Digital evidence
= Digital evidence
\b[Digital evidence] is information represented in digital form that is used to support or test a claim about an event. A <file>, system log or recorded <computer network> activity can supply such information. An artifact becomes evidence through its relation to a question and the explanation of how it was obtained and interpreted; being stored on a computer does not make its contents true.<Guide to Integrating Forensic Techniques into Incident Response by Karen Kent and others>[Section2.1 and section3, data sources, collection, examination and analysis]{ref}
<Digital forensics> separates collection from analysis. <Chain of custody> documents handling, and <cryptographic hash functions> help check continuity of acquired data. Those checks support the reliability of a particular artifact; they do not by themselves establish its author or the cause of the recorded event.<Guide to Integrating Forensic Techniques into Incident Response by Karen Kent and others>[Section3.1.2, acquisition and integrity; section3.3, analysis]{ref}
An original mathematical distinction is useful. For a fixed deterministic <hash function> $h$, if byte sequences $x$ and $y$ satisfy
$$
h(x)\ne h(y),
$$
then $x\ne y$. Identical inputs must produce identical outputs. The converse fails: $h(x)=h(y)$ does not logically prove $x=y$, since a fixed-length digest can have collisions. A well-chosen <cryptographic hash function> makes finding such collisions computationally difficult under its stated security assumptions.
Even exact byte equality is narrower than factual truth. Two identical copies of a log preserve the same recorded assertion, including any inaccurate clock value or fabricated entry already present. Interpretation must connect the artifact to independent context and identify uncertainty.