7.5 Direct versus Circumstantial Evidence

Direct evidence establishes a fact. Circumstantial evidence may suggest one. It is a common misconception that digital evidence cannot be direct evidence because of its separation from the events it represents as discussed in Chapter 1. However, digital evidence can be used to prove facts. For example, if the reliability of a computer system is at issue, showing the proper functioning of that specific system is direct evidence of its reliability, whereas showing the proper functioning of an identical system is circumstantial.

Although digital evidence is generally only suggestive of human activities, circumstantial evidence may be as weighty as direct evidence and digital evidence can be used to firmly establish facts. For example, a computer logon record is direct evidence that a given account was used to log into a system at a given time but is circumstantial evidence that the individual who owns the account was responsible. Someone else may have used the individual's account and other evidence would be required to prove that he actually logged into the system. It may be sufficient to demonstrate that nobody else had access to the individual's computer or password. Alternately, other sources of digital evidence such as building security logs may indicate that the account owner was the only person in the vicinity of the computer at the time of the logon.

Consider intellectual property theft as another example. Even if nobody saw the defendant take the proprietary data, it may be sufficient to show that the data in his possession are the same as the proprietary data and that he had the opportunity for access. So, there is nothing inherently wrong with circumstantial evidence. Given enough circumstantial evidence, the court may not require direct evidence to convict an individual of a crime.