Systems Security Certified Practitioner – SSCP – Question0620

Computer-generated evidence is considered:

A.
Best evidence
B. Second hand evidence
C. Demonstrative evidence
D. Direct evidence

Correct Answer: B

Explanation:

Computer-generated evidence normally falls under the category of hearsay evidence, or second-hand evidence, because it cannot be proven accurate and reliable. Under the U.S. Federal Rules of Evidence, hearsay evidence is generally not admissible in court. Best evidence is original or primary evidence rather than a copy or duplicate of the evidence. It does not apply to computer-generated evidence. Direct evidence is oral testimony by witness. Demonstrative evidence are used to aid the jury (models, illustrations, charts).
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 9: Law, Investigation, and Ethics (page 310). And: ROTHKE, Ben, CISSP CBK Review presentation on domain 9.