Chapter 28 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and a scoring band at the bottom. Commit to an answer before you look — the contraband and reporting items especially are ones you want reflexive, not looked-up.

Multiple choice

Q1. Which statement best describes the forensic examiner's primary obligation? - A) To advocate zealously for the party who retained them. - B) To serve the truth, not the client — reporting what the evidence shows even when it hurts the side that hired you. - C) To reach the conclusion most consistent with the engagement letter. - D) To avoid any finding that could expose the client to liability.

Q2. Which of the following is an inference rather than a finding? - A) A USB device with serial 4C530001234567890123 was connected on 2026-03-12 at 18:51 UTC. - B) The $STANDARD_INFORMATION` timestamp precedes the `$FILE_NAME timestamp on the file. - C) The employee intended to steal the design and harm the company. - D) TurbineHousing_v7.sldprt was opened from drive E: at 19:04 per the LNK record.

Q3. Why must an expert witness never accept a contingency fee? - A) It is taxed as ordinary income rather than capital gains. - B) It pays you for a particular outcome, converting testimony into advocacy, and is widely treated as grounds to exclude that testimony. - C) It violates HIPAA. - D) It is prohibited only in criminal matters.

Q4. A warrant authorizes searching a 2 TB drive for evidence of financial fraud. Browsing the entire device by hand and later claiming that whatever you happened to see was in "plain view": - A) is the recommended, efficient approach. - B) is fine as long as you document it afterward. - C) risks suppression of everything — including the fraud evidence you were authorized to find — because digital "plain view" edges toward the general warrant the Fourth Amendment forbids. - D) is required by the Federal Rules of Civil Procedure.

Q5. You encounter a single apparent CSAM image during an authorized media review. The correct first action is to: - A) open the surrounding files to confirm the finding and gauge the scope. - B) export a sample and email it to your supervisor for a second opinion. - C) stop examining that item immediately — one apparent item triggers the duty, and confirming the crime is not your job. - D) delete it so it cannot spread further.

Q6. Why is "do not copy" an absolute legal line rather than mere lab etiquette? - A) Copies waste storage and slow the case. - B) Reproduction, distribution, and possession of CSAM can themselves be felonies under 18 U.S.C. §2252/§2252A, and "I was preserving evidence" is not a general license for a private party. - C) Copying any evidence voids the chain of custody. - D) The drive's warranty forbids duplication.

Q7. The mandatory CyberTipline reporting duty of 18 U.S.C. §2258A, by its terms, falls directly on: - A) every individual who encounters apparent CSAM. - B) data-recovery technicians specifically. - C) electronic-communication-service and remote-computing-service providers (hosting, cloud, ISPs, email and messaging services). - D) defense attorneys and their experts.

Q8. A suspect resized and re-encoded a known image before storing it. Which detection method can still flag it? - A) An MD5 cryptographic hash of the file. - B) A SHA-256 cryptographic hash of the file. - C) A PhotoDNA perceptual/robust hash, which signatures the visual content and survives resizing and re-compression. - D) None — any edit defeats every form of hashing.

Q9. The standard mechanism for keeping the investigative team from reading attorney-client privileged material is: - A) deleting all email from the forensic image before analysis. - B) a filter team (taint team) or court-appointed special master that reviews first, removes privileged items, and passes only the non-privileged remainder onward. - C) asking the suspect to identify which files are privileged. - D) ignoring privilege, since a valid warrant overrides it.

Q10. Secondary traumatic stress, compassion fatigue, and burnout in forensic examiners are best understood as: - A) signs that a person is unsuited to the work and should be permanently reassigned. - B) rare conditions limited to clinicians, not technical staff. - C) predictable, normal responses of a healthy nervous system to abnormal input — to be managed deliberately, not endured in silence. - D) a liability the examiner must conceal to keep their certification.

True/False

Q11. Making one extra copy of suspected CSAM "for safekeeping" is acceptable as long as you store it securely and restrict access. (True / False)

Q12. Because §2258A's CyberTipline duty names providers, a private examiner or data-recovery technician who finds apparent CSAM has no obligation of any kind. (True / False)

Short answer

Q13. In two or three sentences, distinguish a finding from an inference, and explain why the report must keep them separate.

Q14. In two or three sentences, explain why — after a single apparent contraband hit — "let me keep looking to be sure" is the wrong instinct, both legally and for your own well-being.

