CHFI Computer Forensics Fundamentals and Process Practice Question
Which type of evidence is based on information that is not directly from an eyewitness but is reported by someone else?
⚠ Common exam trap
EC-Council often tests the distinction between hearsay and circumstantial evidence, where candidates mistakenly choose circumstantial because they think any indirect information is circumstantial, but the key differentiator is that hearsay specifically involves a secondhand statement, not an inference from physical evidence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hearsay evidence
Hearsay evidence is defined as a statement made outside of court that is presented to prove the truth of the matter asserted. In digital forensics, this applies when a witness testifies about what another person said regarding an event, rather than recounting their own direct observation. The CHFI exam categorizes this under evidence types because it is not based on the witness's firsthand knowledge, making it generally inadmissible unless an exception applies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Direct evidence
Why it's wrong here
Direct evidence is firsthand proof—such as an eyewitness testifying to what they personally saw or heard—that, if believed, resolves a fact without needing any inference. It is inapplicable here because the evidence in question relies on a declarant's out-of-court statement rather than on the witness's own sensory experience. Thus, direct evidence does not match the described category.
- ✗
Circumstantial evidence
Why it's wrong here
Circumstantial evidence consists of facts observed firsthand from which a factfinder may infer the existence of another fact, for example fingerprint matching to prove presence. While indirect in its logical pathway, the underlying information is still directly perceived by the witness or derived from a tangible object, not from a secondhand statement. Therefore, it is not the correct type of evidence for information that is not directly known to the speaker.
- ✗
Best evidence
Why it's wrong here
The best evidence rule requires a party to produce the original writing, recording, or photograph when proving its content, rather than a copy or oral testimony. This evidentiary principle addresses the reliability of documentary proof, not the admissibility of out-of-court statements. Because the question concerns a statement made outside court, not the content of a document, the best evidence rule is irrelevant and does not define the evidence type.
- ✓
Hearsay evidence
Why this is correct
Hearsay is an out-of-court statement offered to prove the truth of the matter asserted, meaning the trier of fact must rely on the declarant's credibility without having observed the declarant's demeanor. This matches evidence 'based on information that is not directly known' because the witness repeating the statement lacks personal knowledge of the underlying fact. Under the Federal Rules of Evidence, such statements are generally inadmissible unless an exception or exclusion applies.
Go deeper
Related to this question
Learn chapter
Evidence Handling and Chain of Custody
Key term
RAM Analysis
RAM Analysis is the forensic examination of a computer’s volatile memory to uncover evidence of running processes, network connections, malware, and user activity that is lost when the system is powered off.
Key term
Process Memory Dump
A process memory dump is a snapshot of all the data a specific running program has stored in RAM at a single moment, used for analyzing its behavior and contents.
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.