Explain the core difference between the Frye "general acceptance" test and the Daubert multi-factor test — specifically, why Frye is narrower even though general acceptance is also a Daubert factor. (b) The chapter advises building your foundation to satisfy Daubert even in a Frye state. Explain why a method that survives Daubert almost always survives Frye, and why the reverse is not guaranteed. (c) Name one practical thing about how you are qualified that can differ depending on which standard governs.

27.7 The December 1, 2023 amendment to Federal Rule of Evidence 702 changed two things that matter to you directly. (a) Explain what "more likely than not" added — whose burden it states and what it stops a judge from doing. (b) Explain what subsection (d)'s "reliable application … to the facts of the case" was strengthened to curb, and why the Advisory Committee singled out forensic experts. (c) In one sentence, connect the amendment to this chapter's cardinal rule. (answer in Appendix)

27.8 Define and place in sequence the parts of the qualification ritual: curriculum vitae as exhibit, voir dire of the expert, tender of the witness, stipulation to qualifications, motion in limine, and the Daubert hearing. (a) Which of these can keep your opinions out before the jury hears a word, and why is that the most catastrophic outcome for a case? (b) Why do many federal judges discourage the formal tender in front of the jury? (c) What does a stipulation to your qualifications save you, and what does it cost you?

Group C — Direct examination: teaching twelve strangers (write the explanation)

27.9 Write the explanation. A juror has never thought about how a computer stores a file. In one short paragraph each, write jury-ready, defensible plain-language explanations of (a) what a cryptographic hash proves, and (b) why a "deleted" file can be recovered. Use an everyday analogy for each — but for the hash, include the analogy's limit (the collision concession) so there is nothing left for a cross-examiner to expose. Avoid the word "unique." Then, beneath each, note in one line the real mechanism it maps onto (the avalanche property; the file system marking the MFT entry unallocated while cluster contents persist). (answer in Appendix)

27.10 The "a hash is like a digital fingerprint — unique to the file" analogy is serviceable but has a flaw a cross-examiner will exploit. (a) Name the flaw and the specific real-world demonstration ("SHAttered," MD5 collisions) the cross-examiner produces to crack it. (b) Rewrite the analogy as the chapter recommends — a tamper-evident seal with a serial number calculated from the whole contents — and explain why that framing survives the same attack. (c) State the principle: why does an examiner who volunteers the limitation look like a teacher while one caught hiding it looks like an advocate?

27.11 ⭐ Build the timeline — then write the answer. You are handed the following artifacts for one file on an NTFS volume. Build the corroborated timeline, then write the strong courtroom answer to "isn't it true that timestamps can be changed, so your dates are worthless?"

$STANDARD_INFORMATION ($SI)   M: 2019-01-01 00:00:00
$FILE_NAME            ($FN)   M: 2024-03-02 19:14:06
LNK / Jump List entry         file opened 2024-03-02 19:15
Browser history record        related download 2024-03-02 19:08
Security event log 4624       logon for user jdoe at 2024-03-02 18:55
EXIF DateTimeOriginal         (inside the image) 2024-03-02 19:11

(a) Which timestamp is user-writable and which is kernel-controlled, and what does their mismatch by itself indicate? (b) List the independent records that corroborate the true time and explain why faking all of them consistently is far harder than changing one date. (c) Write the two-to-three-sentence answer that turns the wedge into a display of thoroughness — without overstating who was at the keyboard. (This is anchor case #2 territory — Chapter 16, Chapter 21, Chapter 30.)

27.12 The chapter recommends building "a small library of analogies you have pressure-tested." Write defensible one-sentence analogies — each with a built-in caveat you could defend — for: (a) unallocated space, (b) EXIF metadata, (c) the difference between the source drive and your working copy. Then have a non-technical person play hostile cross-examiner and try to break each one; note where each analogy is weakest and how you would patch it on the stand. (d) The chapter also recommends demonstrative exhibits — a one-page diagram, a blown-up screenshot of matching hashes, a simple timeline graphic. Pick one of your findings and describe the single demonstrative you would build, and the two things you must confirm about it before trial (that your attorney has it, and that it is accurate enough to survive its own cross-examination).

