Common types of electronic evidence

  • Emails and electronic documents
  • Text messages and instant messaging data
  • Social media posts and metadata
  • Digital photographs and videos
  • Location data from mobile devices
  • Logs from computer systems or network activity
  • Cloud-based data from services like Google Drive or Dropbox

⚖️ Investigating War Crimes

Ukrainian law enforcement agencies are investigating hundreds of thousands of war crimes and human rights violations.

Role of Electronic Evidence

Electronic evidence is critical where traditional evidence is destroyed or unavailable.

Reliability of Digital Evidence

Metadata, hashing, and timestamps ensure authenticity and resistance to manipulation.

Key Principles of Electronic Evidence

Digital origin Same legal value Connection to a crime scene
Electronic evidence is derived from electronic devices such as computers and their peripheral apparatus. Electronic evidence is not fundamentally different from traditional forms of evidence. Electronic evidence may be used to link individuals, devices or activities directly or indirectly to a crime scene.

Where Electronic Evidence Can Be Found

Electronic evidence may exist in multiple locations, including:

  • Devices at the crime scene
  • Devices belonging to suspects, witnesses or victims
  • Wired networks connected to those devices
  • Wireless networks
  • Servers located within the jurisdiction
  • Servers located anywhere in the world

Types of Electronic Data

• Subscriber information
Data held by a service provider that identifies a subscriber, including name, address and contact details.

• Traffic or transmission data
Computerised data relating to a communication that indicates the date, origin, route and destination of a communication.

• Content data
Data representing the substance of a communication or illicit content attached to a communication.

• Cloud data
Data stored on distributed servers across different locations, often managed through automated systems and algorithms.

 

 Lifecycle of electronic evidence

 

Lifecycle of electronic evidence

 

  1. Preservation: Ensuring electronic data is protected from alteration, damage, or loss. Art. 16, 17 of Budapest Convention
  2. Authorisation: Obtaining legal permission to access and process electronic evidence. Art. 14, 15 of Budapest Convention
  3. Collection: Extracting and recording electronic data while maintaining the chain of custody. Art. 18, 19 of Budapest Convention
  4. Examination & Analysis: Investigating the collected data to identify facts, traces, and correlations. Art. 19, 20, 21 of Budapest Convention
  5. Preparation: Organizing analytical results into a structure suitable for legal presentation. Art. 15 of Budapest Convention
  6. Admissibility: Verifying that the evidence meets legal standards for acceptance in court. Art. 14, 15 of Budapest Convention