What happens to evidence if it is damaged, partially lost or changed in the process of acquisition or analysis?
There is is little of anything in the physical universe that is perfectly preserved. Most acquisitions start with the real possibility that there was relevant evidence on the system being subject to the recovery process that was there at some time in the past, but that is not there now and can’t be recovered. Some documents may still have remnants existing and may be partially recoverable, but with significant elements of information no longer available. Any number of problems may exist and examiners may even make decisions that lead to mistakes in an acquisition. The art of live acquisition (collecting the data from RAM) is particularly vulnerable as active processes may be changing/updating data even as it is being collected. The courts have long understood that evidence is seldom pristine and perfect and have rules that allow even damaged evidence to come in, and the court (the judge) will typically give an instruction to the jury about their duty to determine how much weight to giv
