Chapter 3: Computer Forensics and Evidence Handling

1. (2)
   Corroborative evidence is best defined as evidence that supports the conclusions made from a primary piece of evidence. Evidence that stands alone and would be admissible in its current format in court would be best evidence. Evidence that contradicts the primary evidence is still direct evidence, and could – under certain circumstances – still be called best evidence.
   Evidence that requires explanation from expert testimony is called indirect or circumstantial evidence, and includes things such as DNA that require interpretation to draw conclusions.
2. (3)
   By copying the files to removable storage, the investigator has made a logical copy, which will have a degraded value compared to the original drive. The original drive would be considered best evidence, which could be submitted directly to court, regardless...