WGU C702 EXAM {LATEST
2025-26} QUESTIONS AND
VERIFIED ANSWERS 100%
GUARANTEED PASS
Admissible evidence - correct answer Evidence that can be legally and properly introduced in a
civil or criminal trial.
Evidence is relevant to the case
Authentic Evidence - correct answer Evidence that is in its original or genuine state.
Investigators must provide supporting documents regarding the authenticity, accuracy, and
integrity of the evidence
Complete Evidence - correct answer Evidence must either prove or disprove the fact
Reliable Evidence - correct answer evidence that possesses a sufficient degree of likelihood that
it is true and accurate
Evidence must be proven dependable when the evidence was extracted
Believable Evidence - correct answer Evidence must be presented in a clear manner and expert
opinions must be obtained where necessary
Rules of Evidence - correct answer Rules governing the admissibility of evidence in trial courts.
,Best Evidence Rule - correct answer states that secondary evidence, or a copy, is inadmissible in
court when the original exists.
Duplicate evidence will suffice under the following conditions:
-Original evidence is destroyed due to fire or flood
-Original evidence is destroyed in the normal course of business
-Original evidence is in possession of a third party
Forensic Readiness - correct answer An organization's ability to make optimal use of digital
evidence in a limited period and with minimal investigation costs.
Fourth Amendment - correct answer Protects against unreasonable search and seizure.
Government agents may not search or seize areas or things in which a person has reasonable
expectation of privacy, without a search warrant.
Chain of Custody - correct answer a written record of all people who have had possession of an
item of evidence
Rule 101: Scope - correct answer These rules govern proceedings in the courts of the United
States and before United States bankruptcy judges and United States magistrate judges, to the
extent and with the exceptions stated in rule 1101.
Rule 102: Purpose and Construction - correct answer These rules shall be construed to secure
fairness in administration, elimination of unjustifiable expense and delay, and promotion of
growth and development of the law of evidence to the end that the truth may be ascertained
and proceedings justly determined.
Rule 105: Limited Admissibility - correct answer When evidence that is admissible as to one
party or for one purpose but not admissible as to another party or for another purpose is
,admitted, the court, upon ITProTV Video Notes for CHFI v9 request, shall restrict the evidence
to its proper scope and instruct the jury accordingly
Rule 801: Hearsay - correct answer "Hearsay" means a statement that:
(1) the declarant does not make while testifying at the current trial or hearing; and
(2) a party offers in evidence to prove the truth of the matter asserted in the statement.
Rule 1002. Requirement of the Original - correct answer An original writing, recording, or
photograph is required in order to prove its content unless these rules or a federal statute
provides otherwise.
Rule 1003. Admissibility of Duplicates - correct answer A duplicate is admissible to the same
extent as the original unless a genuine question is raised about the original's authenticity or the
circumstances make it unfair to admit the duplicate.
Rule 1004. Admissibility of Other Evidence of Content - correct answer Admissibility of Other
Evidence of Content
Scientific Working Group on Digital Evidence (SWGDE) - correct answer brings together
organizations actively engaged in the field of digital and multimedia evidence to foster
communication and cooperation as well as to ensure quality and consistency within the forensic
community.
Computer Forensics Investigation Process - correct answer 1. Pre-Investigation
2. Investigation
3. Post-Investigation
Pre-Investigation - correct answer Tasks performed prior to investigation
Setting up a computer forensics lab, toolkit, and workstation
, Investiagtion - correct answer Main phase in computer forensics investigation
Acquisition, preservation, and analysis of the data
Post-Investigation - correct answer Reporting and documentation of all the actions undertaken
and the findings
Ensure that the target audience can easily understand the report
Ensure report provides adequate and acceptable evidence
Computer Forensics Laboratory - correct answer Work area considerations (50-63 sq. ft per
station) no windows
ASCLD/Lab Accreditation
ISO/IEC 17025
Forensic Hardware Tools - correct answer FRED, Paraben's StrongHold, PC-3000 Data Extractor,
Paraben's Chat Stick, RAPID IMAGE 7020 X2, RoadMASSter-3 X2, ZX-Tower, Data Recovery Stick,
Tableau T8-R2 Forensic USB Bridge
FRED - correct answer Acquires data directly from hard drives and storage devices
Paraben's StrongHold - correct answer blocks out wireless signals
PC-3000 Data Extractor - correct answer Diagnoses and fixes file system issues, so data can be
obtained
Paraben's Chat Stick - correct answer Thumb drive devices; searches the entire computer and
scan for chat logs
2025-26} QUESTIONS AND
VERIFIED ANSWERS 100%
GUARANTEED PASS
Admissible evidence - correct answer Evidence that can be legally and properly introduced in a
civil or criminal trial.
