Digital Evidence: What Counts and How to Keep It Admissible
A video lands in your inbox just before a filing deadline or publication meeting. It appears to show the incident everyone's discussing, but the sender didn't record it, the original device is unavailable, and someone has already uploaded it to social media. Your editor or attorney asks a simple question: can we rely on this?
The answer requires more than close scrutiny or running a deepfake detector. You need to establish what you received, preserve it without changing it, investigate its origin, and separate what the file shows from what it proves.
What Counts as Digital Evidence and Where It Lives
Digital evidence is information in binary form that can support a criminal or other legal investigation or proceeding. The National Institute of Standards and Technology's digital-evidence guidance emphasizes that evidentiary value generally lies in the content and associated information, not merely in the device holding it.
That distinction changes how you collect evidence. Taking possession of a phone doesn't automatically preserve a disappearing message, its account history, or the circumstances in which someone received it. Saving a photograph doesn't necessarily preserve the original file's metadata or establish who operated the camera.
Digital evidence categories and where they sit
NIST organizes preservation challenges into the following categories. The practical risks explain why collecting a device and preserving its contents aren't interchangeable tasks.
| Category | Typical sources | Main risk |
|---|---|---|
| Physical media | Phones, drives, memory cards, servers | Overwriting, device loss or wiping |
| Digital images and files | Photos, documents, exported video | Re-saving that changes metadata |
| Other digital objects | Messages, cloud posts, software, logs | Provider retention limits and deletion |
| Law-enforcement generated | CCTV, body-worn and dash cameras, plate readers | Overwritten recording loops |
These categories describe preservation problems, not rigid boundaries. A body-camera recording is a digital file, resides on physical media, and may pass through an evidence-management system. Each stage introduces information worth retaining, including export settings, access records, and acquisition history.
The scope extends well beyond cybercrime. Computer and mobile data, audio, video, software, hardware, crime-scene photographs, surveillance recordings, and material used in facial recognition can all have investigative value.
Separate the container from the claim
Think of a sealed envelope. The envelope matters, but so do the letter inside, the sender's identity, and the record of how it arrived. An intact envelope doesn't establish that its author told the truth.
For legal teams connecting technical preservation to potential challenges, digital evidence insights from Brian Hansford Law offer a complementary legal perspective. Keep that assessment alongside, rather than in place of, the acquisition and examination records.
From the outset, distinguish the storage device, the file, and the event the file records. A genuine phone can contain fabricated media. An unchanged file can show a misleading excerpt. A convincing scene can still lack a reliable connection to the place, time, or person alleged.
How to Preserve and Hash Evidence Before Anyone Analyzes It
Authenticity requires a documented workflow, not just a convincing appearance. Organize forensic work around validation, preservation, acquisition, examination, analysis, and reporting. Validation includes checking whether your tools and procedures perform as expected, not declaring the depicted event genuine.
The workflow below provides a useful overview, but its stages require records that another examiner can inspect.
A preservation routine your team can repeat
NIST's digital-evidence preservation guidance recommends hashing close to collection with a NIST-approved algorithm, storing the hash separately and securely, and retaining additional evidence copies.
Validate the tools before use. Test the acquisition and hashing tools against known files, and record their names, versions, settings, and expected behavior. A common slip is installing a familiar utility without checking whether its current configuration modifies files or omits relevant information.
Hash the original at collection. Use a NIST-approved algorithm before viewing or analyzing the received file, and record exactly which object you hashed. Hashing a re-saved export instead of the received original establishes a baseline for the export, not for the earlier file.
Separate the reference hash from the evidence. Store the hash in a secured record and maintain protected evidence copies so you can recover from corruption. Keeping every copy and its only verification record in the same writable folder defeats that protection.
Create a controlled working copy. Protect the original through write protection or appropriate access controls, then perform examination on the copy. Don't assume that copying succeeded because the filename and displayed size look right; verify the working copy against the recorded hash.