Group D — Cross-examination: the seven attacks

27.13 Match each of the seven classic attacks to the single discipline (created before trial) that defeats it: attacks — (1) chain-of-custody gap, (2) tool reliability, (3) alternative explanation (Trojan/SODDI), (4) examiner bias, (5) overstatement, (6) beyond-your-expertise, (7) timestamp wedge; defenses — (i) a corroborated timeline across independent records, (ii) documented dual-purpose (inculpatory and exculpatory) findings and calibrated language, (iii) an unbroken two-signature custody log plus the re-verification hash, (iv) version-pinned, NIST CFTT-tested, validated tools, (v) affirmative, documented diligence (you looked for malware and found none), (vi) "that is outside my area of expertise," (vii) refusing the escalating overstated claim. Then state the single sentence that runs through all seven. (answer in Appendix)

27.14 Drill. For the chain-of-custody attack — "there's a four-hour window on March 14th where your form doesn't show who had this drive; anything could have happened to it, couldn't it?" — write the weak answer that loses and the strong answer that holds, then one sentence of why. Your strong answer must do two things the weak one cannot: point to a documented custody record (the access-logged evidence locker, the intact tamper-evident seal) and invoke the re-verification hash. Explain why "I'm sure it was fine" is "the sound of a gap."

27.15 ⭐ The Trojan / SODDI defense ("a virus put those files there without my client's knowledge") has succeeded in real cases. (a) Explain precisely which examiner it works against, and why. (b) List four pieces of affirmative diligence — done during analysis, not on the stand — that collapse it (think malware scan, persistence mechanisms, AV/quarantine logs, and the pattern of activity). (c) Write the strong answer to "you can't rule out malware, can you?" Note carefully: your answer establishes diligence and pattern — it must not leap to asserting the defendant's guilt. (d) Explain how this attack is the same diligence the ethics of the work demand of you (Chapter 28).

27.16 The bias attack — "you were hired by the prosecution, you're paid, so you found what they wanted" — lands hardest on examiners who actually shaded a conclusion. (a) Identify the three things you did months before trial that make this attack fail. (b) Write the strong answer that combines calm neutrality with a documented exculpatory finding, and explain why indignation ("that's offensive — I'm a professional") is the worst possible response. (c) Explain the prosecutor's Brady obligation and why a clean, complete report — favorable and unfavorable findings alike — protects the case, the accused, and you. (d) A variant of this attack probes the share of your income that comes from one side, or the number of times you have testified for the same office. Why is "I am compensated for my time and expertise, not for a result" a complete answer, and why does it become more credible — not less — when your report visibly contains findings that did not help the side paying you?

27.17 The overstatement trap is built as a staircase of escalating "you're certain…?" questions. (a) Write a realistic four-step staircase a cross-examiner would climb from a true narrow finding up to "you're certain my client is guilty, aren't you?" (b) Identify the exact step at which agreeing would claim something your evidence cannot support. (c) Write the answer that walks up the first true steps and then declines, courteously, to take the last one — and explain why that answer "cannot be impeached, because there is nothing past it for the cross-examiner to reach."

Group E — The cardinal rule: calibrate your conclusions (rewrite the report)

27.18 Place each phrase on the conclusion-language spectrum — establishes/demonstrates (strong, defensible when true), consistent with/supports/indicates (the broad defensible middle), or refuse (jury territory; do not say it): (a) "the matching hash ___ that the image is a bit-for-bit copy"; (b) "the files recovered from unallocated space are ___ deliberate deletion"; (c) "the evidence ___ that the defendant intended to steal the data"; (d) "the $SI`/`$FN mismatch ___ that a timestamp was altered"; (e) "my findings ___ who was physically at the keyboard." For (c) and (e), name the rule of evidence (702(d) and/or 704(b)) that bars the overstated version. (answer in Appendix)

