Digital evidence
-
can be duplicated exactly
-
its copy can be examined just like the original
-
data integrity can be easily verified once properly collected
-
it is hard to destroy digital evidence:
-
for example, when file is deleted, the data remains on a disk. Therefore, digital evidence can be successfully recovered using multiple tools and techniques.
-
-
Even if offender destroys one copy, another may remain intact (e.g. a backup tape.)