Electronic Evidence and Digital Forensics Law

Introduction

Cybersecurity investigations increasingly depend on information that exists in electronic form: authentication logs, emails, instant messages, cloud audit trails, mobile devices, databases, photographs, browser histories, and metadata. Such information can establish what happened, when it happened, which account or device was involved, and whether a person or organisation took reasonable steps to prevent harm.

However, the existence of digital information does not automatically make it legally usable. A court, regulator, disciplinary panel, or internal decision-maker may ask whether the information is relevant, authentic, complete, reliable, lawfully obtained, and sufficiently well preserved. Digital evidence is also unusually fragile. It can be altered by opening a file, starting a computer, synchronising a cloud account, changing a system clock, or allowing a logging system to overwrite older records.

Digital forensics is therefore both a technical and legal discipline. The investigator must preserve original data, use repeatable methods, record decisions, protect privacy, and explain findings in a way that another competent person could review. This chapter presents a practical framework for assessing electronic evidence and documenting its forensic handling. Because legislation differs between jurisdictions, the discussion uses general legal principles and identifies areas where local law must be consulted.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Explain the meaning and importance of relevance, authenticity, integrity, admissibility, and evidential weight.
2. Classify common forms of electronic evidence, including logs, emails, devices, cloud records, and metadata.
3. Apply a defensible process for identification, preservation, acquisition, examination, analysis, and reporting.
4. Explain the role of hashes, timestamps, audit trails, write blockers, chain-of-custody records, and validated tools.
5. Recognise legal issues involving authority, privacy, search, seizure, disclosure, cross-border access, and expert testimony.
6. Evaluate the strengths and limitations of digital evidence in an applied investigation.

1. The Nature of Electronic Evidence

Electronic evidence is information of potential evidential value that is stored, processed, or transmitted in digital form. It may be stored on a physical device, held by a service provider, or generated automatically by an information system.

Examples include:

• operating-system event logs;
• firewall, VPN, DNS, proxy, and authentication records;
• emails, attachments, headers, and mailbox audit records;
• documents, spreadsheets, photographs, and videos;
• mobile-phone application data and location records;
• cloud storage objects, access logs, and identity-provider records;
• database records and transaction histories;
• browser history, cached data, cookies, and download records; and
• metadata such as creation time, modification time, author, geolocation, and device identifiers.

A useful distinction is between content and context. Content is the substantive information, such as the words in an email or the values in a database record. Context is information about the content, such as who created it, when it was created, how it was transmitted, and whether it was subsequently changed. In many investigations, context determines whether content can be trusted.

Digital evidence may be:

• Direct, appearing to establish a fact without substantial inference, such as a video showing an event.
• Circumstantial, supporting an inference, such as a login from an account shortly before a file was downloaded.
• Volatile, likely to disappear when power is removed or a system changes state, such as memory contents, running processes, and network connections.
• Persistent, retained on storage or in a provider’s records, such as a disk image or archived email.
• Original, meaning the source data or a legally recognised equivalent.
• Derived, meaning information produced through processing, such as a timeline, keyword index, or statistical summary.

A derived artefact is not automatically inferior. A forensic report may properly rely on a timeline generated from original records, provided the method is explained, the source data is preserved, and the result can be reproduced or checked.

2. The Five Core Evidential Questions

2.1 Relevance

Evidence is relevant when it has a logical connection to a fact that must be proved or disproved. Relevance is normally assessed against the issues in the investigation. A complete disk image may contain millions of files, but only a small proportion may relate to the alleged incident.

Relevance has two dimensions:

• Logical relevance: the information tends to make a proposition more or less probable.
• Legal relevance: the information concerns an issue that the decision-maker is legally permitted or required to consider.

Investigators should avoid collecting or reporting information merely because it is interesting. Excessive irrelevant collection increases privacy risk, storage cost, disclosure obligations, and the possibility of confusing the decision-maker.

2.2 Authenticity

Authenticity concerns whether the evidence is what the proponent claims it to be. For an email, the issue may be whether it came from the stated account, whether its headers are genuine, and whether it was altered. For a cloud log, authenticity may require evidence about the provider’s logging system, account controls, and export process.

Authenticity does not necessarily require proving that a particular person physically typed every character. An account may have been shared, compromised, delegated, or accessed through malware. A careful conclusion might therefore be that “the record shows successful authentication using account X” rather than “person Y definitely performed the action.”