Rehash after transfers and processing. Matching values establish that the compared byte sequences haven't changed; an unexpected mismatch calls for investigation while the original remains protected. If processing intentionally creates a derivative, record its new hash and relationship to the source rather than expecting it to match.
Record every handoff. Identify who handled the evidence, when and where they handled it, what they did, and why. A message saying that a file was sent isn't a substitute for identifying the actual file and documenting receipt.
Know what the fingerprint establishes
A hash is a mathematical fingerprint of the file's bytes. It lets you compare the collected object with a later copy without relying on appearance, filename, or someone's memory.
Practical rule: A matching hash supports file integrity. It doesn't establish that the depicted content is true.
An unaltered deepfake remains an unaltered file. Preservation protects the material you'll investigate; it doesn't complete the investigation.
Build these fields into your intake checklist rather than reconstructing them later. Our evidence-preservation guide can help teams turn the routine into a repeatable handoff process.
Handling Video and Audio Without Altering the Evidence
A clip that plays successfully hasn't necessarily survived handling unchanged. Screen recording adds another capture and encoding process. Re-encoding can change frame timing, audio synchronization, or encoder history before an examiner sees the material.
Start by identifying which version you hold and what operations produced it.
| Situation | Risk to the evidence | Action |
|---|---|---|
| Screen recording of playback | Adds a second encoding and can lose frame timing | Obtain the original file from the device or export, and label the recording as secondary |
| Social media re-upload | Platform recompression can remove original encoder history | Request the original upload where possible and record the URL and capture time |
| Transcoding for playback | Changes codec and can drop or shift audio | Prefer stream copy where compatible, and hash streams before and after copying |
| Audio split from video | Sample rate and sync data can be lost | Keep the combined file and separate audio only on a working copy |
| No original device available | Fewer forensic signals remain | Record the gap in the custody log and state the limit in the report |
Extract context without treating it as proof
The Scientific Working Group on Digital Evidence's video-authentication guidance explains that video lacks a universal metadata standard comparable to EXIF for still images, and metadata can be altered without preventing playback. It recommends validating extraction tools, comparing their results, and combining metadata with global and local content analysis.
Organize extraction into readable groups:
- Capture context: Recording time, camera model, GPS information, and modification timestamps.
- Picture structure: Resolution, frame timing, color space, and video-stream organization.
- Audio properties: Sample rate, bit depth, channel information, and synchronization with the picture.
- Encoding history: Codec, bitrate, encoder information, and container structure.
Tools such as ExifTool and FFprobe can expose useful attributes, but don't treat agreement between tools as independent confirmation of the underlying facts. Both may be reading the same editable field. Record raw outputs and investigate disagreements rather than choosing whichever result fits the expected story.
Preserve the payload when making derivatives
Stream copying isn't the same as transcoding. Stream copying duplicates encoded media without decoding and re-encoding it; transcoding creates a new encoded representation. When the destination format supports the existing streams, prefer stream copying and compare hashes of the source and duplicated streams.
The container file may change even when the media payload remains intact. Document whether you're comparing whole files or individual streams so another examiner can interpret the results.
An unfamiliar encoder or irregular frame interval is a reason to investigate. It isn't, by itself, evidence of malicious editing: ordinary export and platform processing can also leave unusual traces.
Admissibility Standards Courts Apply to Digital Video
The central authentication question is whether the proponent can show that the item is what they claim it is. That claim needs precision: an unchanged download from an account is different from an original camera recording of a particular person at a particular location.
The American Bar Association's discussion of deepfakes and evidentiary standards explains that Federal Rule of Evidence 901 requires enough evidence for a reasonable finding of authenticity, while Rule 104(a) concerns preliminary admissibility determinations and Rule 702 and Daubert may govern expert reliability.
