Chapter 27 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and a scoring band are at the bottom — try the whole set before you look. Several questions hinge on a single word (does the evidence establish a fact or merely make it consistent with one?), exactly as the witness box does.

Multiple choice

Q1. A first responder who seized and bagged a laptop testifies "I took the device from the desk, photographed it, and logged it into evidence at 14:32." Under the Federal Rules of Evidence, that witness is testifying as a: - A) Expert witness, because it concerns digital evidence - B) Fact (lay) witness, limited under Rule 701 to what they personally perceived - C) Character witness - D) Hostile witness

Q2. The expert witness's primary duty is to: - A) Win the case for the side that retained them - B) Assist the trier of fact — the judge or jury — by explaining and interpreting evidence - C) Advocate for the most persuasive interpretation available - D) Avoid conceding anything to opposing counsel

Q3. Which of the following is not one of the Daubert factors a court may weigh? - A) Whether the technique can be (and has been) tested - B) Whether it has a known or potential error rate - C) The number of years the expert has been employed - D) Whether it is generally accepted in the relevant field

Q4. The December 1, 2023 amendment to Federal Rule of Evidence 702 most directly: - A) Abolished the Daubert standard in federal court - B) Made admissibility a question for the jury, not the judge - C) Clarified that the proponent must show admissibility is "more likely than not," and strengthened the requirement of a reliable application of the method to the facts — to curb overstatement - D) Required every expert to hold a Ph.D.

Q5. In Kumho Tire Co. v. Carmichael (1999), the Supreme Court held that the judge's gatekeeping duty: - A) Applies only to "scientific" testimony, so digital forensics is exempt - B) Applies to technical and other specialized knowledge as well, not just "science" - C) Was eliminated for technical fields - D) Belongs to the jury rather than the judge

Q6. A judge may exclude an expert opinion when it is connected to the underlying data "only by the ipse dixit of the expert" — the so-called analytical gap. This rule comes from: - A) Frye v. United States (1923) - B) General Electric Co. v. Joiner (1997) - C) Miranda v. Arizona (1966) - D) Katz v. United States (1967)

Q7. Under a pure Frye standard, the test for admitting novel scientific evidence is: - A) Whether the technique has a measured error rate below 5% - B) Whether the technique is generally accepted in the relevant scientific community - C) Whether the expert holds a relevant certification - D) Whether both parties stipulate to it

Q8. Which plain-language explanation of a cryptographic hash is most defensible on cross-examination? - A) "A hash is a digital fingerprint — completely unique to the file" - B) "A hash is a random number the software assigns to each file" - C) "A hash is a tamper-evident seal with a serial number calculated from the entire contents; change one character and the serial comes out completely different" - D) "A hash guarantees no two files anywhere can ever share a value"

Q9. On NTFS, when the $STANDARD_INFORMATION` ($SI) modified time and the$FILE_NAME` ($FN) modified time for a file disagree, the most defensible interpretation is that: - A) The drive is failing - B) The $SI value was likely altered (it is user-writable), while the kernel-controlled $FN value is harder to forge — the mismatch is itself evidence of tampering - C) The file was never created - D) Both timestamps are meaningless and must be discarded

Q10. Your forensic examination can reliably establish that activity occurred on a specific device under a specific user account at specific times. The leap to who was physically at the keyboard is: - A) Always provable from the file system alone - B) User attribution — generally outside what the digital evidence alone can establish, and a question for the jury - C) Established automatically by a matching hash - D) The examiner's duty to assert with confidence

True/False

Q11. Under Federal Rule of Evidence 704(b), an expert in a criminal case may testify that the defendant had the specific intent that is an element of the charged offense. (True / False)

Q12. Volunteering on direct examination that MD5 collisions exist — before the cross-examiner raises it — is a sound tactic, because conceding a true limitation removes the cross-examiner's "gotcha" and makes you look like a teacher rather than an advocate. (True / False)

Short answer

Q13. Define source attribution and user attribution, and explain in one or two sentences why the distinction between them is "the cardinal rule made flesh."

Q14. State the cardinal rule of expert testimony, then give the three-rung spectrum of conclusion language with a one-line example of each rung (the strong rung, the defensible-middle rung, and the rung you must refuse).

---

Answer key

Q1 — B. A fact (lay) witness testifies only to what they personally perceived or did; Rule 701 limits their opinions to those rationally based on their own perception and not resting on specialized knowledge. Saying what a hash means would require expertise the rule reserves for an expert.

