 Digital evidence

Digital evidence is information represented in digital form that is used to support or test a claim about an event. A file, system log or recorded computer network activity can supply such information. An artifact becomes evidence through its relation to a question and the explanation of how it was obtained and interpreted; being stored on a computer does not make its contents true.^[ref]

Digital forensics separates collection from analysis. Chain of custody documents handling, and cryptographic hash functions help check continuity of acquired data. Those checks support the reliability of a particular artifact; they do not by themselves establish its author or the cause of the recorded event.^[ref]

An original mathematical distinction is useful. For a fixed deterministic hash function $h$, if byte sequences $x$ and $y$ satisfythen $x\ne y$. Identical inputs must produce identical outputs. The converse fails: $h(x)=h(y)$ does not logically prove $x=y$, since a fixed-length digest can have collisions. A well-chosen cryptographic hash function makes finding such collisions computationally difficult under its stated security assumptions.

Even exact byte equality is narrower than factual truth. Two identical copies of a log preserve the same recorded assertion, including any inaccurate clock value or fabricated entry already present. Interpretation must connect the artifact to independent context and identify uncertainty.