CHFI Computer Forensics Fundamentals and Process Practice Question
Which TWO of the following are considered forms of evidence under the rules of evidence? (Select two.)
⚠ Common exam trap
EC-Council often tests the distinction between admissibility and form of evidence, leading candidates to mistakenly select 'illegally obtained evidence' as a valid form because they confuse the concept of 'evidence' with 'admissible evidence'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Circumstantial evidence
Circumstantial evidence is a recognized form of evidence under the rules of evidence because it allows a fact-finder to infer a fact from other established facts, even without direct witness testimony. In digital forensics, this is critical when reconstructing user activity from log files, file metadata, or network traffic patterns that indirectly prove an action occurred.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Illegally obtained evidence
Why it's wrong here
Illegally obtained evidence may be excluded.
- ✗
Hearsay evidence
Why it's wrong here
Hearsay is generally inadmissible unless an exception applies.
- ✓
Circumstantial evidence
Why this is correct
Circumstantial evidence requires inference but is still valid.
- ✗
Opinion evidence
Why it's wrong here
Opinion evidence is generally limited to expert witnesses.
- ✓
Direct evidence
Why this is correct
Direct evidence directly proves a fact without inference.
Go deeper
Related to this question
Learn chapter
Overview of Computer Forensics and Investigation Process
Key term
Evidence Admissibility
Evidence admissibility is the legal and technical standard that determines whether digital evidence can be used in a court of law.
Key term
FTK Imager
FTK Imager is a free forensic imaging tool used to create exact copies of computer drives and storage devices for digital evidence analysis.
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.