Chapter 28 — Exercises

A mix of concept checks, judgment calls, and a few hands-on labs — because ethics in this field is a technical competency, not a mood, and the way you prove you have it is by executing procedures (a hash-set triage, a content-free discovery log, an authority-and-ethics memo) cold and correctly. (answer in Appendix) = worked solution in Answers. ⭐ = stretch. Where a lab references a practice image, see Appendix J — Practice Images and Lab Setup; the statutory citations are collected in Appendix E — Legal Frameworks Reference. Every hands-on exercise here is done on data you own or on sanctioned practice images — never on real evidence and never, under any circumstances, on real contraband. The contraband labs below are about the mechanism and the record, with opaque hashes standing in for material no exercise would ever have you touch.

Group A — Objectivity: you serve the truth, not the client

28.1 Write, in exactly the chapter's words, the one sentence that separates a forensic professional from a hired gun. Then explain in four or five sentences why this is not idealism but the structural logic of expert evidence — what an expert is permitted to do in court that a lawyer is not, what happens to an examiner's every other case once they are shown to have shaded findings, and why "you can sell it only once" describes the reputational economics exactly. Give one concrete example for each discipline of a finding you would deliver against the party who hired you (e.g., a defense-retained exam that confirms guilt; a corporation-retained exam that exonerates the suspected employee), and state what you actually say when the client pushes back. (answer in Appendix)

28.2 (Classify.) A finding is what the artifact says; an inference is what you think it means. For each statement, label it FINDING or INFERENCE, and for each inference state what additional support (if any) would let you offer it as a qualified expert opinion rather than smuggle it in as fact: (a) "A USB mass-storage device with serial 4C530001234567890123 was connected to the workstation on 2026-03-12 at 18:51 UTC." (b) "The employee intended to steal the design and harm the company." (c) "TurbineHousing_v7.sldprt was opened from that device at 19:04, per the LNK and $FILE_NAME timestamps." (d) "The $STANDARD_INFORMATION` timestamp predates the `$FILE_NAME timestamp, a pattern consistent with timestomping." (e) "The user is guilty." (f) "The 14,212 files in the archive were copied in a single operation lasting roughly four seconds, based on near-identical MFT entry timestamps." (g) "The user tried to hide what they did." Finish by writing one sentence explaining why an examiner who routinely lets statements like (b), (e), and (g) into the findings section of a report — rather than a separate, clearly labeled opinion section — is a gift to opposing counsel, and tie your answer to the report structure Chapter 26 uses to enforce the separation.

28.3 ⭐ (Judgment — the bias you can't feel.) The case agent tells you "we know he did it, just find the proof." Name the cognitive trap this sets, then describe the three procedural defenses the chapter prescribes instead of willpower — linear sequential unmasking, blind peer review, and documented alternative hypotheses — saying in one sentence each how it works. Finish by explaining the chapter's quietest tell ("notice when you are relieved by a result") and why noble-cause corruption is the most dangerous rationalization in this field precisely because it feels virtuous — using anchor case #4 (the child-exploitation matter) as the example where the temptation is strongest and the cost of yielding to it is highest in both directions.

Group B — Conflicts of interest and independence

28.4 State the standard for a conflict of interest in this work — note that it is "reasonably be seen to," not "actually did," and explain why the appearance damages evidence almost as effectively as the reality. Then explain why the cardinal expert-witness rule is never accept a contingency fee: what a contingency fee literally pays you to do, and why courts widely treat it as grounds to exclude your testimony entirely. (answer in Appendix)

28.5 List the five recurring conflicts the chapter names (financial interest in the result; prior relationships; examining your own work; the recovery-to-forensics pipeline; a stake in the client). For two of them — examining your own work and the recovery-to-forensics pipeline — give a concrete one-sentence scenario, and explain why the standard remedy is almost always disclosure in writing rather than "never take the case," including the asymmetry the chapter draws between the cost of over-disclosing and the cost of under-disclosing. Then explain the trap the chapter says "snares 🛡️ incident responders constantly" — being asked to be the "independent" examiner of an incident your own team handled — and why a single person quietly wearing two hats (investigator and neutral expert) on one case is a structural problem even if that person is scrupulously honest.

