Digital evidence: a challenge for the justice system

Today we are immersed in a digital revolution that has profoundly transformed the way we communicate, work, and interact. The Internet, cloud computing, mobile devices, and social media have not only changed the economy and daily life, but have also opened up a new legal frontier: digital evidence.

What is digital evidence?

Digital evidence refers to any information that is generated, stored, or transmitted by digital means and that can be used in a legal proceeding to prove relevant facts. This may include, among others, emails, access logs, files extracted from devices, social media posts, instant messaging chats, metadata, or activity logs.

Nowadays, its use has become widespread in many legal proceedings—from labor disputes or divorces to financial crimes, harassment, identity theft, or cybercrime—and its relevance will continue to grow. It is therefore essential that judges, lawyers, and citizens understand its implications and rely on qualified professionals to ensure that such evidence is obtained, analyzed, and presented with full legal and technical guarantees. In particular, it is crucial to involve certified computer forensic experts officially registered with professional bodies, capable of ensuring the technical and legal validity of digital evidence.

Areas of application of digital evidence

Digital evidence is a cross-cutting resource that may be found in virtually any type of legal proceeding. Some relevant examples include:

• Labor proceedings: emails or messages sent or received by the employee that may prove their conduct during working hours.
• Divorce proceedings: messages exchanged between spouses that reveal relevant facts.
• Commercial proceedings: digital communications proving agreements or breaches of contract, unlawful online content (such as intellectual property infringements), electronic invoices, or backups proving failures in IT systems.
• Gender violence cases: messages proving threats, insults, or risk situations justifying a protection order.
• Cybercrime cases: crimes such as cracking, phishing, hacking, cyberbullying, cyberterrorism, or glorification of terrorism and hate crimes.
• Criminal proceedings for common crimes: investigations into economic crimes, fraud, theft, threats, or any other offense where digital evidence is essential (such as messages, images, geolocation, or browsing history).

Digital evidence vs. digital proof

Broadly speaking, digital evidence is the preliminary stage of digital proof and does not always become admissible evidence. It is a raw digital item that has not yet undergone the necessary technical and methodological processes to ensure its validity in court. For example, a received email, a file stored on a disk, or a forum post are digital evidence. But in order to become digital proof, they must have been properly processed according to forensic standards.

In this sense, digital proof refers to any digital information that holds evidentiary value. That is, any element produced, stored, or transmitted through digital means that, when properly handled, can be used in a legal proceeding to prove relevant facts.

All digital proof is digital evidence, but not all digital evidence qualifies as digital proof.

Why is digital evidence a challenge for law?

Digital evidence poses a growing challenge to the judicial system, mainly because technology evolves faster than legislation. Each innovation creates new opportunities for society, but also new ways to commit crimes. Courts must now deal with issues that were unthinkable just a few years ago, facing a type of evidence that cannot be seen or touched, which requires a specialized approach for proper interpretation and evaluation.

These are some of the key questions that arise in legal practice when digital evidence is presented:

• How is digital evidence presented in court?
• What format is admissible?
• How can its authenticity be proven?
• What evidentiary value does it hold?
• How is its integrity guaranteed?

In this context, a rigorous procedure for preservation and analysis is essential, as well as the intervention of qualified forensic IT experts to ensure its technical and legal validity.

Key features of digital evidence

Digital evidence has a number of characteristics that set it apart from other types of evidence and require specific technical and legal treatment. These include:

• Intangible: Digital evidence cannot be perceived directly with the senses. It must be visualized, interpreted, or presented using digital devices. Unlike physical evidence like a gun or a bloodstain, digital evidence lacks tangibility.
• Replicable: It can be easily copied, requiring proof that original and copy are identical (bit by bit), using techniques such as hashing.
• Volatile: It can be altered or disappear quickly—e.g., Instagram stories or social media comments may vanish within minutes.
• Deletable: It can be partially or entirely destroyed, preventing recovery. A known case in Spain is the destruction of Bárcenas’ hard drives.
• Partial and distributed: It may be spread across multiple files, devices, or servers (even in different countries), complicating its recovery and analysis.
• Intrusive: Its acquisition can affect fundamental rights like privacy or data protection and must be conducted with full legal safeguards.

What is required for digital evidence to be admissible?

For digital evidence to be admitted and assessed with full guarantees in legal proceedings, it must meet a series of technical and legal requirements that ensure its reliability. These requirements are based on three essential principles:

• Origin: The source of the digital evidence must be clearly and verifiably identified, including the device, system, or environment from which it came, as well as the circumstances of its extraction.
• Authenticity: It must be proven that the evidence is genuine and has not been manipulated or altered. Techniques such as digital fingerprinting or correlation with other evidence are used for this purpose.
• Integrity: The evidence must remain unaltered throughout the entire chain of custody, with every step rigorously documented and preserved under proper technical conditions.

