CHFI · Domain 1
Forensic Science, Regulations, Policies and Ethics
About 25% of the exam
The investigative process
- Identify
- Preserve
- Collect
- Examine
- Analyze
- Report
- Authorization comes before collection
- Preservation outranks curiosity
- Examination extracts, analysis interprets
- Reporting states methods and limits
- Every phase is documented as it happens
Scientific method in casework
- Form a testable hypothesis first
- Look for evidence that would refute it
- Reproducible steps beat clever shortcuts
- Peer review before conclusions leave the lab
- Absence of contradiction is not proof
- Confirmation bias is the common failure
Say what would have proved you wrong, then show that you looked for it
Types of cybercrime
- Computer as target
- intrusion, denial of service
- Computer as tool
- fraud, harassment, theft
- Computer as container
- stored records of an offense
- Insider misuse
- authorized access, unauthorized purpose
- Civil matter
- policy breach, contract, employment
- Criminal matter
- state prosecutes, higher standard
Authority to search
- Warrant
- scope, place and time bounded
- Consent
- informed, from someone with authority
- Corporate policy
- acceptable use and monitoring notice
- Exigent circumstances
- narrow, evidence about to vanish
- Plain view
- limited in digital search contexts
- Out of scope find
- stop, document, seek new authority
Consent can be limited and withdrawn, and one user cannot consent for another user's protected area
Admissibility standards
Reliability tests
- General acceptance in the field
- Tested method with known error rate
- Published and peer reviewed technique
- Standards controlling the operation
- Gatekeeping covers technical experience too
Evidence rules
- Expert testimony must help the trier
- Authentication shows the item is what claimed
- Self authenticating certified copies exist
- Duplicates admitted unless authenticity is questioned
- Records kept in business ordinarily admitted
Admissibility factors
- Relevant to a fact in dispute
- Authentic and traceable to its source
- Lawfully obtained under stated authority
- Reliable method, reproducible by another examiner
- Complete rather than selectively presented
Hash values plus a clean custody record plus testimony about the method is the standard authentication package
Hearsay and records
- Machine generated logs assert nothing themselves
- Human statements inside records are different
- Business records need a foundation witness
- Regular course of business matters
- Certification can replace live testimony
- Best evidence favors originals or duplicates
Preservation duties
- Anticipated litigation triggers the hold
- Suspend routine deletion immediately
- Notify custodians in writing
- Preserve before any reimaging or reissue
- Spoliation invites sanctions and inference
- Document the preservation steps taken
Ethics in practice
- Never create or embellish evidence
- Decline work that requires a predetermined result
- Disclose conflicts before accepting the case
- Stay inside the authorized scope
- Report findings that hurt the client too
- Testify to the evidence, not the side
Objectivity is the product being sold; an examiner who advocates has nothing left to sell
Lab and quality controls
- Standard procedures
- same result whoever performs it
- Tool validation
- known data, expected output, recorded
- Dual tool checks
- second tool confirms key findings
- Competency testing
- examiners proven before casework
- Evidence storage
- restricted, logged, environmentally controlled
- Case file
- complete record of every action
Forensic readiness
Decide in advance
- What data is collected and kept
- Who has authority to preserve
- How incidents hand off to forensics
- Which tools and formats are standard
Build the capability
- Central logging with sensible retention
- Trained responders and rehearsed playbooks
- Pre approved legal and privacy review
- Contacts for providers and counsel
Prove it works
- Exercise the handoff regularly
- Audit whether logs actually exist
- Review scope creep after every case
- Feed gaps back into policy
Cross border and provider data
- Data location decides which law applies
- Treaty requests move evidence between states
- Providers answer to their own jurisdiction
- Privacy law can limit what may be exported
- Informally obtained evidence may be unusable
- Involve counsel before touching foreign data
Report and testimony basics
- Executive summary in plain language
- Methods described so others can repeat them
- Findings tied to specific artifacts
- Limitations stated without prompting
- Answer only what was asked
- Concede possibilities the evidence cannot exclude
Rapid recall
- Relevance
- makes a disputed fact more probable
- Authentication
- proof the item is genuine
- Best evidence
- original or an acceptable duplicate
- Spoliation
- destroying evidence you should keep
- Legal hold
- suspend deletion, preserve everything relevant
- Fruit of the poisonous tree
- evidence derived from an unlawful search
- Treaty request
- formal channel between two states
Know the order
- Confirm authority
- Preserve the scene
- Document everything
- Collect by volatility
- Verify with hashes
- Analyze the copy
Authority before access: evidence collected outside the authorized scope can lose the whole case
Reference strip: law, ethics, process
Reliability tests
- General acceptance standard
- Testing and error rate factors
- Gatekeeping over technical testimony
- Peer review and published methods
Evidence rules
- Expert testimony admissibility
- Authentication of items
- Certified electronic records
- Duplicates and best evidence
- Business records exception
Authority
- Warrant scope and time limits
- Consent, authority and withdrawal
- Corporate monitoring policy
- Treaty requests across borders
Ethical duties
- No fabrication or exaggeration
- Conflicts disclosed early
- Scope respected throughout
- Findings reported either way
Quality controls
- Written standard procedures
- Validated tools and versions
- Dual tool verification
- Complete and reviewable case file
Quick exam traps
- Trap: A corporate investigator faces the same constitutional limits as police
- Trap: Automatically generated logs are always inadmissible hearsay
- Trap: Evidence found outside the warrant scope can simply be seized
- Trap: General acceptance is the only test any court applies
- Trap: One user can consent to a search of another user's private area
- Trap: A hash match alone authenticates the evidence completely
- Trap: Deleting routine data during litigation is acceptable if it is policy
cybercertprep.com · original revision sheet written from the public body of knowledge