Family law digital forensics in BC: what can be collected, and what it proves

Most family law matters now turn, at least in part, on something stored on a phone. Messages, photos, location history, banking apps, dating apps, a shared laptop. Counsel know the evidence is there. The harder questions are whether it can be obtained lawfully, whether it will hold up, and what it will really prove once an examiner has looked at it.

This article sets out how family law digital forensics works in British Columbia in practice: the lawful starting points, what a forensic examination produces, and the mistakes that cost clients the very evidence they were trying to secure.

Start with authority, not with the phone

Every engagement we run for family counsel begins with one question: what gives this person the right to have this device or account examined?

The usual lawful starting points are the client's own devices and accounts, devices that are genuinely jointly owned and used, a child's device where the parent has authority over it, and devices or accounts produced under a court order or by agreement between the parties. Where access is contested, counsel can seek a preservation order or a production order before any forensic work begins.

What does not work is self-help. Reading a spouse's phone while they sleep, logging into their email with a remembered password, installing monitoring software, or recording conversations covertly can engage the Criminal Code provisions on unauthorized use of a computer and interception of private communications, and the BC Privacy Act creates a civil claim for wilful violation of privacy. A family court judge who learns that evidence was collected that way can exclude it, draw inferences against the person who collected it, or reflect it in costs. We decline engagements where the retaining party cannot show authority, and we say so at the first call.

What a forensic examination actually produces

A forensic examination is not someone scrolling through a phone. It starts with an acquisition: a complete, verified copy of the device's storage taken with specialist tools, with hash values recorded so that anyone can later confirm the copy was not altered. On modern phones the most useful acquisition is a full file system extraction, which reaches application databases and system records that a backup or a screenshot never shows.

From that copy, an examiner can usually establish:

• Messages and deletions. Current and, where the data still exists, deleted messages across SMS, iMessage, WhatsApp, Signal, Instagram and the rest, with timestamps and the database records that show when something was removed.
• Location history. Significant-location records, photo metadata, map searches and app check-ins that place a device at a time and place.
• Financial activity. Banking, e-transfer and investment apps, cryptocurrency wallets and exchange apps, browser history for institutions that never appeared on a financial statement, and the artifacts of seed phrases or hardware wallets.
• Device use and timelines. Which apps were used, when the device was unlocked, when photos were taken or shared, and whether a device was wiped or reset shortly before it was produced.
• Shared computers. User accounts, document history, cloud sync folders and browser activity on a laptop both spouses used.

Each finding is tied to the record it came from, so the report can say not only what happened but how the examiner knows.

What it does not prove

Digital evidence has limits, and a credible report states them. A message recovered from a database shows what was stored on that device; it does not by itself prove who typed it. A location record shows where a phone was, not necessarily where its owner was. Deleted content is only recoverable while the space it occupied has not been reused, which on a modern phone can be a matter of days. Cloud accounts, including iCloud and Google backups, generally need the account holder's credentials and consent, or an order, and the provider's own retention rules apply.

Counsel who understand these limits before retaining an examiner ask better questions and get a report that survives cross-examination.

Where the evidence meets BC family procedure

In a BC Supreme Court family matter each party swears a financial statement, and the duty of full and true disclosure runs through the Family Law Act. Forensic findings most often come in at that point: a wallet app or an exchange login that was never disclosed, a second bank account visible in a notification history, or income from a side business that only exists in a payments app.

In parenting matters the questions are different: communication with the children, the content and timing of messages between the parties, and sometimes whether a device given to a child carried monitoring software. The same acquisition and reporting standard applies, and the sensitivity is higher. We treat every family engagement as confidential by default and write for a judge who will not want a technical primer.

Preserve first, decide later

The single most valuable step counsel can take early is preservation. A phone that is about to be returned to the other party, traded in, or reset should be forensically acquired first, even if no one has decided whether the evidence will be used. The acquisition is non-destructive, it is usually invisible to the device user afterwards, and it stops the clock on deletion. Deciding not to use preserved evidence costs nothing. Deciding to use evidence that was never preserved is not an option.

How an engagement runs

A scoping call with counsel establishes authority, the questions to answer and the devices involved, followed by a written estimate. Devices are acquired at our lab or on site, with a documented chain of custody from the moment they are received. The examination answers the questions counsel set, and the report is written in plain English with the technical record in appendices. Where the matter proceeds to a hearing, the same examiner is available to give evidence and be cross-examined on the methodology.

If you are a family lawyer in BC or a client in an active or imminent matter, the most useful first step is a short conversation about what needs to be proven and what you have lawful access to. From there, the path is usually clear.