Question

Read the passage and answer the question. When detectives arrive at a cybercrime scene, the first principle they follow is deceptively simple: change nothing. Digital evidence is fragile; a single careless click can overwrite a deleted file, alter a timestamp, or trigger a remote wipe. For this reason, modern law enforcement treats every device — a phone, a laptop, a server — as a crime scene in miniature, photographed and documented before anything is touched. Specialists then create a bit-stream image, a bit-for-bit copy of the storage, and perform all analysis on the copy while the original is sealed, hashed, and stored. This workflow grew out of hard lessons: early computer-crime units often examined originals directly, and defence lawyers successfully argued that the evidence had been tampered with. Courts now expect a documented chain of custody and a cryptographic hash to prove that the analysed copy is identical to the seized original. As crime migrates online, digital forensics has become as routine as fingerprinting — but unlike a fingerprint, a byte can be copied, cloned, and altered without a trace, which is exactly why the method must be stricter, not looser. What is the central principle of handling digital evidence at a crime scene?