Authentication may be supported by:

• testimony from a person with knowledge;
• system-generated records and explanations of how the system operates;
• reliable digital signatures or certificates;
• consistent metadata and timestamps;
• corroboration from independent sources; and
• evidence of secure access controls and ordinary business processes.

2.3 Integrity

Integrity concerns whether evidence remained complete and unaltered, or whether any alteration is known and controlled. Integrity has both a technical and procedural dimension. A hash can show that a file is identical to a previously hashed version, but it cannot prove that the file was truthful when first created or that the correct file was selected.

A cryptographic hash function maps data to a fixed-length digest. If even a small part of the input changes, the digest should change with overwhelming probability, subject to the security properties of the selected algorithm. For a data object D, its digest may be represented as:

Here, H is a specified cryptographic hash function, D is the exact byte sequence, and h is the resulting digest. The comparison is meaningful only if the same data, algorithm, and hashing procedure are used. Hashes support integrity verification; they do not establish relevance, authorship, intent, or legal authority to collect the data.

For high-value investigations, investigators commonly record hashes at acquisition and again when evidence is transferred, processed, or presented. Modern collision-resistant algorithms should be selected in accordance with organisational policy and current professional guidance. Older algorithms may remain useful for continuity or comparison, but should not be treated as the sole protection where stronger alternatives are available.

2.4 Admissibility

Admissibility is the legal decision about whether evidence may be received and considered by a particular court or decision-maker. Rules vary among criminal courts, civil courts, tribunals, employment processes, and regulatory proceedings. Common admissibility concerns include:

• relevance;
• authenticity;
• integrity and completeness;
• hearsay or equivalent restrictions;
• reliability of the generating system;
• legality of search, seizure, interception, or monitoring;
• compliance with statutory requirements for electronic records;
• unfair prejudice, privilege, confidentiality, or privacy; and
• proper disclosure to the opposing party.

A technically accurate item may still be excluded if it was obtained unlawfully or if required procedural safeguards were ignored. Conversely, a procedural defect does not always result in exclusion; its effect depends on the jurisdiction, the seriousness of the defect, and the rules governing the proceeding.

Electronic-transactions legislation in many jurisdictions gives legal recognition to electronic records, electronic signatures, and electronic communications, subject to conditions such as accessibility, reliability, and retention. Data-protection laws may regulate collection, purpose limitation, security, international transfer, and retention. Criminal procedure and evidence laws may impose additional requirements for warrants, production orders, interception, or expert evidence.

2.5 Evidential Weight

Admissibility is a threshold question. Evidential weight concerns how persuasive the evidence is after it has been admitted. Weight may depend on reliability, specificity, completeness, independence, corroboration, and the strength of competing explanations.

For example, a single firewall record may show that an IP address connected to a service. It may not identify a particular human because of network address translation, shared devices, public Wi-Fi, VPNs, or compromised credentials. A stronger conclusion may arise when the firewall record aligns with endpoint telemetry, badge access, email activity, and a cloud audit record.

Investigators should distinguish:

• Observation: what the record directly shows.
• Inference: what reasonably follows from the observation.
• Conclusion: the overall assessment, including uncertainty and alternatives.

This distinction prevents overstatement and helps the decision-maker assess weight independently.

3. A Framework for Common Evidence Sources

Logs

Logs should be interpreted as records generated by a particular system under particular configuration conditions. Important questions include:

1. What system generated the record?
2. Was logging enabled and protected from unauthorised modification?
3. What time zone and clock source were used?
4. Were clocks synchronised through a trusted time service?
5. Is the record complete, or are there gaps and rotation limits?
6. Can the record be correlated with an account, device, process, or network address?

A timestamp such as “10:15” is incomplete unless its time zone, date, precision, and clock source are known. Time normalisation should preserve the original timestamp and document any conversion to a common time standard such as UTC. A converted time should never replace the original without explanation.

Emails

Email evidence may include the message body, attachments, full headers, mailbox audit records, server logs, delivery records, and authentication results. The visible “From” field is not sufficient by itself to establish origin. Investigators should examine message identifiers, received headers, sender-authentication results, transport information, mailbox access records, and whether the mailbox was compromised or delegated.

The original message should be preserved in a format that retains headers and attachments. Printing an email may be useful for presentation but normally loses technical information. Investigators must also consider privileged communications, personal information, and legal restrictions on monitoring or interception.

