Many cases do not go to trial because, once spotted, it is easier to get firm, convincing evidence from the attacker. It is best to catch the criminal in the act. Nearly all of this evidence is machine-readable. As any computer user will tell you, this makes it subject to easy, undetectable editing. The courts have to deal with this alarming and obvious possibility.
Legal requirements vary greatly between jurisdictions.
The laws of one country may not have yet contemplated hacking activity that is quite illegal in another. Even in countries with more experience with hacking cases, the laws and case law are still emerging. But there are some rules that seem to be working. Logs kept in the ordinary course of business are admissible. Log-keeping is an important part of dealing with the Internet.