Admissibility requirements and what to document
These are U.S. federal considerations, not a universal filing checklist.
| Standard | What it requires | What to document |
|---|---|---|
| FRE 901 authentication | Enough evidence for a reasonable finding that the item is what it claims to be | Original file, acquisition record, hash values, and the identity of the person who captured it, where known |
| FRE 104(a) reliability | Judge decides preliminary questions of admissibility and reliability | Workflow description, tool and version details, and stated error limits |
| FRE 702 and Daubert | Expert testimony rests on sufficient facts, reliable methods and reliable application | Method validation, known error rates, expert qualifications, and relevant peer review |
A detector score doesn't independently satisfy these requirements. It doesn't identify the person who recorded the footage, establish the acquisition circumstances, or explain whether the method is suitable for the particular file.
Compressed social-media copies and screen recordings can be especially difficult to evaluate because processing may remove useful signals. That doesn't automatically make them inadmissible or worthless. It means the supporting account and the limits of examination deserve particular attention.
Assemble a court-ready evidence packet
Build a packet that lets counsel and an examiner reconstruct the work. Include the preserved original or earliest available file, its hash, acquisition circumstances, analysis timestamp, custody records, and tool/version details.
Then include signal-level findings, not merely a verdict. Explain what was examined, which observations support the conclusion, and what uncertainty remains. Include confidence information only with an explanation of what it measures; don't relabel a detector score as a statistical confidence interval without a validated basis.
For teams preparing specialist testimony, the Law Office of Bryan Fagan's explanation of how expert testimony is admitted provides useful procedural context. Our expert-witness guidelines can also help organize the technical handoff.
Automated analysis supports human or expert authentication. It doesn't replace the evidence needed to explain the file's identity and history.
Proposals for enhanced authentication when generative-AI manipulation is alleged should not be mistaken for universally adopted rules. Counsel should verify the current rules, local procedure, and applicable jurisdiction before filing.
What a Detector Score Cannot Prove
No manipulation detected doesn't mean the event is proven. A detector evaluates characteristics of the submitted media. It doesn't establish whether the recording excludes an important moment, whether another camera contradicts it, or whether the accompanying caption is accurate.
Separate the questions before interpreting the result.
| Question | What answers it | What a detector score adds |
|---|---|---|
| Is the file authentic? | Provenance, original hash, and unaltered-export checks | Frame and audio signal findings |
| Is the scene complete? | Surrounding files and other camera angles | Nothing about what lay outside the frame |
| Is the capture continuous? | Source device, synchronization logs, and timestamps | No independent proof that recording gaps are absent |
| Did the event happen? | Corroborating records and witness accounts | No independent establishment of event truth |
Absence claims require different evidence
A September 2025 submission by Epistria LLC hosted by the SEC argues that courts lack clear standards for digital evidence offered to prove a negative and that cryptographically generated negative receipts still require authenticity, integrity, and custody checks. This is a contributor's submission, not an SEC rule or endorsement.
The distinction matters when someone claims that no employee accessed a system, no transaction occurred, or no recording was altered. Examining one artifact doesn't establish that all relevant artifacts were collected.
Say a surveillance export begins after an argument started. It may faithfully preserve the exported interval while omitting the provocation. Another clip might lose audio during conversion, while a separate camera records a conflicting account.
A related boundary applies to suspected covert monitoring. Sentry Private Investigators Ltd's TSCM bug sweeping concerns a separate investigative service; an uploaded-video assessment shouldn't be presented as establishing whether a room contains surveillance equipment.
Write conclusions that match the question
Use outcome labels with explicit scope:
- Authentic copy: The copy's integrity and stated provenance are supported.
- Altered: Examination supports a specified alteration, with its significance explained.
- Not determinable: Available material doesn't support a dependable conclusion.
- Event not established: The proposed account remains unproven, even if file integrity is supported.
These labels aren't necessarily mutually exclusive. An authentic copy can still leave the event unestablished.
Combine frame and audio examination with source-device information, provenance, surrounding files, synchronized timestamps, and independent accounts. State unknowns plainly rather than turning a clean screening result into an answer to a different question.