27.19 Rewrite the report. Here are five overstated sentences from a draft report. Rewrite each into a defensible claim calibrated to what the evidence actually shows, and name what was wrong with the original: (a) "The defendant downloaded the files on March 2nd." (b) "These timestamps prove when the crime occurred." (c) "The recovered files conclusively establish the suspect's guilt." (d) "My tool never makes errors." (e) "It is impossible that anyone else used this account." After rewriting, state the single habit (from preparation) that would have caught all five before the report left your lab.

27.20 ⭐ Source attribution vs. user attribution — the "at-the-keyboard problem" — is the deepest form of the cardinal rule. (a) Define each in one sentence. (b) Explain, with three concrete examples, why your examination can reach the device-and-account level but not the human-hands level (think shared accounts, known passwords, unlocked machines). (c) Write the model two-sentence answer: state the finding with appropriate confidence, name the gap, stop. (d) Explain why this answer is simultaneously the most informative about what you found and the least impeachable — the two qualities the witness box rewards together.

27.21 Federal Rule of Evidence 704(b) specifically bars an expert in a criminal case from opining on whether the defendant had the mental state that is an element of the offense. (a) Explain why "the files were organized into named folders and opened across many sessions" is admissible while "the defendant knew the files were there" is not — even though the second feels like a small step from the first. (b) Whose job is that inference? (c) Connect 704(b) to the 2023 amendment of 702(d): how do the two rules work together to keep an expert from stealing the jury's role? (d) A cross-examiner cannot ask you the forbidden question directly either, but they can try to lead you toward it ("so this is exactly what someone who knew would do, isn't it?"). Write the one-sentence answer that supplies the factual observation while explicitly declining the inference about knowledge.

Group F — Preparation and the stand (calculate and verify the hash)

27.22 Calculate and verify the hash. It is the morning of testimony. Your working image was acquired months ago for exhibit 2024-0417-001 with recorded SHA-256 9f2c4e7a1b8d3f60c5a2e9b4d7f1c803a6e2b5d8f1a4c7e0b3d6f9a2c5e8b1d4. (a) Using the chapter's PowerShell or Python re-verification approach (model it on the scripts in the chapter and in Appendix B), describe exactly what you compute and what you compare it against. (b) Write the two sentences you may now say under oath if it matches. (c) If it does not match, state precisely what you do before you take the stand, and why testifying to integrity you have not re-verified is a trap. (d) Explain why re-verifying the morning-of is worth the effort even though the acquisition already verified months ago. (answer in Appendix)

27.23 Red-team your own report. Pick any finding from a report you have written (or invent a realistic one). (a) Write the single strongest cross-examination attack you can invent against it from each of the seven categories — chain, tools, alternative explanation, bias, overstatement, expertise, timestamps. (b) Write your honest, calibrated answer to each. (c) Identify the one place where your honest answer is weak, and state what you would do about it before trial (a supplemental report, a re-verification, a revised phrase). Explain why "it is far better to disappoint your own attorney in a conference room than to be caught overstating in front of a jury."

27.24 ⭐ The discipline of answering has hard rules. For each over-answer below, identify which rule it breaks and rewrite it into a disciplined answer: (a) Q: "Did you image the drive?" A: "Yes, and I also want to mention that the defendant clearly tried to hide things…" (b) Q: "Could a virus have done this?" A: "Probably not, I mean, I didn't really check but it seems unlikely." (c) Q: "Is it always true that deleted files can be recovered?" A: "Yes, always." (d) Q: "You're certain, aren't you?" A: "100% certain." (e) [an attorney says "objection" mid-answer] A: [witness keeps talking]. State the single root these rules share with the cardinal rule.

