1. What are the main differences of digital evidence when compared to the physical evidence like a weapon, paper document, or visible injury? You are appointed as the forensics investigator of a hacking case. You seized the computer of the hacker. What digital evidence you may collect from this computer?

2. What is the primary purpose of hashing digital evidence? What are the three rules for forensic hashes? Assume that the hash function does not meet one of the rules, please select one rule and explain how the forensic investigation can become invalid with the lack of that rule?