There are three primary goals with digital forensics:
Collect electronically stored information in a sound, defensible manner,
Analyze the results of the collections, and
Present the findings either in formal legal proceedings or less formally to inform a client.
Electronic evidence can be short-lived and fragile. It needs to be collected in a defensible, methodological manner to preserve it accurately, and to withstand scrutiny in legal proceedings. (chain of custody)
Electronic evidence can be highly probative, both as it appears to users, and behind the scenes. There is a lot of information that a computer user never sees (e.g. metadata, logs, registry entries). This behind-the-scenes evidence may provide a wealth of information about who did what when and where. Forensic analysts are trained to preserve, collect and interpret this kind of evidence.
Some digital files can be recovered, even if a user has tried to delete them.