At a retailer, a cashier was unhappy, and a register later had malware, but nothing ties that person to the file. What evidence class is the note about the unhappy cashier?
Select an answer to reveal the explanation.
Short Explanation
A grumpy note on the break-room board is not a fingerprint on the tool. You can treat the cashier note as indirect at best, and it does not show who planted the file. The trap is upgrading a mood into authorship, a hash match, or a confession.
Full Explanation
Indirect evidence suggests a possibility and does not show the fact being asked. The cashier was unhappy, and a register later had malware, and nothing ties that person to the file. The note's class is Indirect at best: the note shows friction and does not show who planted the file. Talk of motive without a link to the file cannot identify who planted it. Best evidence that the unhappy cashier personally authored the malware on the register would require the original record of authorship, and a mood note is not that record. Corroboration of the malware hash, tying the cashier's mood directly to that file would require a second source that agrees the cashier handled that file, and the scenario says no such tie exists. A confession by the cashier, as if the mood note itself were that admission treats dissatisfaction as an admission the note never makes. Exam caveat: indirect evidence can guide where to look next, and it is not proof of who performed the act. Operational check: keep the note as context, and look for a host log, an account, or a file event that actually links a person to the malware before you name the cashier.