Q2 — B. The expert's duty is to assist the trier of fact, not to win for the retaining side. The moment you advocate instead of explain, you stop being an expert and a competent cross-examiner will prove it to the jury.

Q3 — C. The Daubert factors are testability, peer review/publication, known or potential error rate, standards controlling the technique's operation, and general acceptance. An expert's length of employment is a credential, not a Daubert reliability factor — and padded credentials are a credibility risk, not an admissibility test.

Q4 — C. The 2023 amendment made explicit that the proponent must demonstrate admissibility by a preponderance ("more likely than not"), and it strengthened subsection (d) — that the opinion reflect a reliable application of the method to this case's facts — specifically because some forensic experts had been overstating their conclusions. It did not abolish Daubert or move gatekeeping to the jury.

Q5 — B. Kumho Tire extended the gatekeeping duty to technical and other specialized knowledge. You cannot escape Daubert scrutiny by calling digital forensics "merely technical" rather than "scientific."

Q6 — B. Joiner held that a court may exclude an opinion when there is too great an analytical gap between the data and the conclusion — when it rests only on the expert's say-so. Frye is the general-acceptance test; Miranda and Katz are unrelated (interrogation and the Fourth Amendment).

Q7 — B. Frye v. United States (1923) asks the single question of general acceptance in the relevant scientific community. It is the ancestor of Daubert's fifth factor, but narrower — under pure Frye, general acceptance is the whole test, not one factor among several.

Q8 — C. The "tamper-evident seal with a serial number" framing is accurate and survives cross because it does not claim impossibility of collision. Calling a hash a "unique fingerprint" (A) or claiming no two files can ever collide (D) invites the cross-examiner to produce the SHAttered/MD5 collision and crack your credibility. (B) is simply wrong — a hash is computed from contents, not assigned at random.

Q9 — B. $SI` timestamps are freely rewritable by user-mode tools (including timestomping utilities); `$FN timestamps are normally updated only by the Windows kernel and are far harder to forge. A disagreement between them is the fingerprint of tampering — the lesson at the heart of anchor case #2.

Q10 — B. Your examination establishes source attribution — activity on a device, under an account, at times. User attribution — whose hands were on the keyboard — generally requires non-forensic facts (who knew the password, who had access, who was present) and is for the jury. A matching hash proves the copy is faithful; it says nothing about who acted.

Q11 — False. Rule 704(b) specifically bars an expert in a criminal case from opining on whether the defendant had the mental state (e.g., intent or knowledge) that is an element of the offense. That inference belongs to the jury.

Q12 — True. Conceding the true, narrow point (crafted MD5 collisions exist) before being forced to removes the cross-examiner's gotcha, and explaining why it does not matter here — crafted collisions need control of both inputs and cannot make your faithful image collide with a different drive, which is why you also computed SHA-256 — turns a trap into a demonstration of competence.

Q13. Source attribution is what your examination can establish: that activity occurred on a particular device, under a particular user account, at particular times. User attribution is the further claim that a specific human being was physically responsible — which generally cannot be established from the bytes alone, because accounts are shared, passwords are known, and machines are left unlocked. The distinction is the cardinal rule made concrete: you state the device-and-account finding with appropriate confidence, explicitly disclaim the leap to a person, and stop — which is both the most informative and the least impeachable thing you can say.

Q14. The cardinal rule: never claim more than the evidence supports — calibrate your conclusion language to the strength of your findings and stop exactly there. The spectrum: (strong) establishes/demonstrates — "the matching hash establishes the image is a bit-for-bit copy"; (defensible middle) consistent with/supports/indicates — "files recovered from unallocated space are consistent with deliberate deletion"; (refuse) who/intent/guilt — the evidence does not prove who sat at the keyboard, what a person intended, or that the defendant did it (those are barred by Rule 704(b) and 702(d) and reserved for the jury).

Scoring: Count the 12 objective questions (Q1–Q12) plus your self-graded short answers. 13–14: stand-ready — you could lay your foundation and hold the cardinal rule under cross. 10–12: solid; re-read "Qualifying as an expert" and "The cardinal rule." 7–9: review the seven cross-examination attacks and the source-vs-user attribution section before the case studies. Below 7: re-read the chapter, especially "Cross-examination," "The cardinal rule," and the worked drill, then retake. Remember: in court, being right is necessary but not sufficient — you must be right and unimpeachable.