GSEC · Question #71
A US case involving malicious code is brought to trial. An employee had opened a helpdesk ticket to report specific instances of strange behavior on her system. The IT helpdesk representative…
The correct answer is C. The user of the infected system. Direct evidence requires a witness who personally and firsthand observed the event in question - only the user directly experienced the malicious behavior on her own system.
Question
A US case involving malicious code is brought to trial. An employee had opened a helpdesk ticket to report specific instances of strange behavior on her system. The IT helpdesk representative collected information by interviewing the user and escalated the ticket to the system administrators. As the user had regulated and sensitive data on her computer, the system administrators had the hard drive sent to the company's forensic consultant for analysis and configured a new hard drive for the user. Based on the recommendations from the forensic consultant and the company's legal department, the CEO decided to prosecute the author of the malicious code. During the court case, which of the following would be able to provide direct evidence?
Options
- AThe IT helpdesk representative
- BThe company CEO
- CThe user of the infected system
- DThe system administrator who removed the hard drive
How the community answered
(59 responses)- A15% (9)
- B8% (5)
- C73% (43)
- D3% (2)
Why each option
Direct evidence requires a witness who personally and firsthand observed the event in question - only the user directly experienced the malicious behavior on her own system.
The IT helpdesk representative only received a secondhand account of the problem from the user during an interview and did not personally witness the malicious code executing on the system.
The CEO made a prosecution decision based on recommendations from the forensic consultant and legal department, giving the CEO no firsthand knowledge of the malicious behavior.
The user of the infected system is the only party who personally witnessed the strange behavior as it occurred on her own computer, qualifying her testimony as direct evidence with no inferential gap. Direct evidence proves a fact without requiring the jury to draw inferences - the user observed the malicious behavior herself and reported it. Every other party in the scenario learned of the events secondhand or interacted only with physical artifacts after the fact.
The system administrator interacted with the hard drive after the reported incidents occurred and did not personally observe the malicious code operating on the live system.
Concept tested: Direct vs. circumstantial evidence in digital forensics court proceedings
Topics
Community Discussion
No community discussion yet for this question.