28.6 ⭐ (Judgment.) You are asked to be the "independent" forensic examiner of an incident your own team handled three weeks ago, and you also happen to own a small amount of stock in the retaining company, and the lead attorney is a former classmate you still see socially. None of these necessarily disqualifies you. Draft the three-to-five-sentence written disclosure you send before accepting, identifying each potential conflict, stating who gets to decide whether it disqualifies you, and explaining why a conflict you surface is "a fact the system can manage" while a concealed one is "a scandal the system will use to throw out everything you touched."

Group C — Scope discipline and the plain-view problem

28.7 Explain why scope discipline is harder in digital evidence than in a physical search, using the chapter's "there are no rooms on a 2-terabyte drive" framing. Then state what the plain-view doctrine becomes when imported uncritically into a whole-device search, why courts (e.g., the Carey and Comprehensive Drug Testing lines) have grown wary of it, and what constitutional danger they are guarding against. (answer in Appendix)

28.8 (Write the search plan.) You hold a warrant authorizing examination of a laptop image for evidence of wire fraud between January and June 2026. Write a five-line scope-respecting search methodology — the kind you document before and as you execute it — using at least four of: keyword terms, hash-set matching, date-range filtering, file-type restriction, and named-artifact analysis. Give a concrete starter set of at least six keyword terms a fraud matter would justify, and name two artifact categories (Chapter 16 and Chapter 18 own these) you would target. Then write the one sentence that states what you will deliberately not do (e.g., "I will not open the personal photo libraries"), and explain why looking there is itself the violation even if you find nothing — and why a methodology documented in advance is what later distinguishes a disciplined search from rummaging you rationalized afterward.

28.9 ⭐ (Judgment — evidence of a different crime.) Mid-way through the authorized fraud search above, a spreadsheet you legitimately opened for fraud terms also contains what appear to be drug-distribution ledgers. State the naive move and why it is tempting, then the disciplined move in three steps (stop; document precisely what you saw and how you lawfully came to see it; seek expanded or new authority before examining further). Explain the doctrine of taint: how barreling ahead on a plain-view theory can get suppressed not only the new evidence but, by taint, the fraud evidence you were lawfully entitled to — i.e., why "the truth-serving move and the legally durable move are the same move."

Group D — When you find contraband: the mandatory-reporting duty

28.10 Reproduce, in order and from memory, the first five minutes when you encounter what appears to be CSAM: STOP · DO NOT COPY · PRESERVE · ISOLATE · DOCUMENT & ESCALATE. For each step give the one-sentence reason. Then explain why rule 1 is the one professionals get wrong out of misplaced thoroughness, and why "let me check whether there are more, just to be sure" is the instinct to commit additional crimes and traumatize yourself further for zero investigative benefit. State explicitly which part of this sequence is identical for all four roles (LE examiner, private/corporate examiner, recovery technician, provider) and which part — the escalation target — differs, and why that single shared core is what makes the procedure something you can execute cold. (answer in Appendix)

28.11 (Calculate and verify the hash — finding without looking.) Hash-matching lets a vetted examiner flag known material without ever rendering an image. (a) Explain the technical and ethical difference between a cryptographic hash (MD5/SHA-1/SHA-256) and a perceptual hash like PhotoDNA — specifically, why changing one pixel or re-encoding defeats the first but not the second. (b) Using a sanctioned practice image (Appendix J) and a small benign known-file list you build yourself, run a hash-set match against a read-only mount — md5deep -m -k known_set_md5.txt -r /mnt/evidence_ro — and confirm hits are reported by path and hash only. (c) State exactly what a hash hit proves and does not prove (lead, not courtroom conclusion), and what the absence of a hit proves about novel material the sets have never seen. (d) Before any of this, write the one command that confirms your working image is unaltered against the acquisition hash in the chain of custody, and say why that comes first. (e) Explain how running a known-good exclusion (the NIST NSRL) and a known-bad match in the same pass implements the chapter's two-sided principle — "one hash set finds what you must not ignore; the other discards what you need not see" — and why both reduce the volume of material a human must lay eyes on.