Devices

A device investigation begins with preservation. If a device is powered on, volatile evidence may justify controlled live response; if it is powered off, starting it may alter data. The choice depends on the investigation, encryption status, risk of remote wiping, organisational policy, and legal authority.

A forensic image is a sector-level or logically defined copy acquired using a documented method. Write blockers may prevent the examiner’s workstation from writing to a storage device. The acquisition record should identify the device, examiner, date and time, tool and version, source and destination, errors, and verification hashes.

Cloud records

Cloud evidence is often distributed across customer systems, identity providers, software-as-a-service platforms, infrastructure providers, and backup services. The investigator should identify the relevant provider, tenant, account, region, retention policy, export format, and access authority.

Provider records may be highly valuable because they are generated independently of the suspect’s device. They are not automatically infallible. A cloud log may reflect an automated process, a compromised token, a service-account action, or a provider’s own time and retention limitations. The export certificate, provider explanation, API method, and integrity controls should be preserved.

Metadata

Metadata can include file-system timestamps, EXIF data in photographs, document author fields, message identifiers, geolocation, application history, and database audit fields. Metadata should be treated as evidence requiring interpretation, not as an unquestionable label. Copying a file, changing a time zone, editing a document, or passing through an application may change metadata.

4. The Forensic Process

A defensible investigation is planned and documented rather than improvised. A widely used lifecycle is identification, preservation, collection or acquisition, examination, analysis, reporting, and presentation. The stages may overlap, but each decision must be recorded.

Figure: A documented digital-forensic lifecycle. Authority and scope govern every later stage, while review and disclosure allow the work to be challenged and revisited.

Authority and scope

Before collection, identify the legal and organisational authority: consent, employment policy, contractual power, warrant, production order, regulatory power, incident-response authority, or another lawful basis. Define the purpose, systems, date range, custodians, search terms, and restrictions. Scope should be sufficiently precise to prevent unjustified collection while allowing reasonable investigation of the incident.

Identification and preservation

Identify likely evidence sources and issue preservation instructions before routine retention systems overwrite data. Preserve relevant cloud records, mailbox contents, endpoint images, logs, backups, and volatile information where justified. Record who identified each source, its location, condition, owner, time settings, and risk of alteration.

Acquisition and verification

Acquire data using competent personnel, validated tools, controlled procedures, and the least intrusive method consistent with the objective. Preserve originals or master copies and conduct analysis on verified working copies. Record errors rather than silently ignoring them. Verify the result through hashes, acquisition logs, or an independent comparison.

Examination and analysis

Examination extracts and organises artefacts; analysis interprets them in relation to the investigative question. Use repeatable methods, document tool versions and settings, preserve search terms and filters, and distinguish automated output from examiner judgment. Where feasible, use more than one source to corroborate important findings.

Reporting and presentation

A report should identify the instruction, scope, methodology, evidence examined, findings, limitations, and conclusions. It should state facts separately from opinions and avoid claiming more than the evidence supports. Relevant exhibits should be traceable to acquisition records and hash values. If an expert opinion is offered, the examiner should explain qualifications, assumptions, methodology, and the degree of uncertainty.

5. Chain of Custody and Documentation

Chain of custody is the chronological record of possession, handling, transfer, storage, and examination. It answers five practical questions:

1. What was collected?
2. When and where was it collected?
3. Who controlled it at each stage?
4. What was done to it?
5. How can the current item be connected to the original?

A chain-of-custody form normally records an evidence identifier, description, serial number or unique identifier, collection details, packaging, seal condition, storage location, transfers, purpose of access, and signatures or authenticated electronic approvals. Digital systems may use access logs and cryptographic verification, but the underlying accountability remains necessary.

Documentation should be contemporaneous. If a mistake occurs, the original entry should not be erased. The correction, reason, date, and person making it should be recorded. Good documentation is not bureaucratic decoration; it enables independent review and protects both the investigation and the person whose data was examined.

6. Legal and Governance Issues

Lawful access and search

Access to a device or account must have a lawful basis. Ownership of hardware does not always grant unlimited authority to inspect personal communications. Organisations should distinguish corporate data from personal data, define monitoring policies, and obtain appropriate authorisation before collection.

