Which of the following is a problem regarding computer investigation issues?
A.
Information is tangible.
B.
Evidence is easy to gather.
C.
Computer-generated records are only considered secondary evidence, thus are not as reliable as best
evidence.
D.
In many instances, an expert or specialist is not required.
Explanation:
Computer-based evidence is typically considered hearsay evidence. Hearsay is second-hand evidence, as
opposed to direct evidence. Second-hand evidence is treated as less reliable.
Incorrect Answers:
A: Tangible information does not cause problem within an investigation.
B: Easily collected information would cause a problem.
D: During a computer investigation an expert or specialist could very well be required.Stewart, James M., Ed Tittel, and Mike Chapple, CISSP: Certified Information Systems Security Professional
Study Guide, 5th Edition, Sybex, Indianapolis, 2011, p. 389
Computer generated incidents are not hearsay.
“Computer-generated records contain the output of computer instructions without
manual intervention. This fails the hearsay definition listed above because in
computer-generated records, a “person” is not making an assertion. So
generally courts have not applied Hearsay standards to pure computer generated
records thus it is initially admissible in courts. This will include the
output of programs, logs, receipts, reports, etc”
Reference: Sans.org document section on page 5–>
https://www.sans.org/reading-room/whitepapers/legal/hearsay-evidence-computer-emergency-response-team-cert-1541