28.12 (Write the report — the content-free record.) Draft the discovery-log entry you commit to your contemporaneous notes the moment you encounter a suspected item. It must capture WHERE (path), WHEN (UTC timestamp), HOW you encountered it (the method — e.g., a known-file hash-set hit during authorized media review), the file's hash, and who you notified and when — and it must contain nothing of the content. Then explain, tying to the theme every action leaves a trace, why this clean, content-free record of "how I found it, stopped, secured it, and escalated" is precisely what later demonstrates you handled the worst-case discovery correctly.

28.13 ⭐ (The authority spectrum and §2258A.) The mandatory CyberTipline reporting duty under 18 U.S.C. §2258A is widely misquoted. State precisely whom it binds by its terms (electronic-communication-service and remote-computing-service providers), and then complete the four-row authority table from the chapter — what a (a) law-enforcement examiner, (b) private/corporate examiner, (c) data-recovery technician, and (d) ESP/RCS provider may do with apparent CSAM and to whom each escalates. Finish with the two cautions that keep the picture accurate: that the absence of a federal §2258A duty on an individual is not the absence of a duty (name the state computer-technician reporting statutes the chapter cites — Missouri's Mo. Rev. Stat. §568.110 and South Carolina's), and that every legitimate lab treats report-and-cease as a standing policy regardless. Note what §2258A does require of the providers it binds — reporting "as soon as reasonably possible," preserving the report and contents for the statutory period (and how the 2024 REPORT Act changed it), and the substantial fines for a knowing and willful failure — and the role of the companion provisions §2258B (good-faith liability protection) and §2258C (sharing of hash values).

28.14 Explain why rule 2 — do not copy — is a legal line and not lab etiquette, citing 18 U.S.C. §2252/§2252A: which acts besides creation the statutes criminalize, why a law-enforcement examiner's possession is lawful while a private party's is not, and what the narrow affirmative defense in §2252A actually requires (promptly reporting to law enforcement and affording access, or taking reasonable steps to destroy). State the one-line lesson the statute encodes ("don't accumulate, don't copy, report immediately") and why making "an extra copy for safekeeping" can make you a defendant rather than a better investigator.

Group E — Sensitive data: minimization, confidentiality, and privilege

28.15 Define data minimization and distinguish it crisply from scope discipline: scope limits what you look at; minimization limits what you keep, copy, and show, even within scope. Then list the four concrete confidentiality controls the chapter names (access control, secure storage, secure transfer, secure disposal) and give a one-line example of each. Explain why confidentiality "survives the end of the case" — including the war-stories-at-dinner failure mode. (answer in Appendix)

28.16 (Filter teams and privilege.) Define legally privileged material (attorney-client communications, work product, doctor-patient, clergy-penitent) and explain what can happen to a matter if the investigating side reads it. Describe the standard mechanism — a filter team / taint team or court-appointed special master — saying what it reviews, what it removes, and what it passes on. Then state the examiner's three duties when privilege is in play (recognize it, follow the protocol scrupulously, and stop-and-flag if you hit apparently privileged material outside a protocol), and explain the chapter's framing that this is "scope discipline wearing a different hat — doors inside the dataset you are not permitted to open even though you physically can." Finally, give a concrete one-sentence scenario: during a keyword search for fraud terms, a hit lands inside an email whose header shows it was sent to the suspect's outside counsel — describe exactly what you do in the next thirty seconds.

