Why care is needed
Digital records can easily be deleted, changed or claimed to be fake. It is therefore important that evidence is kept in its original state and its source and time can be shown.
Practical rules
- Do not touch the original file or message; work on a copy.
- In screenshots show the date, time, username and link.
- Save the email with its header information.
- Keep files in their original format when moving them.
- Write down where and when the record was taken.
Integrity record
For important files a digest value (hash) can be calculated and kept so that it can be shown the file has not changed since. This is a technical integrity proof and does not alone guarantee admission of the evidence.
Legal support
In important cases routes such as notarial verification or evidence gathering through the prosecutor are considered with a lawyer. The court assesses evidence freely. See digital evidence preservation and evidence and reporting.
