Section 5 - Event Correlation & Normalization

Question 1

Name the main two broad types of Evidence?

Answer 1

Direct Evidence

Circumstantial Evidence

Question 2

Describe Direct Evidence?

Answer 2

Does not require any reasoning to reach the conclusion to be drawn from the evidence.

Question 3

Describe Circumstantial Evidence?

Answer 3

Requires an inference linking the evidence to the conclusion drawn from the evidence and sometimes called indirect evidence.

Question 4

Describe Corroborating Evidence?

Answer 4

Corroborating evidence is evidence that supports an assertion that is supported by previously obtained evidence. The existence of corroborating evidence increases the level of confidence in the assertion.

Question 5

What are the four phases of digital forensics?

Answer 5

Collect
Examine
Analysis
Reporting