Search authority should be interpreted according to its scope. A warrant or consent limited to certain systems, offences, people, or periods should not be treated as a general licence to inspect everything. If unexpected evidence appears, investigators should seek legal guidance before expanding the search.

Privacy and data protection

Forensic collection frequently exposes health information, family communications, financial records, passwords, and unrelated personal material. Core privacy principles commonly include purpose limitation, data minimisation, proportionality, security, transparency, retention limitation, and accountability. Access should be restricted to personnel who need it, and irrelevant information should be segregated, masked, or deleted when legally permitted.

Privilege and confidentiality

Legal advice, protected professional communications, trade secrets, and regulated personal data may require special handling. A legal adviser or designated review team may need to screen material before investigators see it. Privileged material should not be casually copied into general case folders.

Cross-border and cloud investigations

Cloud data may be stored in another country even when the customer and investigator are local. Accessing it may implicate data-transfer rules, mutual legal assistance procedures, provider terms, sovereignty concerns, or restrictions on interception. Investigators should obtain specialist legal advice and preserve provider responses, requests, and timestamps.

Disclosure and fairness

In adversarial proceedings, relevant material may need to be disclosed even if it weakens the presenting party’s case. Investigators should preserve exculpatory, contradictory, and inconclusive information. Search methodology, rejected hypotheses, failed acquisitions, and limitations may be material to fairness.

7. Professional Roles and Expert Evidence

A forensic examiner should be competent in the relevant technology, evidence handling, tool limitations, and applicable legal requirements. Technical skill alone is insufficient. The examiner must remain impartial, avoid advocacy, and disclose limitations.

An expert’s evidence should be based on sufficient data and reliable methods. The examiner should be able to explain:

• qualifications and experience;
• the question being answered;
• the data and assumptions used;
• the method and validation performed;
• alternative explanations considered;
• error sources and limitations; and
• the difference between fact and opinion.

Peer review is especially important where findings depend on complex parsing, malware attribution, recovered fragments, or probabilistic interpretation. A second examiner should be able to reproduce the material steps without relying solely on the first examiner’s conclusion.

8. Applied Case: The Northbridge Payroll Investigation

This is a fictional illustrative case designed to demonstrate procedure, not to describe a real organisation.

Background

Northbridge Services discovered that a payroll spreadsheet containing employee bank details had appeared on an external file-sharing site. The organisation suspected that an administrator’s cloud account had been compromised. It had identity-provider logs, endpoint telemetry, email records, and cloud-storage audit logs.

Problem

The organisation needed to determine whether the spreadsheet was uploaded by the administrator, by an attacker using the administrator’s account, or by an unrelated process. It also needed to preserve evidence for possible regulatory notification and disciplinary proceedings.

Analysis

The response team first documented authority, scope, and the relevant date range. It preserved the cloud audit records and requested provider retention of related access events. The administrator’s laptop was isolated from the network without opening user files. A forensic image was acquired using a documented process, and the source and image were verified with cryptographic hashes.

The cloud records showed a successful login from an unfamiliar geographic region, followed by creation of an access token and upload of the spreadsheet. The endpoint showed no corresponding local file-opening activity during that period. Identity-provider records showed that multifactor authentication had been completed through a token previously registered to the administrator’s browser. A separate email indicated that the administrator had clicked a convincing “document-sharing” link shortly before the suspicious login.

The investigators preserved original timestamps and converted them to UTC for comparison. They documented that the geographic estimate was based on an IP address and therefore did not identify a precise physical location. They also considered the alternative hypothesis that the administrator had intentionally uploaded the file.

Approach and solution

The report separated observations from conclusions. It stated that the cloud account performed the upload, but that the evidence did not prove the administrator personally performed it. The combined evidence supported the conclusion that the account or its session token had likely been compromised. The organisation reset credentials, revoked tokens, enabled stronger authentication controls, notified affected stakeholders as required by applicable law, and reviewed its cloud-sharing policy.

Outcome

The evidence was sufficiently preserved for legal review. The organisation avoided the unsupported claim that the administrator was the perpetrator. The incident led to improved token management, conditional access controls, cloud audit retention, and staff training.

Learning points

1. Account activity is not automatically proof of human identity.
2. Independent sources increase evidential weight.
3. Time zones and clock assumptions must be documented.
4. Alternative explanations should be tested, not ignored.
5. A careful report can support accountability while avoiding unjustified accusations.

