Best Evidence is the best available evidence that can be produced in court to prove the content of a writing, recording, or photograph. Under the U.S. Federal Rules of Evidence (FRE), the original is generally required to prove content, although exceptions exist.

Key points:
- The goal is to present the most accurate and reliable version of the information.
- If the original cannot be produced (e.g., it is destroyed, too large, or impossible to bring into court), a duplicate or faithful reproduction may be admitted.
- For Digital Evidence, the FRE treats a printout or other readable output that accurately reflects the data as an original.

A classic analogy involves a helicopter and tractor trailer colliding on a bridge. The wreckage cannot be brought into the courtroom, so photographs of the scene become the best evidence available.

In network forensics, a bit-for-bit snapshot of a network transaction or a full packet capture is the best evidence. Unlike a still photograph, network forensics can often reconstruct a forensically identical copy of the original transaction.

Examples:
- A photo of a crime scene
- A copy of a signed contract
- A file recovered from a hard drive
- A bit-for-bit snapshot of a network transaction

Source: Network Forensics: Tracking Hackers through Cyberspace, §1.3.2.