Module 4 Assessment Quiz | CCEC

Q1Section 63 BSA

A Section 63 BSA certificate must be signed by:

A.Any employee of the organization B.A notary public C.A person in responsible position in relation to operation of the computer or management of relevant activities D.The legal department head

Explanation

Section 63(4) BSA specifically requires the certificate from a person "occupying a responsible official position in relation to the operation of the relevant device or the management of the relevant activities." This means someone with actual operational control, not just any employee or legal representative.

Q2Authenticity

Hash values in digital forensics serve to:

A.Encrypt the evidence to prevent unauthorized access B.Verify that digital evidence has not been modified since collection C.Identify the owner of the device D.Speed up the analysis process

Explanation

Hash values are digital fingerprints. If even one bit changes, the hash changes completely. By comparing hashes at collection and analysis, investigators prove the data was not modified. Without matching hashes, integrity is compromised.

Q3WhatsApp Evidence

Scenario

The prosecution produces WhatsApp screenshots as evidence against the accused.

What is the primary weakness of this evidence?

A.WhatsApp's end-to-end encryption means no server verification is possible, and screenshots can be easily fabricated B.WhatsApp is not a valid communication platform C.Screenshots are automatically admissible D.WhatsApp deletes all messages after 24 hours

Explanation

WhatsApp's end-to-end encryption means the company cannot provide message content for verification. Combined with the ease of fabricating screenshots, this makes WhatsApp screenshot evidence inherently weak without device-level forensic corroboration.

Q4Email Evidence

The "From" field in an email:

A.Cannot be changed and is always accurate B.Is verified by all email servers before delivery C.Is encrypted and tamper-proof D.Can be set to any address by the sender and is easily spoofed

Explanation

Email spoofing is trivially easy. The "From" field can be set to any address the sender chooses. Proper email authentication requires server-side logs, SPF/DKIM verification, and header analysis - not just the displayed "From" address.

Q5CCTV Evidence

Scenario

CCTV footage shows the incident occurred at 21:47. The accused claims alibi at that exact time.

What is the most effective challenge to the CCTV timestamp?

A.CCTV timestamps are always accurate B.DVR clocks drift over time and are rarely synchronized - the timestamp could be off by several minutes C.The footage itself must be fake D.CCTV evidence is not admissible in court

Explanation

CCTV timestamps are only as accurate as the DVR's internal clock, which is rarely synchronized with accurate time sources and can drift significantly over months. Without verification of clock accuracy, timestamps may be minutes or even hours off.

Q6Chain of Custody

Scenario

A mobile phone was seized on January 1st but sent to FSL only on January 20th. The phone was kept in the Malkhana without a Faraday bag.

What is the primary concern?

A.The delay is normal and acceptable for all evidence B.The phone battery may have died C.Without Faraday shielding, the phone could have been remotely accessed and data added or deleted D.FSL cannot examine phones older than 10 days

Explanation

Mobile devices require immediate isolation in Faraday bags to prevent remote access. Without shielding, the phone can be accessed remotely via WhatsApp Web, iCloud, or other services - allowing data to be added, deleted, or modified without physical access.

Q7Social Media

A Facebook account with the accused's name and photo is produced as evidence. This proves:

A.Only that an account exists with that name and photo - not that the accused controls it B.The accused definitely created and controls the account C.Facebook has verified the accused's identity D.The accused committed the alleged offense

Explanation

Anyone can create a social media account with any name and any photo. Account ownership must be independently proved through registration records (email, phone), login history, or device forensics. A name and photo alone prove nothing.

Q8Metadata

Scenario

A contract is dated March 15, 2023, but the document metadata shows "Created: March 28, 2023."

What does this suggest?

A.The metadata is always wrong B.The computer clock was set incorrectly C.March 28 is before March 15 D.The document was created after the alleged execution date - possible backdating

Explanation

If a document's creation date is 13 days after the date shown on the document, it suggests the document was created later and backdated. Metadata can expose fabrication that content examination cannot reveal.

Q9Section 63 BSA

When should you object to a defective Section 63 certificate?

A.During final arguments B.When the document is tendered for marking as exhibit, before cross-examination C.During appeal D.Never - certificates cannot be challenged

Explanation

Object when the document is tendered, before cross-examination. Cross-examining on the document's contents without objecting may be treated as waiver of the objection. Object FIRST, then cross-examine if overruled.

Q10CCTV Evidence

The best evidence of CCTV footage is:

A.A USB drive copy provided by the owner B.Screenshots of key frames C.The original DVR hard drive with proper forensic imaging and hash verification D.A verbal description of what the footage showed

Explanation

The original DVR hard drive is the best evidence. USB copies can be easily edited, and screenshots lose context and metadata. Proper chain of custody requires forensic imaging of the original drive with hash verification at each step.

Electronic Evidence & Digital Cross-Examination

Instructions