312-49 Question #585: Real Exam Question with Answer & Explanation

The correct answer is C: Image file on a hard disk. Physical evidence refers to tangible, real-world objects that can be collected and handled. Removable media (USB drives, CDs), cables, and publications are all physical, touchable items. An image file on a hard disk is digital/logical evidence â€” it is data stored on a medium, n

Submitted by obi.ng· Apr 18, 2026Computer Forensics in Today's World

Question

Which of the following is NOT a physical evidence?

Options

ARemovable media
BCables
CImage file on a hard disk
DPublications

Explanation

Physical evidence refers to tangible, real-world objects that can be collected and handled. Removable media (USB drives, CDs), cables, and publications are all physical, touchable items. An image file on a hard disk is digital/logical evidence â€” it is data stored on a medium, not a physical object itself. In digital forensics, the distinction between physical evidence (the hardware) and digital evidence (the data or files) is critical for proper evidence classification and handling procedures.

Topics

#Physical evidence#Digital evidence#Evidence classification#Forensic evidence types

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice Browse All 312-49 Questions