27.25 The pretrial meeting with your attorney is proper for some things and improper for others. (a) List three legitimate purposes of the meeting (scope, exhibits, anticipated attacks). (b) List the one thing it must never become, and the question a cross-examiner asks to expose it ("what did the attorney tell you to say?"). (c) The chapter says "a good expert will tell the attorney, bluntly, where the evidence is weak." Explain why surfacing your own weaknesses to your own side is a strength, not disloyalty — and what happens if you don't. (d) Your retaining attorney asks you, in the pretrial meeting, to "soften" a finding in your report that hurts their theory. Write the two-sentence response that preserves both your independence and the working relationship, and name the chapter (and the ethical duty) this situation foreshadows.

Group G — Judgment, edge cases, and the progressive project

27.26 ⭐ The recovery engineer in the box. A data-recovery technician is named in a spoliation dispute: the opposing party claims the shop's handling destroyed recoverable data the client had a duty to preserve. (a) Explain, using the chapter's Recovery vs. Forensics dual lens, why "the same disciplined log that makes evidence admissible is the same log that exonerates you." (b) Which two artifacts from a careful ddrescue-based acquisition (Chapter 8) most directly prove the shop did not cause the loss? (c) Write the calm, non-overstated sentence the technician gives when asked "did your shop destroy my client's data?" — staying strictly within what the imaging log can establish. (d) The opposing attorney then presses: "so you're saying the data was definitely unrecoverable by anyone?" Explain why the technician must not agree to that absolute, what the seasoned answer is instead, and how this is the same "outside my expertise / I will not overstate" discipline the forensic expert uses on the stand.

27.27 Diagnose the transcript. Read this cross-examination excerpt and identify, for each exchange, the attack being run and whether the witness handled it well or walked into a trap.

Q: "You examined the original laptop directly, didn't you?"
A: "I looked at the drive, yes."

Q: "Isn't MD5 broken — two files can share a value?"
A: "MD5 isn't perfect, but it's probably fine."

Q: "So your work proves my client is guilty?"
A: "Yes, I believe the evidence shows he's guilty."

(a) Name each attack. (b) For each weak answer, write the strong replacement and explain in one sentence what the weak version conceded. (c) Which single answer most damages the witness's overall credibility, and why does one overstated sentence "taint everything else you say"? (answer in Appendix)

27.28 Progressive project — prepare to defend your case file. Your Forensic Case File already contains a court-admissible report (Chapter 26). Build the testimony-preparation package of four artifacts and add it to the file: (1) a qualifications proffer — the CV and short narrative your attorney would use to qualify you, including nothing you could not document, with certifications drawn from Appendix I; (2) a red-team of your own report — every attack and your honest answer, with each overstated phrase revised; (3) three plain-language explanations of technical findings, each with an accurate analogy and its limitation; (4) a morning-of-trial integrity log — re-verify your working image against the acquisition hash, record the result, date, and tool versions. This package folds directly into the Chapter 38 capstone, where the whole case file is cross-examined in the instructor mock trial. Then reflect in writing: which finding was hardest to phrase without overstating, and what is the one sentence you could now say under oath about the limit of what your examination establishes? Keep that reflection — it is the difference between knowing the cardinal rule and living it.

Self-check. You have mastered this chapter when you can, without notes: distinguish the fact-witness from the expert role and stay inside each; lay the foundation to be qualified under Rule 702, the Daubert factors and trilogy, and Frye, and say in one plain sentence why your deterministic method satisfies the gatekeeper; explain hashing, deleted-file recovery, and timestamps to a juror with analogies that survive their own cross; recognize all seven cross-examination attacks and give the documented, pre-trial discipline that defeats each; and — above all — calibrate every conclusion to the evidence, state source attribution while disclaiming user attribution, and say "the evidence is insufficient to determine that" without flinching. If a cross-examiner asked "so your work proves my client is guilty?" and your answer is one calm sentence that states the finding, names the gap, and stops, you are ready for Chapter 28 — Ethics in Data Recovery and Digital Forensics, where the question turns from how you defend your findings to what you owe while making them.