Computer forensics experts are hackers in their own right. They have to know the technology inside and out, understand the daily activities of the criminals, forage into a computer used in the commission of a crime, and develop a case that prosecutors can use in court. So much of what occurs on a computer is invisible to the user that special tools are needed to reconstruct data. The computer forensics expert has to possess a wide variety of skills, own or develop a suite of software forensic tools, and maintain the integrity of the chain of evidence according to accepted legal practices. The forensics examiner's tool kit should contain the tools and techniques to collect and analyze the data.
Lawyers believe that bits are easier to tamper with than paper.
In one sensitive case a bitstream copy of the hard drive and a memory dump of the RAM needed to be done by a qualified specialist before examination. The tools used by the forensic expert have to be established as working properly and must not alter the data in any way. The computer forensic community must accept the tools and the results must be repeatable. These same tools are sometimes also used to monitor and audit a network. So, in a way, a good system administrator should provide a staring point for the investigation of the network by providing the installation information about the network and updates as each new application or change was completed, in addition to the backup and log files.