9. Challenges, Limitations, and Contemporary Developments

Encryption, secure deletion, ephemeral messaging, containerisation, and remote wiping can limit recovery. Attackers may manipulate logs, use legitimate administrative tools, steal tokens, or exploit gaps in retention. Artificial intelligence can assist with document classification, anomaly detection, translation, and prioritisation, but automated output requires validation. An AI-generated classification is not self-authenticating evidence; investigators must preserve the input, model or service information where possible, decision rules, confidence limitations, and human review.

Attribution remains difficult. IP addresses, usernames, device identifiers, and biometric events may narrow possibilities but rarely prove a person’s intent without corroboration. Deepfakes and synthetic media increase the need for provenance, source verification, cryptographic signing, and examination of encoding and editing history. At the same time, privacy-enhancing technologies and end-to-end encryption protect legitimate users and should not be treated as evidence of wrongdoing.

Organisations should periodically review logging architecture, retention, access controls, time synchronisation, incident-response agreements, provider contracts, and legal hold procedures. Evidence readiness is a governance capability developed before an incident, not improvised after one.

Best-Practice Checklist

Before concluding an investigation, confirm that:

• legal authority and scope were documented;
• preservation occurred before avoidable alteration or deletion;
• volatile evidence decisions were justified;
• originals or master copies were protected;
• forensic working copies were verified;
• hashes, tools, versions, settings, and errors were recorded;
• timestamps and time zones were explained;
• chain of custody was complete;
• privacy, privilege, and irrelevant data were controlled;
• findings were corroborated where possible;
• alternative explanations were considered;
• limitations and uncertainty were stated; and
• another competent examiner could understand and repeat the material steps.

Chapter Summary

Electronic evidence is information stored or transmitted digitally and may include logs, emails, devices, cloud records, network data, and metadata. Its value depends on more than technical availability. Relevance connects the evidence to an issue; authenticity addresses whether it is what it claims to be; integrity concerns completeness and protection from alteration; admissibility is determined by the applicable legal rules; and evidential weight concerns how persuasive the admitted evidence is.

A defensible forensic process begins with authority and scope, followed by identification, preservation, acquisition, verification, examination, analysis, reporting, and review. Hashes support integrity verification but do not prove truth, authorship, or lawful collection. Chain-of-custody records, validated tools, accurate time interpretation, write protection, independent corroboration, and transparent reporting make evidence more reliable and reviewable.

Legal and governance responsibilities include lawful access, privacy, proportionality, privilege, cross-border cloud access, disclosure, and impartial expert practice. Contemporary technologies such as encryption, cloud services, artificial intelligence, tokens, and synthetic media create new opportunities and limitations. The central professional principle is to make conclusions no stronger than the evidence and method justify.

Key Terms

Electronic evidence: Information stored, processed, or transmitted in digital form that may have evidential value.

Digital forensics: The disciplined identification, preservation, acquisition, examination, analysis, and reporting of digital evidence.

Relevance: The logical and legal connection between evidence and an issue to be decided.

Authenticity: The quality of being what the evidence is claimed to be.

Integrity: The condition of being complete and unaltered, or having alterations controlled and documented.

Admissibility: The legal determination that evidence may be received and considered.

Evidential weight: The persuasive strength assigned to evidence after consideration.

Metadata: Data describing or providing context about other data.

Volatile evidence: Digital information likely to disappear or change when a system state changes.

Forensic image: A documented copy of digital storage or data acquired for examination.

Hash: A fixed-length digest generated from data by a cryptographic hash function.

Write blocker: A hardware or software control designed to prevent unintended writing to a source device.

Chain of custody: The chronological record of evidence possession, handling, transfer, and storage.

Acquisition: The controlled process of obtaining a forensic copy or export of data.

Artifact: A digital trace produced by a system, application, or user activity.

Time normalisation: Converting timestamps to a common reference while preserving original time information.

Legal hold: A preservation instruction that suspends ordinary deletion or retention processes.

Privilege: Legal protection applying to specified confidential communications or materials.

Corroboration: Independent evidence that supports a finding or account.

Evidential limitation: A condition that reduces certainty, reliability, completeness, or interpretive scope.