Evidence is relevant to the case
Authentic Evidence - correct answer Evidence that is in its original or genuine state.
Investigators must provide supporting documents regarding the authenticity, accuracy, and
integrity of the evidence
Complete Evidence - correct answer Evidence must either prove or disprove the fact
Reliable Evidence - correct answer evidence that possesses a sufficient degree of likelihood that
it is true and accurate
Evidence must be proven dependable when the evidence was extracted
Believable Evidence - correct answer Evidence must be presented in a clear manner and expert
opinions must be obtained where necessary
Rules of Evidence - correct answer Rules governing the admissibility of evidence in trial courts.
,Best Evidence Rule - correct answer states that secondary evidence, or a copy, is inadmissible in
court when the original exists.
Duplicate evidence will suffice under the following conditions:
-Original evidence is destroyed due to fire or flood
-Original evidence is destroyed in the normal course of business
-Original evidence is in possession of a third party
Forensic Readiness - correct answer An organization's ability to make optimal use of digital
evidence in a limited period and with minimal investigation costs.
Fourth Amendment - correct answer Protects against unreasonable search and seizure.
Government agents may not search or seize areas or things in which a person has reasonable
expectation of privacy, without a search warrant.
Chain of Custody - correct answer a written record of all people who have had possession of an
item of evidence
Rule 101: Scope - correct answer These rules govern proceedings in the courts of the United
States and before United States bankruptcy judges and United States magistrate judges, to the
extent and with the exceptions stated in rule 1101.
Rule 102: Purpose and Construction - correct answer These rules shall be construed to secure
fairness in administration, elimination of unjustifiable expense and delay, and promotion of
growth and development of the law of evidence to the end that the truth may be ascertained
and proceedings justly determined.
Rule 105: Limited Admissibility - correct answer When evidence that is admissible as to one
party or for one purpose but not admissible as to another party or for another purpose is
,admitted, the court, upon ITProTV Video Notes for CHFI v9 request, shall restrict the evidence
to its proper scope and instruct the jury accordingly
Rule 801: Hearsay - correct answer "Hearsay" means a statement that:
(1) the declarant does not make while testifying at the current trial or hearing; and
(2) a party offers in evidence to prove the truth of the matter asserted in the statement.
Rule 1002. Requirement of the Original - correct answer An original writing, recording, or
photograph is required in order to prove its content unless these rules or a federal statute
provides otherwise.
Rule 1003. Admissibility of Duplicates - correct answer A duplicate is admissible to the same
extent as the original unless a genuine question is raised about the original's authenticity or the
circumstances make it unfair to admit the duplicate.
Rule 1004. Admissibility of Other Evidence of Content - correct answer Admissibility of Other
Evidence of Content
Scientific Working Group on Digital Evidence (SWGDE) - correct answer brings together
organizations actively engaged in the field of digital and multimedia evidence to foster
communication and cooperation as well as to ensure quality and consistency within the forensic
community.
Computer Forensics Investigation Process - correct answer 1. Pre-Investigation
2. Investigation
3. Post-Investigation
Pre-Investigation - correct answer Tasks performed prior to investigation
Setting up a computer forensics lab, toolkit, and workstation
, Investiagtion - correct answer Main phase in computer forensics investigation
Acquisition, preservation, and analysis of the data
Post-Investigation - correct answer Reporting and documentation of all the actions undertaken
and the findings
Ensure that the target audience can easily understand the report
Ensure report provides adequate and acceptable evidence
Computer Forensics Laboratory - correct answer Work area considerations (50-63 sq. ft per
station) no windows
ASCLD/Lab Accreditation
ISO/IEC 17025
Forensic Hardware Tools - correct answer FRED, Paraben's StrongHold, PC-3000 Data Extractor,
Paraben's Chat Stick, RAPID IMAGE 7020 X2, RoadMASSter-3 X2, ZX-Tower, Data Recovery Stick,
Tableau T8-R2 Forensic USB Bridge
FRED - correct answer Acquires data directly from hard drives and storage devices
Paraben's StrongHold - correct answer blocks out wireless signals
PC-3000 Data Extractor - correct answer Diagnoses and fixes file system issues, so data can be
obtained
Paraben's Chat Stick - correct answer Thumb drive devices; searches the entire computer and
scan for chat logs
