Digital forensics

For this one. options are circumstantial or direct.

circumstantial or direct evidence: a. At around the time of the victim's death, a witness sees John enter the victim's house holding a gun, and then hears shots fired inside. Is this direct or circumstantial evidence that John killed the victim? b. Ballistics analysis indicates a match between the bullets fired at the scene of the crime and John's gun. Is this direct or circumstantial evidence that John killed the victim? c. The victim's roommate reports that she saw John shoot the victim. Is this direct or circumstantial evidence that John killed the victim? Finding a running computer, an officer at the scene of a crime conducts a live analysis in which he opens a web browsing session to view the browsing history and opens various other files to view their contents. He documents his findings in his official report, turns off the computer, and brings it to the lab for further analysis. The live analysis evidence will not be admissible to court because: The evidence is circumstantial. The chain of custody has been broken. The live analysis was not forensically sound. The analyst who will be writing the final forensics report was not present for the live analysis. Which one or more of the following best describe a scientific hypothesis about evidence? Explains as many facts as possible Simple Accurate Consistent Falsifiable An officer investigating a crime scene finds a powered-off laptop. She follows standard operating procedures, documenting the physical location and condition of the device, and recording the names and actions of fingerprint analysts who dust the device for fingerprints. She then confiscates the device, adding her own name to the documentation, before bringing it to the digital forensics analysts. The forensic analyst conducts a forensically sound analysis of the device and writes a final report, including his name as the final person to handle the device. This evidence: Will not be admissible because the analysis was not forensically sound. Will not be admissible because the chain of custody was broken. Will be admissible in court. Will not be admissible because it is circumstantial. Will not be admissible because it could have been tampered with before the police confiscated the devices