28.17 ⭐ (Recovery vs. Forensics — the technician who sees the most.) The chapter argues a 💾 recovery technician "may be the human being who sees the most of a stranger's private life of anyone in this entire book." Explain why recovering "everything" (theme #1 — deleted ≠ destroyed) produces this exposure, and contrast the recovery tech's reason for minimizing (respect for a person who trusted you with their whole digital existence) with the examiner's reason (staying within authority). Then explain the Limitation the chapter draws: that to recover or to index you frequently must process the whole container, so you cannot always avoid encountering sensitive data — and that minimization is therefore "a discipline of the second look, not a guarantee about the first." Finish by explaining how an NSRL known-good exclusion is itself an act of minimization and good ethics. As a closing judgment, contrast the two clients of Chapter 1's wedding-photos job and a stranger whose drive happens to also hold a third party's intimate material: state what you verify, what you retain, what you disclose, and when you destroy your working copies — and why "see what you must to verify the recovery, retain nothing beyond the deliverable, disclose nothing ever" is the recovery tech's whole confidentiality creed in one line.

Group F — Codes of professional conduct, competence, and credentials

28.18 (Map the codes.) For each of IACIS, ISFCE, GIAC, and (ISC)², name one credential it issues and state one core ethical canon from its code. Then write the single "common thread" sentence that runs through all of them — the shared DNA — and explain why being able to name the code you adhere to is a question you will be asked on the stand (Chapter 27). (answer in Appendix)

28.19 Two canons are most often violated by people who consider themselves ethical: competence (do not exceed your expertise) and honesty about credentials. For competence, explain why rendering a confident opinion about a file system or encryption scheme you have never studied is an ethical violation even when you happen to be right, and why "that is outside my expertise" is the professional move (tie to theme #4 — technology changes, principles don't — and the duty to keep competence current). Then explain why tool and method validation is "an ethical duty hiding inside a technical practice," and write the one sentence that is simultaneously a Daubert answer and an ethics answer. Finally, give one example of a load-bearing finding you would corroborate with a second independent tool before putting your name on it, and explain why the cross-examiner's favorite trap is "the expert who claims to know everything" while "the durable expert is the one comfortable saying 'I don't know.'"

28.20 ⭐ (Judgment — the CV.) An examiner's résumé claims a certification that lapsed two years ago and rounds "assisted on about 40 cases" up to "over 100 cases examined." Neither misstatement touches the technical findings in the current matter. Explain why padding the CV is nonetheless "the single fastest way to have all of your testimony excluded," using the cross-examination logic that once a jury catches one misrepresentation under oath they are entitled to disbelieve every other fact you assert. Then state the clean alternative and where the book treats earning (versus claiming) credentials (Appendix I, Chapter 39).

Group G — The human cost, everyday integrity, and the limits of a code

28.21 Name and define the three clinical responses to sustained exposure the chapter distinguishes — secondary traumatic stress (vicarious trauma), compassion fatigue, and burnout — and list four of the symptoms it enumerates. Then explain, in two or three sentences, why these are "the predictable, normal response of a healthy nervous system to abnormal input" rather than a sign of weakness, and why treating them as a personal failing is itself part of the problem. (answer in Appendix)

28.22 (Build the exposure-reduction plan.) Construct a one-page exposure-management plan for an examiner about to rotate onto an exploitation queue, drawing at least two measures from each of the chapter's three tiers — technical (hash-set triage, PhotoDNA, grayscale review, reduced-size/blur, NSRL exclusion), organizational (time-boxing, two-person presence, caseload rotation, mandatory wellness, EAP/peer support), and personal (hard boundaries, decompression ritual, sleep/exercise, trauma-informed care, connection). For each chosen measure write one sentence on how it reduces harm, and explain the double-duty insight: that the technical measures "protect both the integrity of the evidence and the psyche of the examiner," because "the cheapest trauma to recover from is the one you never absorbed." Then add a two-sentence note for the examiner's supervisor, stating the organizational measures the chapter says labs "most often fail their people" on, and why treating wellness as "a program, not a poster" is itself a forensic-ethics obligation.

