Direct evidence is testimony from a direct witness who personally observed the act or event in question. It is based on firsthand human perception rather than inference from other facts.

Key characteristics:
- It comes from someone who saw, heard, or otherwise directly perceived the event.
- It is usually admissible if it is relevant.
- Its main weakness is human reliability — memory, perception, and bias can be challenged.

In digital forensics, direct evidence is less common than in physical crimes because attackers usually act remotely and leave no human witness. However, it can still occur when an insider, coworker, or other observer sees the activity.

Examples:
- "I saw him stab that guy."
- "She showed me an inappropriate video."
- "I watched him crack passwords using John the Ripper and a password file he shouldn't have."
- "I saw him with that USB device."

Direct evidence contrasts with Circumstantial Evidence, which requires inference from other facts.

Source: Network Forensics: Tracking Hackers through Cyberspace, §1.3.3.