Section 5 - Event Correlation & Normalization Flashcards
1
Q
Name the main two broad types of Evidence?
A
Direct Evidence
Circumstantial Evidence
2
Q
Describe Direct Evidence?
A
Does not require any reasoning to reach the conclusion to be drawn from the evidence.
3
Q
Describe Circumstantial Evidence?
A
Requires an inference linking the evidence to the conclusion drawn from the evidence and sometimes called indirect evidence.
4
Q
Describe Corroborating Evidence?
A
Corroborating evidence is evidence that supports an assertion that is supported by previously obtained evidence. The existence of corroborating evidence increases the level of confidence in the assertion.
5
Q
What are the four phases of digital forensics?
A
Collect
Examine
Analysis
Reporting