28.23 ⭐ (Judgment — the War Story.) Re-read the chapter's war story about the strong, respected examiner who was the de facto CSAM specialist for three years because he "could handle it." Explain why his competence was "exactly the trap," what the sentence "I can handle it" actually predicts, and why "exposure is cumulative and untreated exposure compounds." Then write the two things this requires of a supervisor as an ethical duty (not a nicety), and explain the chapter's claim that "a lab that lets its best examiner burn out in silence has failed at ethics just as surely as one that mishandles evidence."

28.24 (Everyday integrity.) The dramatic tests are rare; the career-defining ones are small and quiet. List five of the everyday-integrity duties the chapter names (bill honestly; do not overstate capability to win business; do not hold data hostage with surprise fees; correct your errors even after a case closes; decline what you cannot competently do). For correct your errors, write the two-sentence disclosure you send to a party who relied on a finding you can no longer support (a misread timestamp, a tool you later learned has a bug), and explain why "however embarrassing" is doing the work in that sentence. Then connect this to the ransomware scenario of Chapter 12: a 💾 recovery professional faces a business owner who wants to hear their data can be saved, and a 🔍 examiner faces a client who wants to hear the evidence proves their case — explain why "the kindest thing you can offer a frightened person is an honest professional," and why the integrity is usually in resisting "a thousand small nudges" rather than a single bribe.

28.25 (Judgment — the limits of a code.) In keeping with theme #5, state plainly what a code of ethics cannot do. Give one genuine dilemma where two duties collide (e.g., confidentiality to a client versus a duty to disclose), explain the two structural reasons the law beneath the code is "a moving, fractured target" (jurisdiction varies; the law lags the technology — cite the synthetic-media problem of Chapter 35 outrunning the statutes), and finish with the fallback the whole chapter circles back to: when the code runs out, escalate and seek guidance rather than improvise alone at the keyboard — and why "I am not certain this is within my authority, so I stopped and asked" is a mark of professionalism, like "the evidence is insufficient to reach a conclusion." As a final part, name the four places the chapter says you can escalate to when genuinely unsure (a supervisor, counsel, a trusted senior peer, your professional body's ethics resources), and explain why "a code is a floor, not an oracle" — that it can tell you the right action and still not make it easy (reporting a client, delivering a finding that frees someone you believe is guilty, admitting an error that embarrasses you, asking for help when you are drowning).

28.26 (Progressive project — the Authority & Ethics Memo.) Your Forensic Case File (built since Chapter 5, assembled in the capstone, Chapter 38) gets its ethics layer. Draft the Authority & Ethics Memo with all six required elements, one or two sentences each, citing the relevant artifact or instrument: (1) authority and scope — what authorized your exam, what it permitted, and how your search methodology stayed inside it; (2) conflicts — that you checked, and any you found (or that you found none, and how you checked); (3) sensitive-data handling — any medical/financial/intimate/privileged material encountered and the minimization/confidentiality measures applied; (4) contraband contingency — written in advance: stop, do not copy, preserve, isolate, document (path/hash/time/method, never content), escalate to the correct authority for your role; (5) findings vs. inferences and limitations — confirming each draft finding is sourced and each inference labeled; (6) a well-being note. Save it to the case-file folder. State in one sentence why "an examination without an ethics-and-authority record is not actually finished, however good the technical work."

Self-check. You have mastered this chapter when you can do four things without notes: state the objectivity rule in its exact words and name the three procedural defenses that protect it from the bias you cannot feel; execute the contraband first response cold — stop, do not copy, preserve, isolate, document (path/hash/time/method, never content), escalate — and explain who reports to whom under §2258A versus §2252/§2252A versus your own state's law; handle sensitive and privileged data with minimization, confidentiality controls, and filter teams; and recognize secondary trauma in yourself and others and name the technical, organizational, and personal measures that manage it. If the authority spectrum, the affirmative-defense logic of "do not copy," or the findings-versus-inferences distinction still feels shaky, re-read the matching section before you ever sit at a bench where it could be tested for real. Next, Chapter 29 — Encrypted Device Forensics turns from the ethics of what you may do to the technical wall of what you sometimes cannot — where "know your limitations" stops being a maxim and becomes a daily fact of the bench.