Which Item Is NOT Considered Physical Evidence?
Which of the following is NOT a physical evidence?
Community Insight
The question tests whether you can distinguish tangible items you can bag and tag from logical data you can only copy — the trap is assuming anything residing ON a physical hard disk is itself physical evidence.
Physical evidence in computer forensics means tangible objects that can be seized, handled and preserved with a chain of custody. This page confirms that an image file stored on a hard disk is a logical/digital artifact — not physical evidence — which is why option C is the answer.
Many candidates pick Publications (D) because paper feels less 'forensic', when in fact printed publications are tangible seized objects; the truly intangible item is the image file on the disk.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Physical evidence is defined by tangibility: it can be seen, touched, seized, packaged and logged in a chain-of-custody form. An image file on a hard disk is a bit-for-bit logical copy of data — the file itself has no independent physical existence beyond the magnetic or flash media it sits on, and you preserve it by hashing and copying, not by bagging it. That makes the image file the one item in the list that is digital rather than physical evidence, so C is the correct pick. Note that the drive holding the image is physical, but the question asks about the image file, not the drive.Why the Other Options Are Wrong
Removable media (A) — USB drives, CDs, DVDs, external disks — are tangible objects that are routinely seized, photographed and sealed as physical evidence. Cables (B) are physical components that can carry fingerprints, DNA, tool marks or serial numbers and are therefore physical evidence. Publications (D) such as printed manuals, notebooks or printed documents are tangible paper items that can be collected and marked as exhibits. Only option C describes data with no independent physical form, which is exactly what the question excludes.Community Comment Notes
Most learners land on the same reasoning: as aqeel1506 puts it, "An image file on a hard disk is a digital artifact rather than physical evidence," while removable media, cables and printed items are tangible. Elb reinforces the same test with the shortest possible explanation — "USB, Cables and disk are tangible items." One dissenting voice, 91a7fba, argues "I think that correct answer is D. Publications," but that view confuses the evidential value of a document with its physical nature: paper is still a tangible object that can be seized and labelled. The consensus explanation is the one that matches the tangibility standard used by forensic examiners.Exam Strategy
When you see 'NOT physical evidence', run every option through one filter: can I pick it up, bag it and write it on a chain-of-custody form? Files, images, log streams and memory captures fail that test and are the answer; media, cables and paper pass it. Also watch for the drive-versus-data distinction — the container is physical, its contents usually are not.
Frequently Asked Questions
Why is an image file on a hard disk not physical evidence while the hard disk is?
The disk is a tangible object you can seize and bag; the image file is logical data you preserve by hashing and copying. The question asks about the file itself, not the media.
Why is Publications (D) not the excluded answer?
Printed publications are tangible paper items that can be collected, labelled and entered into a chain of custody, so they count as physical evidence.