In order to determine whether a computer holds information that may serve as evidence,
the professional must first create an exact image of the drive. The examiner examines only this image drive to protect the original from inadvertent alterations. These images must be actual bit-by-bit or "mirror" images of the originals, not just simple copies of the data. Acquiring these kinds of exact copies requires the use of specialized forensics techniques.
These mirror images are critical because each time someone turns a computer on, many changes are automatically made to the files. In a Windows® system, for example, more than 160 alterations are made to the files when the computer is turned on. These changes are not visible to the user, but the changes that do occur can alter or even delete evidence, for example, critical dates related to criminal activity.
Assuring chain of custody is as important to the specialist who oversees drive imaging and evaluation of the data for its evidentiary value as it is in medical forensics. The forensics specialist uses hash codes to assure chain of custody.
Hash codes are large numbers, specific to each file and each drive, that are computed mathematically. If a file or drive is changed, even in the smallest way, the hash code will also change. These hash codes are re-computed on the original and images at various points during the investigation in order to ensure that the examination process itself does not modify the image being examined.
http://www.expertlaw.com/library/forensic_evidence/computer_forensics_101.html