CHFI Computer Forensics Fundamentals and Process Practice Question
A security analyst notices that a log file on a Linux server shows repeated failed SSH login attempts from an external IP address, but no successful login from that IP. However, the /var/log/auth.log file has been recently truncated. Which type of evidence is the truncated log file?
⚠ Common exam trap
The trap is to confuse the physical existence of an artifact with direct evidence. Direct evidence must prove the ultimate fact without relying on inference. A truncated file's condition only suggests tampering through reasoning, making it circumstantial.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Circumstantial evidence
The truncated log file is circumstantial evidence. While the truncation itself is a directly observable fact, the conclusion that someone intentionally altered or destroyed the log to conceal failed SSH attempts requires inference. Other explanations (e.g., log rotation, system error) are possible. Direct evidence proves a fact without inference, such as an eyewitness testimony or a video recording of the tampering. Therefore, the truncated log file is circumstantial evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hearsay evidence
Why it's wrong here
Hearsay is an out-of-court statement offered to prove the truth of the matter asserted, typically made by a declarant. A log file is an electronically generated record, not a human assertion, and is not hearsay when authenticated as a system record. The issue here is classifying the evidence's nature, not its admissibility under an exception.
- ✗
Best evidence
Why it's wrong here
The best evidence rule is a rule of preference requiring the original writing, recording, or photograph when proving its content, not a category of evidence. This truncated log file is the original digital artifact itself, so the rule is not in play. The question is whether the log is hearsay, direct, or circumstantial, not whether a copy or original must be produced.
- ✓
Circumstantial evidence
Why this is correct
Circumstantial evidence requires a logical inference to connect the evidence to a fact in issue, such as inferring intent from behavior. The truncated log is not the basis for an inference; its tampered state is the very fact at issue and is observable directly. Because no intermediate deduction is needed to see that the file has been altered, it is not merely circumstantial.
- ✗
Direct evidence
Why it's wrong here
Direct evidence is evidence that, if accepted, proves a fact without drawing an inference from another fact. The truncated log file is a physical artifact whose altered state—shortened content, broken continuity, or modified metadata—can be directly viewed and compared to expected integrity. This makes it direct evidence of tampering, because the evidence itself is the result of the action rather than a clue pointing toward it.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.