Even in countries with more experience with hacking cases, the laws and case law are still emerging. But there are some rules that seem to be working. Logs kept in the ordinary course of business are admissible. Log-keeping is an important part of dealing with the Internet. They help identify usage patterns, administrative and configuration errors, misuse, and attacks.
Mailers keep logs to help identify sources of spam mail.
Firewalls log rejected packets. Authentication servers record account usage, and DHCP servers record caller ID information, accounts, and IP addresses assigned. ISP records of this sort are particularly important in tracing attacks back to their source. This requirement has been a source of tension for companies, particularly those who do not wish to become involved in the legal process. If logs are discarded routinely, without backup, there is less to obtain through the discovery process.