Readiness note. This is a private training programme. It builds knowledge and readiness. It does not grant any official certificate, licence, or government recognition, and it does not create any affiliation with a regulator or an agency. On passing, learners receive a Record of Completion.
Mission briefing
This lesson introduces electronic evidence. You will learn what it is, how it is made, where it is stored, and why it matters in legal work. You will also learn why this kind of evidence is easy to damage, and why careful handling is so important.
Focus: understand the idea of electronic evidence before you learn how to collect and protect it in later lessons.
Learning objectives
By the end of this lesson, you will be able to:
- Define electronic evidence and explain why it matters.
- Name the four main types of electronic evidence.
- List common public and private sources of this evidence.
- Explain, in simple terms, why integrity and lawful access matter.
Why this matters to you. Officers collect this evidence. Lawyers test it, for either side. Students need the basic ideas before the case law. Company teams hold the data and answer lawful requests for it. The rules in this course are the same for all four.
1. What is electronic evidence?
Electronic evidence is any information that is stored or sent in electronic form. Examples are emails, text messages, social media posts, photos, videos, and files on a device.
People can create this evidence on purpose. They can also create it without knowing. It can sit on many kinds of devices, such as computers, phones, and tablets.
A court can use this evidence to prove or disprove a fact. For example, a message may show that two people spoke on a certain day. A photo may show where a person was at a certain time.
Evidence is not the same as intelligence. Intelligence is information that guides an inquiry. Evidence is material that can be put before a court, so it must meet the court's rules. The same evidence can help the prosecution or the defence. Unit 1A (How Courts Treat Electronic Evidence) explains how courts test it.
2. Why it is hard to handle
Electronic evidence is powerful, but it is fragile. Three problems are common:
- It can be deleted or changed easily. A single click can remove a file.
- It can be spread across many places. Data may sit on a phone, in the cloud, and on a company server at the same time.
- It can be complex. It may be hard to read and hard to explain in court.
Because of these problems, whoever collects this evidence must protect its integrity. Integrity means the evidence stays complete and unchanged from the moment it is collected.
Electronic evidence has a life cycle: identify it, preserve it, collect it, examine it, and present it. A mistake at any stage can weaken every later stage.
3. The four main types
Electronic evidence falls into four groups:
- Data — the digital information itself: text, images, video, audio, and emails.
- Metadata — information about data: when it was made, who made it, and how it was changed.
- System logs — records of activity on a device or network, such as logins, file access, and website visits.
- Device contents — everything held on a device, such as a computer, phone, or tablet.
This evidence can help establish many facts, such as a person's identity, the time and place of an event, the content of a conversation, or the existence of an agreement.
4. Where it comes from
Sources fall into two broad groups.
Public or open sources are open to anyone, within the law:
- Government websites and public records.
- Public databases.
- Social media posts that are public.
- Open data sets published by governments or bodies.
- News archives.
- The Internet Archive ("Wayback Machine"), which stores old versions of web pages.
- Public research papers.
- Public forums and discussion boards.
Private service providers hold data about their users. Access almost always needs lawful authority:
- Cloud storage (for example, drive and backup services).
- Social media platforms.
- Email providers.
- Messaging apps.
- Internet service providers (ISPs).
- E-commerce platforms.
- Ride-sharing and food-delivery apps.
- Banks and financial institutions.
- Website and app developers.
Important. Whoever takes evidence from a private provider must respect privacy law, the provider's terms, and user rights. Unauthorised access can harm the case and can break the law. Always get proper authority first. Lessons 2 to 5, on private service providers and data requests, cover these providers in detail.
5. How different systems treat it
Several international texts help countries treat electronic evidence in a similar way. They do not all bind every country:
- UNCITRAL model laws on electronic commerce and electronic signatures help countries recognise electronic records. A model law applies in a country only when that country writes it into its own law.
- The Budapest Convention (Council of Europe) helps countries cooperate on cybercrime. It binds only the countries that have joined it. More than 80 have joined; many have not.
- The United Nations Convention against Cybercrime was adopted in December 2024. By October 2026, 95 states had signed it, but it was not yet in force.
- ISO/IEC 27037 gives guidance on handling digital evidence. It is a standard, not a law.
Always check which of these apply in your country. Your country note says so where we have checked it.
The common thread is simple: evidence must be authentic (it is what it claims to be), its integrity must be protected, and it must be collected through a lawful, documented process.
Activity — analyse a case
Case study: Unmasking the cyberstalker.
Ms Anita, a marketing executive, began to receive threatening messages across her social media, email, and messaging accounts. The sender used anonymous accounts to hide their identity.
Think about these questions:
- Which types of electronic evidence might exist in this case? (Think data, metadata, system logs, device contents.)
- Which sources might hold that evidence — public, private, or both?
- Why would lawful authority be needed before asking a provider for the sender's account data?
There is no single right answer. The goal is to connect the ideas in this lesson to a real situation.
Conclusion
You have completed this lesson. You now know:
- What electronic evidence is and why it matters.
- The four main types.
- Where it comes from, in public and private sources.
- Why integrity and lawful access are central to every step.
The next lessons look closely at private service providers and at how data is requested and disclosed within the law.
Complete the Learning Check for this lesson before you move on.