I have seen stuff like "defendant had TOR installed - a popular program for criminals" in court filings. ...and judges and juries accept that as fact because they just don't understand the technology. For example, having a bookmark for "Hacker News" would absolutely show up in court. Crazy stuff meant to bias judges and juries that don't know tech.
The point is that the situation is 100x worse in tech where prosecutors, judges, and juries simply do not understand the evidence. ANYTHING can be painted as incriminating evidence.
I have seen saved credentials on automation jobs being used to incorrectly establish people's network activity. I have seen routine maintenance being used to establish obstruction charges just to intimidate possible witnesses... Like stuff you would not believe happens, happens.
It's even worse in civil suits, where opposing counsel will subpoena as much as possible (mountains of data) just to give you more work and fish for trade secrets or anything they can twist in court.
When I was junior, I proudly told my legal team "good news, I added space to keep our transaction records for 20 years!" and was aghast when they said they wanted files deleted THE DAY the legal requirement to hold it expired because it increased legal liability.
Now I totally get it. Today we only store the bare minimum - everything else is deleted immediately. ... and I have to re-explain this to junior employees each year to their disgust.