How do you preserve digital evidence?

1. Keep the original medium

The original medium — phone, computer, disk, USB stick — is the reference. As long as it is intact, a faithful copy remains possible. Ordinary use changes data: opening a file changes its access dates, an update rewrites parts of the system, a reset erases most of it.

2. Precautions before doing anything

• Do not reset, restore or update the device.
• Do not delete the suspect app, message or file.
• Do not « clean » the device with an antivirus or a consumer detection app.
• Isolate a computer or server from the network rather than powering it down: volatile memory is lost at shutdown.
• Note the date and time of the discovery, and every action taken since.

3. Screenshots: useful but limited

A screenshot captures what was displayed, and is often the first thing to do when content may disappear. But it has limits: it does not carry the original item's metadata, it does not by itself prove authenticity, and it is easy to alter. It complements preserving the original; it does not replace it.

For online content, a timestamped technical record — URL, date, time, hash of the captured content, method — is more robust. See impersonation and fake profiles.

4. Metadata and timestamps

Metadata accompanies a file or message: creation and modification dates, author, device, location, email headers. It often allows an item to be dated and placed, but it is fragile: copying, forwarding or editing a file can change it. Hence the importance of working on a properly made copy, and of accounting for time zones and each device's clock setting.

5. Forensic acquisition and hashing

A forensic acquisition is a copy made with a method that does not alter the medium, with every step documented. At the time of copying, a cryptographic hash — for example SHA-256 — is computed to characterise the content. If a later recomputation gives the same hash, the copy has not changed. That is what allows a third party to check the work.

International guidelines such as ISO/IEC 27037 and NIST SP 800-86 describe these stages of identification, collection, acquisition and preservation.

6. The chain of custody

The chain of custody traces each item's path: who handed it over, to whom, when, in what condition, and what operations were carried out. A handover record, a seal and an operations log are the usual documents. Without it, an item's integrity becomes hard to demonstrate.

7. By type of medium

Smartphone

Do not reset or update; leave the device on if possible; do not uninstall the app concerned. See smartphone forensics.

Computer

Isolate from the network without shutting down; do not run a clean-up tool; note the programs open. Volatile memory holds traces that vanish at shutdown.

Cloud and online accounts

Activity logs have limited retention: request an export or a hold quickly. Secure the account from another trusted device. See cyber investigation.

Email

Keep the message in the original mailbox, with its full headers; avoid forwarding it, which rewrites part of it.

Messaging apps

Do not delete the conversation; do not block the other party before the exchanges are captured; note usernames, numbers and aliases. For blackmail, see sextortion and blackmail.

8. What technology establishes, and what is for the court

The technical approach establishes facts: a file existed on a given date, a message came from a given account, a copy is identical to the original. It documents its method and its limits. The legal characterisation of those facts, the admissibility of the material and its evidential weight, on the other hand, depend on the applicable law and the court's assessment. A sound report does not cross that line.