In addition, to have full evidentiary value, digital evidence must have undergone three key methodological phases:

• Acquisition: Data must be lawfully obtained, respecting fundamental rights and current regulations.
• Submission in court: The evidence must be relevant, necessary, and submitted in compliance with procedural requirements applicable to the specific jurisdiction.
• Judicial assessment: If the above phases are met, the court can evaluate the evidence and grant it probative value.

If these requirements and phases are not followed, the digital evidence may be challenged and excluded from the proceedings. For this reason, it is essential that it be handled in accordance with recognized forensic standards and with the intervention of certified forensic IT experts who can guarantee its technical and legal validity in court. This rigor not only reinforces the reliability of the evidence but also ensures the right to evidence, prevents legal defenselessness, and contributes to the proper administration of justice.

Technical and legal challenges of digital evidence

Despite its increasing presence in judicial proceedings, digital evidence presents a number of challenges that affect its effective use and assessment. These stem from both the lack of specific regulation and the technical complexity involved. Some key challenges include:

• Lack of clear, systematic regulation: Spanish law lacks a unified legal framework for the acquisition, preservation, and evaluation of digital evidence, often requiring analogical interpretations.
• Limited case law: Legal doctrine on digital evidence is still evolving, and judicial criteria are not yet fully consolidated.
• General lack of technical knowledge: Many legal professionals lack specific training in technology, hindering the interpretation and defense of digital evidence.
• Complexity in presentation: Translating technical data into accessible language for judges requires a rigorous explanatory effort by the forensic expert.
• Lack of technical infrastructure: Not all courts have the means to view or verify digital evidence formats.
• High cost of expert analysis: Validating digital evidence requires skilled professionals, whose work may involve significant costs not all parties can afford.
• Ease of falsification or manipulation: The digital nature of evidence allows relatively easy alteration, making it necessary to ensure its authenticity and integrity with maximum guarantees.
• No mandatory technical standards: There are multiple valid methodologies, but no unified criteria on how digital evidence must be presented or justified.
• Problems proving origin and chain of custody: If the secure handling of evidence is not strictly proven, it may be excluded from the case.
• Difficulty identifying the perpetrator: Linking an offense to a specific person based on an IP address or device requires a thorough analysis ruling out impersonation or other scenarios.
• Complexity in seizure and storage: Digital evidence can be deleted, corrupted, or degraded if not preserved quickly and professionally.

Beyond these challenges, frequent mistakes in judicial practice directly affect the validity of digital evidence. Some courts still confuse digital evidence with printed screenshots, omitting the need to analyze the original file. In other cases, they fail to properly assess the chain of custody, or give more credibility to police reports without technical backing, even though Spanish criminal procedure law does not grant them automatic presumption of truth.

These technical misunderstandings can lead to invalid evidence being accepted or valid evidence being excluded due to procedural flaws. The intervention of a certified forensic IT expert is therefore essential—not only to provide technical rigor, but to ensure compliance with applicable legal standards.

All of these factors explain why digital evidence requires highly qualified professional intervention. In particular, the role of the certified forensic IT expert is essential to ensure that the evidence presented is valid, understandable, and resistant to challenge in court.

Examples of relevant case law

In recent years, several court rulings have addressed the validity and limits of digital evidence, highlighting the importance of guarantees in its collection and the need for proper expert intervention. Below are four significant examples:

• • SAP Málaga 438/2017, July 19: This case involved threats on Twitter. The court upheld the appeal due to lack of technical guarantees proving the origin, authorship, and authenticity of the messages.

    “An expert analysis is essential to identify the true origin of the communication, the identity of the parties, and the integrity of the content.”
    View ruling (PDF)

• • SAP Almería 221/2018, May 2: The court examined alleged threats via Instagram. The defendant was acquitted due to lack of technical evidence proving the origin, authorship, and integrity of the message.

    “An expert analysis is essential to identify the true origin of the communication, the identity of the parties, and the integrity of the content.”
    View ruling (PDF)

• STS 300/2015, May 19 (Criminal Division): The Supreme Court analyzed the evidentiary value of a conversation on Tuenti between a minor and a witness, stressing the need to apply strong guarantees when admitting this type of communication.

  “An expert analysis is essential to identify the true origin of the communication, the identity of the parties, and the integrity of the content.”
  View ruling (PDF)

If you need professional assistance with digital evidence, you can explore our specialized services: