1

I'm studying for the CCSP certification and the online training course I'm taking is a little vague on the topic of evidence types (within the context of digital forensics).

Specifically, I'd like to know if it's possible for evidence from a digital forensics investigation to be multiple types of evidence at the same time. For example, can digital content bet Direct Evidence and Real Evidence and Best Evidence?

The instructor presented them as completely separate types of evidence independent of one another but it seems to me that there could be some overlap here and that one piece of digital evidence could serve multiple purposes.

Improve this question

1 Answer 1

Reset to default
2

Let's first map out what each of these terms mean:

  1. Direct evidence: "proves or disproves a fact directly." It's common for direct evidence to take the form of eyewitness testimony, but this doesn't have to be the case. Real or documentary evidence can be direct evidence, too.
  2. Real evidence: used interchangeably with physical evidence, is "any evidence that is a tangible object, as opposed or oral testimony or documentary evidence, which records information that is offered as evidence." What's more, it's "used to prove a fact based on the characteristics of all or part of an object." For example, if I'm at a stoplight and I get rear-ended and my airbag deploys, the airbag would be an example of real evidence.
  3. Best evidence: "requires that an original or a highly accurate copy of a document or other object be brought into court."

Now to your question: Can a piece of evidence fall into all three categories?

Yes, and here's a (common) example. Imagine an external hard drive with a terabyte of child pornography on it. If a forensic scientist can demonstrate that the external hard drive belongs to the defendant who is being accused of possessing child pornography, then the direct evidence condition has been met.

For real evidence, let's assume that the defendant covered his external hard drive with a variety of stickers. Upon examination, the defendant plays dumb, but the prosecutor reveals that a search of his apartment found sheets of the same stickers that were on his hard drive. The characteristics of the hard drive, the stickers, would be good reason to believe that the hard drive belongs to the defendant.

Lastly, the original hard drive of the defendant or a forensic copy could satisfy the best evidence condition. Hashing the forensic copy can verify that the "image" (in the digital forensics sense, not necessarily a picture) is identical to the source media, which would mean that the forensic copy of the digital hard drive would satisfy the best evidence condition.

Sources:

Improve this answer
3
  • 1
    Your examples are all evidence that this person was in possession of the hard drive, and that the hard drive contained illegal material. It does not prove that it was not put there by e.g. malware (which can very reliably leave intentional forensic evidence and has quite a few times lead to innocent people being convicted). Also a terabyte seems like a bit much, unless they're storing every image as an uncompressed TIFF for some silly reason.
    – forest
    Commented Mar 8, 2018 at 6:32
  • That's a good point @forest. Does this mean that the drive in my example is disqualified from being direct, real, or best evidence? I suppose a prosecutor would be a little more ambitious in the direct evidence category, and want to show that the drive belongs to the defendant and the illegal material was transferred there by the defendant. Or are there other issues I am missing?
    – user171922
    Commented Mar 8, 2018 at 7:17
  • In general, while the forensic process is often pretty... bad, there is still often a requirement to prove possession at the time of the illegal activity. Sometimes it's as easy as asking the suspect if anyone else has access to their computer, and sometimes it requires getting an expert to analyze the drive for signs of tampering (which may or may not be effective). You also have to prove that they knew the content was on the drive. People have been acquitted because illegal content was in their browser cache and there was no evidence that they knew it was there.
    – forest
    Commented Mar 8, 2018 at 7:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .