12. Categories of evidence

• Evidence with attributes that

  • fits class characteristics

  • exhibits individual characteristics

• Class characteristics' example: an operating system file, such as

      "C:\Windows\System32\notepad.exe"
  

  belongs to the category of verified and trusted files on the system.

• Individual characteristics are more unique and can be linked to a specific person or activity with greater certainty:

  • shoe prints are left under a window at a crime scene;

  • the suspect is in possession of a pair with the same manufacturer and model...