Review Questions

Short Answer Questions

1. What is the difference between authenticity and integrity?
2. Why is a visible email “From” field insufficient by itself to prove authorship?
3. What information should a chain-of-custody record contain?
4. Why must original timestamps and time-zone information be preserved?
5. What does a cryptographic hash verify, and what does it not verify?

Long Answer Questions

1. Explain the relationship among relevance, authenticity, integrity, admissibility, and evidential weight.
2. Describe a complete forensic workflow from authority and scope through reporting and presentation.
3. Compare the evidential strengths and limitations of endpoint data, cloud audit records, and network logs.
4. Discuss privacy, privilege, proportionality, and cross-border issues in a cloud investigation.
5. Explain how an expert witness should present forensic findings and limitations.

Analytical / Application Questions

1. An employee account uploads a confidential file from a foreign IP address, but the employee says the account was compromised. What additional evidence would you seek, and how would you distinguish account activity from proof of personal action?
2. A forensic examiner discovers that a workstation was switched on before imaging and that the acquisition report contains no hash value. Assess the effect on integrity, admissibility, and evidential weight, and recommend remedial steps.
3. A cloud provider supplies an audit export showing that a file was deleted. Design a defensible process for authenticating, preserving, interpreting, and reporting that record while considering time zones, provider limitations, privacy, and alternative explanations.

Multiple Choice Questions with Answers

Question 1

Which question is primarily concerned with whether digital evidence is what it is claimed to be?

A. Relevance

B. Authenticity

C. Retention

D. Privilege

Correct Answer: B. Authenticity

Question 2

What does a cryptographic hash comparison most directly support?

A. Proof of a person’s intent

B. Proof that an account was not compromised

C. Verification that data matches a previously hashed version

D. Proof that a file is legally admissible

Correct Answer: C. Verification that data matches a previously hashed version

Question 3

Which statement about an account login is most accurate?

A. It always proves the named person performed the action.

B. It proves the device was physically located at the IP address.

C. It shows that authentication activity occurred, subject to system and account limitations.

D. It proves that the account owner intended the resulting activity.

Correct Answer: C. It shows that authentication activity occurred, subject to system and account limitations.

Question 4

Why should investigators preserve original timestamps when converting times to UTC?

A. To remove all uncertainty from the evidence

B. To permit later checking of the conversion and original system context

C. To make every system use the same clock

D. To guarantee that the timestamp was accurate

Correct Answer: B. To permit later checking of the conversion and original system context

Question 5

Which practice best protects a storage device during forensic acquisition?

A. Opening files directly on the original device

B. Allowing the operating system to update the device

C. Using a write blocker where appropriate and examining a verified copy

D. Changing the device clock before acquisition

Correct Answer: C. Using a write blocker where appropriate and examining a verified copy

Question 6

What is the main purpose of chain-of-custody documentation?

A. To increase the storage capacity of evidence

B. To record possession, handling, transfers, and storage over time

C. To encrypt every file automatically

D. To identify the perpetrator without corroboration

Correct Answer: B. To record possession, handling, transfers, and storage over time

Question 7

Which statement best describes admissibility?

A. It is the technical size of a file.

B. It is the legal decision about whether evidence may be received and considered.

C. It is the certainty that a conclusion is correct.

D. It is the process of converting local time to UTC.

Correct Answer: B. It is the legal decision about whether evidence may be received and considered.

Question 8

Why may a cloud audit record require careful interpretation?

A. Cloud records can never be used as evidence.

B. The record may reflect automated processes, compromised tokens, provider limitations, or retention gaps.

C. Cloud systems do not generate timestamps.

D. Cloud evidence is always more reliable than endpoint evidence.

Correct Answer: B. The record may reflect automated processes, compromised tokens, provider limitations, or retention gaps.

Question 9

Which reporting practice is most defensible?

A. State that an account owner definitely acted whenever the account was used.

B. Report observations, inferences, conclusions, and limitations separately.

C. Omit contradictory evidence to keep the report concise.

D. Replace original records with printed summaries.

Correct Answer: B. Report observations, inferences, conclusions, and limitations separately.

Question 10

What is the principal risk of using AI-generated forensic classifications without human review?

A. AI outputs cannot be stored digitally.

B. The classification may be inaccurate, non-transparent, or unsupported by preserved methodology.

C. AI always destroys the original evidence.

D. AI prevents investigators from documenting timestamps.

Correct Answer: B. The classification may be inaccurate, non-transparent, or unsupported by preserved methodology.