---

Answer key

Q1 — B. The examiner serves the truth, not the client; you report what the evidence shows even when it wounds the retaining party. That independence is the structural reason an expert is permitted to offer opinions in court at all, and shading findings collapses the testimony and taints every other case.

Q2 — C. Intent is not a thing you can read out of a registry hive — it is an interpretation. (A), (B), and (D) are sourced, bounded, and verifiable by re-running the work; (C) is an inference that, if offered at all, must be carefully qualified and labeled, never given the certainty of a finding.

Q3 — B. A contingency fee pays you to reach a particular conclusion, which is why courts widely treat it as grounds to exclude an expert's testimony. You bill for time and expertise, never for an answer.

Q4 — C. General rummaging invites suppression of everything, by taint, because importing plain view uncritically into a whole-device search risks the general warrant the Fourth Amendment was written to forbid (the Carey / Comprehensive Drug Testing line). The fix is a scope-respecting, documented methodology.

Q5 — C. Stop immediately; one apparent item triggers the duty, and confirming the extent of a crime is the job of the law-enforcement examiner working under proper authority — not yours. Opening more files is additional criminal exposure and additional trauma for zero investigative benefit.

Q6 — B. Federal law criminalizes the handling — receipt, reproduction, distribution, transportation, possession — not only the creation, under §2252/§2252A; a private party's possession is not authorized, so "I was just preserving it" is no general defense. The safe path runs through not copying and reporting immediately.

Q7 — C. By its terms §2258A obligates ESP/RCS providers (hosting, cloud, ISPs, messaging) to report apparent violations to the NCMEC CyberTipline — not individual examiners or one-person recovery shops. (That does not leave an individual with no duty — see Q12.)

Q8 — C. A cryptographic hash matches only byte-identical files, so resize/re-encode/one-pixel changes defeat MD5, SHA-1, and SHA-256 alike. PhotoDNA computes a robust signature of the image's visual content that survives those alterations, which is what makes large-scale detection feasible without a human viewing every file.

Q9 — B. A filter/taint team or special master — walled off from the investigative team — reviews first, strips privileged items, and passes only the remainder, so the people working the case never read attorney-client communications or work product. Reading privileged material can taint the matter and even disqualify counsel.

Q10 — C. They are the predictable, normal response of a healthy nervous system to abnormal input, not a personal failing — and the stigma of treating them as weakness is exactly what stops people from getting help until the damage is done. They are managed with technical, organizational, and personal measures.

Q11 — False. Reproduction and possession of CSAM can themselves be felonies (§2252/§2252A); the safe path runs through not copying and reporting immediately, not through accumulating securely stored copies you were never authorized to hold. "For safekeeping" is exactly the rationalization the statute does not forgive.

Q12 — False. The absence of a federal §2258A provider duty is not the absence of a duty: several states impose statutory reporting obligations specifically on computer technicians (e.g., Missouri's Mo. Rev. Stat. §568.110 and South Carolina's), professional codes treat report-and-cease as a standing policy, and the obligation is in any case professional and moral. Know your jurisdiction's law.

Q13 — Model answer. A finding is what the artifact says — sourced, bounded, and verifiable by anyone who re-runs your work (e.g., "device serial X connected at 18:51 UTC"); an inference is what you think it means (e.g., "the user intended to steal it"). The report separates them so that a carefully qualified expert opinion can never borrow the unearned certainty of a fact, which is what keeps the examination objective and survivable on cross-examination.

Q14 — Model answer. One apparent item already triggers the reporting duty, so continuing to examine adds nothing investigative while exposing you to additional criminal liability for handling the material and confirming the full extent of the crime — which is the job of the authorized law-enforcement examiner, not you. It also needlessly increases your own exposure to traumatic content; stopping protects the case, your legal standing, and your mind at once.

Scoring: 13–14 correct — you can execute the contraband response and the objectivity, scope, and reporting rules cold; you are ready to be trusted with sensitive work. 10–12 — solid, but revisit the §2258A-versus-§2252 distinction and the findings-versus-inferences line. 7–9 — you have the vocabulary but not yet the reflexes; re-read "When you find contraband" and "Objectivity" before any engagement where it could matter. Below 7 — re-read the chapter end to end; in this domain the cost of getting ethics wrong is suppressed evidence, a freed predator or a destroyed innocent, a lost career, and in some cases your own criminal exposure.