3.4Types of evidence

Even for the same incident, the logs and artifacts at hand are not uniform in "what, and how far, they prove." An original disk image or a full recording of the actual communication carries strong probative force; a log from a different system corroborates it; and the mere presence of some tool may only let you infer "it might have been used." This section organizes evidence into best, corroborative, and indirect (circumstantial) evidence so that, looking at a given log, you can instantly judge its class of probative strength. Mistaking the grade of evidence leads to over- or under-estimating your conclusions.

3.4.1Three types of evidence

• Best evidence is primary evidence that proves a fact most directly and reliably—the unaltered original itself: a forensic image of a disk, a full packet capture recording the actual event in its entirety, an original system log, and so on. With integrity (hashes) and an intact chain of custody, it becomes the core of fact-finding.
• Corroborative evidence is not decisive on its own but supports/reinforces other evidence. It is the form in which a different system's log (e.g., firewall log, authentication-server log, NetFlow) independently backs up the fact shown by best evidence. The more corroboration converges, the higher the confidence in the conclusion.
• Indirect (circumstantial) evidence does not show a fact directly but lets one infer it from circumstances. For instance, "an attack tool existed on the host" does not directly record the moment of the attack, but combined with other facts it lets one infer involvement. Weak alone, it gains value through accumulation and consistency.

3.4.2Mapping logs to types

• The order of judgment is: (1) is this log a primary record of the fact itself (a best-evidence candidate)? -> (2) is it positioned to back up other primary evidence (corroborative)? -> (3) does it merely let one infer a fact it does not directly show (indirect)? Note that even the same NetFlow is near best evidence as the primary record of one fact, yet works as corroborative when it supports a different best evidence—the type is set by role (its relation to the fact to be proved).
• In practice the standard approach is to anchor on best evidence, raise confidence with corroborative evidence, and accumulate indirect evidence to check consistency. Lacking integrity (no hash/chain) downgrades the class of what should be best evidence—hence it is handled together with the chain of custody from s3.

You are investigating a suspicion that "confidential data was exfiltrated from an internal endpoint," and you hold three materials. (1) A forensic disk image taken from that endpoint (with hashes and an intact chain of custody) retains traces of the file being copied to an external-storage directory, plus the actual data. (2) The boundary firewall log/NetFlow records, at the same time, a large upload flow from that endpoint to the outside. (3) The fact that a transfer tool usable for exfiltration was installed on the endpoint. Treating these with equal weight is wrong. (1) is the primary record that most directly proves the fact (data was copied and taken out)—best evidence; with integrity and chain intact it is the core of fact-finding. (2) is corroborative evidence that independently backs up the exfiltration shown by (1) from a different system—alone it can only say "there was heavy traffic," but if it matches (1) in time and data volume it greatly raises confidence. (3) is merely indirect (circumstantial) evidence—the tool's presence only lets one infer "exfiltration was possible / that method may have been used," not the actual moment of exfiltration. So the sound construction is to anchor on (1), corroborate with (2), and add (3) as circumstance. Conversely, concluding "the tool is here, so this is the culprit" from (3) alone is the classic error of over-valuing indirect evidence as if it were best evidence. And if image (1) lacked a hash or chain of custody, the class of what should be best evidence drops, and the other side can attack it as "possibly tampered"—which is why the type of evidence is inseparable from guaranteeing integrity at acquisition. Distinguishing by role whether a log directly proves, corroborates, or only lets one infer a fact is the key to fact-finding that is neither overstated nor understated.

3.4.3Section summary

• Best evidence is the primary original that proves a fact most directly (forensic image/full packet capture/original log), premised on integrity and an intact chain of custody
• Corroborative evidence backs up best evidence with a different-system record; indirect (circumstantial) evidence lets one infer without showing directly (never conclude alone)
• The type is set by the "role" relative to the fact to be proved—anchor on best evidence, raise confidence with corroboration, and handle indirect evidence via accumulation and consistency