Which of the following is a typical digital evidence artifact encountered in investigations?

• A. Physical CCTV footage
• B. Software license agreements
• C. Email communications with attachments and headers
• D. User training records

Answer: (C)

Digital investigations rely on artifacts that exist in electronic form, and email communications with attachments and headers are a quintessential example. The actual message content shows what was said or exchanged, while attachments can hold documents, images, or malware that shed light on the activity or intent. The headers are especially valuable because they reveal who sent the message, who received it, when it was sent, and the path it traveled through mail servers. This routing and timing information helps establish a timeline, identify involved parties, verify authenticity, and sometimes detect spoofing or tampering. Because these elements are routinely stored on servers, devices, and backups, they are among the most accessible and informative digital traces investigators rely on.

Other options don’t provide the same direct digital evidence about communications or events. Physical CCTV footage, while it can be relevant, is described as physical rather than a digital artifact, and its evidentiary value depends on how it’s stored and accessed. Software license agreements are contractual documents, not records of the actual events or communications in question. User training records are internal administrative documents and less likely to reveal actionable investigative details.