Data files from original evidence should be used for forensics analysis