Well there are basic things like the timestamp (but could be manipulated at a file system level if you know how), metadata, signatures (source os / current os), CRC values, fingerprints, and a few more on the digital side, and other stuffs on the logical (RAM / buffers / cells / etc)
An example, normally, first thing that the police does when they size a media, is to connect it tru a write-blocker device, even before imaging/cloning it, reason for is that if you simply plug up a hard drive taken from another system, it will do some stuffs between the BIOS and the OS and write some data (nothing that the user sees, hardware and software level stuffs), and the first thing one could do, would be to have a whole drive CRC match that would dismiss the proof, as the CRC it's a unique hash generated every time something changes (even a bit), so the write-blocker prevents physically any possible write command to the drive, same principle applies for a file
Well there are basic things like the timestamp (but could be manipulated at a file system level if you know how), metadata, signatures (source os / current os), CRC values, fingerprints, and a few more on the digital side, and other stuffs on the logical (RAM / buffers / cells / etc)
An example, normally, first thing that the police does when they size a media, is to connect it tru a write-blocker device, even before imaging/cloning it, reason for is that if you simply plug up a hard drive taken from another system, it will do some stuffs between the BIOS and the OS and write some data (nothing that the user sees, hardware and software level stuffs), and the first thing one could do, would be to have a whole drive CRC match that would dismiss the proof, as the CRC it's a unique hash generated every time something changes (even a bit), so the write-blocker prevents physically any possible write command to the drive, same principle applies for a file
THIS is what needs to be taught in schools, not sex education.
Interesting, thanks