Applying the Workflow to a Clip Shared Across Borders
A newsroom receives footage of a public confrontation. The sender found it on a social platform, the relevant provider holds information abroad, and the newsroom has only a compressed re-upload.
The journalists need to preserve what they have while pursuing material they can't immediately obtain.
Preserve now while access remains uncertain
Europol's SIRIUS reporting on 2020 found that about 25% of police officers reported reduced capacity to request electronic evidence during the pandemic, while cross-border requests from EU authorities to eight large providers increased 27% from 2019 to 2020. Those historical findings describe policing, not newsroom response times, but they illustrate why access planning belongs alongside technical examination.
The receiving journalist makes a source record containing the post's URL, account name, capture time, and accompanying claims. The evidence custodian hashes and protects the downloaded file before the editorial team starts manipulating it.
The next decisions proceed in parallel:
- Pursue preservation. Promptly contact the platform through its applicable process, log the request, and involve counsel where necessary. A newsroom's request doesn't carry the same authority as legal process.
- Examine a working copy. Review picture and audio, recording the methods and file version used.
- Seek independent context. Contact the apparent recorder, obtain nearby footage, and compare landmarks, witness accounts, and surrounding files.
- Assign scoped outcomes. Record authentic copy, altered, not determinable, or event not established only where the findings support that label.
If the original never arrives
The editor shouldn't upgrade the re-upload into an original recording. Any publication decision should account for the unresolved source and content questions, with limitations placed beside the clip rather than hidden in internal notes.
A clear disclosure might identify it as a compressed re-upload, state that the original wasn't obtained, and explain which claims remain unverified. The legal team separately assesses whether the available foundation supports its intended courtroom use.
Preservation, examination, and corroboration can continue while requests remain outstanding. Time is the variable to plan for, not a reason to leave the available evidence undocumented.
Confirm Authenticity Before You Rely on a Clip
Choose an action based on the evidence you hold, not the urgency of the decision. Publication deadlines, litigation schedules, and internal pressure don't resolve missing provenance.
Rely with documentation when preservation, source tracing, examination, and corroboration support the particular claim you intend to make. An authentic-copy finding should identify the source object it authenticates, rather than imply that every interpretation of the scene is correct.
Match the decision to the unresolved risk
Corroborate first when the original is missing or the source is unclear. Request the earliest available file, pursue other recordings, and hold the unresolved authenticity question as not determinable rather than forcing a binary answer.
Withhold reliance on the disputed claim when findings support material alteration or the evidence history leaves an important gap. A custody gap alone doesn't prove fabrication, and routine editing doesn't necessarily make footage useless. Use altered or event not established only as the findings warrant, and explain the reason.
Our content-authenticity guide offers a practical companion for teams deciding how to describe these distinctions to readers and reviewers.
Complete the release checks
Before authorizing reliance, confirm that the packet contains:
- A baseline hash: Identify the original or earliest received file, without implying you obtained an unavailable camera original.
- A custody record: Account for handlers, transfers, storage, and documented gaps.
- An identified source: Separate the recorder, uploader, and person who supplied your copy.
- A dated examination: Identify the working copy, analyst, methods, tools, and analysis timestamp.
- Written limitations: Place unresolved questions beside the conclusion they qualify.
For sensitive material, confirm authorization and applicable confidentiality obligations before using an external service. Our uploaded videos are processed in real time and are never stored on our servers; signed-in analysis history retains only minimal metadata such as filename, size, and score. Keep your own preserved evidence and verification records regardless of the service's processing model.
A qualified examiner should review the packet before court use. Give that examiner the underlying files and records, not just a screenshot of a score.
Start today by hashing the file you received before opening it for review. Once you've preserved it and confirmed upload authorization, submit a working copy to AI Video Detector for frame-by-frame screening that estimates whether it was created or altered using AI and provides a confidence score. Keep that result inside the evidence packet, alongside provenance, corroboration, and a clear statement of what remains unproven.