Glossary term
Digital Evidence
Digital evidence is information stored, processed, or transmitted in binary form that may be used to support a fact at issue in a legal or investigative matter.
Digital evidence covers everything from text messages to file metadata to cloud audit logs. The defining characteristic is that the evidence exists as data on a computing device or network, rather than as a physical artifact.
In Canada, the admissibility of digital evidence is governed by section 31.1 to 31.8 of the Canada Evidence Act for federal proceedings, with parallel provisions in provincial evidence acts. The proponent must satisfy the court that the integrity of the electronic system has been preserved, which usually means demonstrating defensible collection, hash verification, and chain of custody.
Practical examples include email messages, SMS and chat logs, photos and videos, browser history, location data, financial-app activity, system event logs, and audit logs from cloud platforms.
The forensic examiner's role is to recover the evidence, document the methodology that produced it, and present findings in a form that allows the trier of fact to assess weight and reliability.