The judgment calls it “lawfulness of evidence”, the requirement that digital data be obtained and preserved without breaching rights or altering its content, which is a different question from whether that data is true. For you it means this, a WhatsApp message, an email or a device log can prove exactly what you need and still be excluded from the trial if the way it was obtained was not the right one. In cybercrime, and in plenty of civil and criminal matters, that is where the case gets decided.
What it is
Any evidence in digital form that helps establish a fact before a court, messages and emails, records and logs from servers and applications, traffic and location data held by the carriers, the contents of phones and computers, the trail left by a transaction. Powerful information and, at the same time, fragile, it can be altered, deleted, or improperly obtained with startling ease.
Why it decides cases
Well-handled digital evidence sustains a conviction or secures an acquittal. Evidence gathered badly, even when it proves exactly what you say, can end up thrown out of the proceedings and count for nothing. In these cases the difference between winning and losing rarely lies in the legal theory; it lies in how the evidence is handled.
The chain of custody
This is the concept that governs everything, the guarantee that the evidence is genuine and has not been tampered with from the moment it is obtained until it reaches the judge. How it is captured, who touches it, and how it is stored decides whether the court admits it or discards it. The same piece of data can be decisive proof or worthless paper, depending on how it was treated.
A screenshot is not always enough
It is a common mistake to assume a screenshot proves everything. Sometimes it does; often it does not, because a capture can be challenged or forged without much effort. Knowing when a screenshot is enough and when you need something more (a certified record, a forensic image, an expert report, the platform’s own data) is part of the craft, and it spares you surprises at the hearing.
Why a generalist is not enough
Working with electronic evidence calls for handling the legal and the technical side at once. The first is second nature to any serious firm; the second, less so. Understanding the digital trail, geolocation, access to devices, and the validity of what carriers and platforms provide, then turning all of it into strategy, is what we have spent years doing and writing about. You can read, for example, how the positioning data kept by the carrier is obtained, or why biometric fingerprints should not be treated as passwords.
If you keep that conversation yourself with nothing more than a screenshot, you risk having that evidence declared invalid at trial, with the fact you wanted to prove left unproven, because a loose image is easily challenged and discarded. In a case like this, in matters of computer crime, we make sure that evidence reaches the proceedings through the correct channel and with the guarantees its admission requires. Call us at +34 677 841 007 or contact the firm before touching anything else on the device. When you speak with us, have ready the original device where the content is stored, the exact dates of the events, and any screenshot or document you have already generated, exactly as it is, without editing or forwarding it.
Frequently asked questions
What exactly is electronic evidence?
It is any evidence in digital form that can help establish a fact before a court, messages, emails, access records, location data, the contents of devices, or the trail of a transaction. Its value depends on how it is obtained and preserved.
Does a screenshot count as evidence at trial?
Sometimes yes and sometimes no. A screenshot is easy to challenge or manipulate, so in many cases it is worth backing it up with other means (a certified record, an expert report, or the platform’s own data). Weighing up what your case needs is key.
Can the digital evidence submitted by the other side be challenged?
Yes. If the evidence was obtained irregularly or its chain of custody was broken, its validity can be questioned and, where appropriate, you can have it left out of account. That technical and legal analysis is precisely our specialty.
Why do I need a specialist rather than a general practitioner?
Because these cases are decided on the technical side of the evidence, not only the legal one. Someone who masters both can obtain, sustain, or dismantle a piece of digital evidence; someone who only sees the legal part cannot.