Core Module
Digital Evidence
Digital evidence is powerful and easy to misread. Know the common sources, capture them carefully, and treat reliability as a question to ask, not an assumption to make.
Common sources
Body and Dashcam Footage
Video from officers and vehicles can corroborate or contradict reports, but coverage has gaps: cameras get turned off, angles miss key moments, and retention windows are short. Request and preserve footage early.
Cell Phone Data
Call logs, texts, photos, app data, and location history can place a person or undercut a timeline. Extraction requires proper authorization and tooling, and interpretation is easy to get wrong.
Social Media
Posts, messages, and metadata can establish relationships, timelines, and statements. Capture content before it is deleted, and document exactly how and when you collected it.
Digital Forensics
The recovery and analysis of data from devices and accounts. Sound forensics depends on validated tools, documented methods, and an unbroken chain of custody from seizure to analysis.
Email and Messaging
Email and chat records can reveal communications, intent, and timelines. Preserve full headers and metadata, not just the message text, and note the platform and account.
Chain of Custody
A continuous, documented record of who handled each item, when, and why. Gaps in custody are one of the fastest ways for otherwise strong evidence to be challenged or excluded.
Reliability flags
Where digital evidence most often gets overstated or misinterpreted.
- Cell-tower location can be far less precise than it looks. A tower connection shows a coverage area, not a pinpoint.
- Digital forensics findings are only as strong as the chain of custody behind them. Gaps invite challenge.
- Touch and transfer DNA can place a person's profile somewhere they never were.
- Probabilistic genotyping software can disagree across systems and versions. Understand the method before relying on a single number.
- AI-generated evidence, including deepfakes, synthetic media, and altered images, is an emerging risk. Verify provenance before you trust it.
Record this for every digital item
For each digital item record: evidence type, collection method, metadata preserved, chain of custody, analytical findings, and long-term storage location.