Which Item Is NOT Considered Physical Evidence?
Short answer
C An image file on a hard disk is a logical/digital artifact, not tangible physical evidence, unlike removable media, cables or printed publications.
Question
Key Takeaways
The question tests whether you can distinguish tangible items you can bag and tag from logical data you can only copy — the trap is assuming anything residing ON a physical hard disk is itself physical evidence.
Physical evidence in computer forensics means tangible objects that can be seized, handled and preserved with a chain of custody. This page confirms that an image file stored on a hard disk is a logical/digital artifact — not physical evidence — which is why option C is the answer.
Common mistake: Many candidates pick Publications (D) because paper feels less 'forensic', when in fact printed publications are tangible seized objects; the truly intangible item is the image file on the disk.
Expert Analysis
Why the Answer Is Correct
Physical evidence is defined by tangibility: it can be seen, touched, seized, packaged and logged in a chain-of-custody form. An image file on a hard disk is a bit-for-bit logical copy of data — the file itself has no independent physical existence beyond the magnetic or flash media it sits on, and you preserve it by hashing and copying, not by bagging it. That makes the image file the one item in the list that is digital rather than physical evidence, so C is the correct pick. Note that the drive holding the image is physical, but the question asks about the image file, not the drive.
Why the Other Options Are Wrong
Removable media (A) — USB drives, CDs, DVDs, external disks — are tangible objects that are routinely seized, photographed and sealed as physical evidence. Cables (B) are physical components that can carry fingerprints, DNA, tool marks or serial numbers and are therefore physical evidence. Publications (D) such as printed manuals, notebooks or printed documents are tangible paper items that can be collected and marked as exhibits. Only option C describes data with no independent physical form, which is exactly what the question excludes.
Community Comment Notes
Most learners land on the same reasoning: as aqeel1506 puts it, "An image file on a hard disk is a digital artifact rather than physical evidence," while removable media, cables and printed items are tangible. Elb reinforces the same test with the shortest possible explanation — "USB, Cables and disk are tangible items." One dissenting voice, 91a7fba, argues "I think that correct answer is D. Publications," but that view confuses the evidential value of a document with its physical nature: paper is still a tangible object that can be seized and labelled. The consensus explanation is the one that matches the tangibility standard used by forensic examiners.
Exam Strategy
When you see 'NOT physical evidence', run every option through one filter: can I pick it up, bag it and write it on a chain-of-custody form? Files, images, log streams and memory captures fail that test and are the answer; media, cables and paper pass it. Also watch for the drive-versus-data distinction — the container is physical, its contents usually are not.
Frequently Asked Questions
Why is an image file on a hard disk not physical evidence while the hard disk is?
Why is Publications (D) not the excluded answer?
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
aqeel1506 👍 1The item that is NOT considered physical evidence is: C. Image file on a hard disk An image file on a hard disk is a digital artifact rather than physical evidence. In contrast: A. Removable media (e.g., USB drives, CDs) is physical evidence. B. Cables are physical components that can be examined as evidence. D. Publications (e.g., printed documents) are physical items that can be considered physical evidence.
-
91a7fba 👍 1I think that correct answer is D. Publications.
-
Elb 👍 1USB, Cables and disk are tangible items.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.