Emails, Chats, CCTV, Cloud Files, and Metadata: Building an Admissible Electronic Evidence Record

A screenshot is a lead, not automatically a finished exhibit.

A screenshot records what appeared on a screen. It may leave out the source file, metadata, account information, surrounding messages, timestamps or attachments needed to explain what happened.

The Rules on Electronic Evidence provide methods for proving authenticity of electronic documents and place the burden of proving authenticity on the party seeking to introduce them. The rules also address audio, photographic, video, and ephemeral electronic communications.

Keep the screenshot, but also preserve the native or source material where reasonably available. Identify the account, export, file, device or system record and the person who can explain its origin.

Preservation should protect context, not just content.

Read a message with the surrounding conversation. Check the CCTV footage before and after the event, the spreadsheet’s working formulas, and the email’s attachments and routing information. An isolated copy may omit information needed to understand it.

The Rules on Evidence recognize the importance of completeness. When part of an act, declaration, conversation, writing, or record is introduced, other portions necessary to understand the subject may also become relevant.

Preserve relevant surrounding material where feasible. For email, retain the message and attachments; for chats, the surrounding thread; for CCTV, sufficient footage before and after the event. For cloud records, keep the audit history or system data that can explain who acted and when.

Authentication begins with the source and the witness.

For each item, ask where it came from and who can competently explain it.

The amended Rules on Evidence permit proof of private-document authenticity through a witness who saw its execution, evidence of the genuineness of the maker's signature or handwriting, or other evidence showing due execution and authenticity. The Rules on Electronic Evidence separately recognize methods demonstrating the integrity and reliability of electronic material.

The appropriate witness may be the records custodian, IT administrator, system user or employee who took part in the communication. Identify who actually created, sent, received, maintained or extracted the record, rather than relying on an executive who only received a case summary.

Business records can be powerful when the system is understood.

The 2019 Rules on Evidence recognize a hearsay exception for records of regularly conducted business activity where the prescribed foundation is shown, including that the record was made at or near the relevant time from information supplied by a person with knowledge and kept in the regular course of business, with the required foundation established through a custodian or other qualified witness.

Check the operational records as well. ERP entries, logs, invoices, transaction histories, access records and regularly generated reports may provide contemporaneous evidence of what happened.

Confirm how the system works. Who enters and edits data? Is there an audit trail? Which timestamps are automatic and in what timezone? How are records exported? The witness needs enough knowledge to explain the relevant process.

CCTV, recordings, and chat evidence require their own foundations.

The Rules on Electronic Evidence address audio, photographic, and video material and contemplate identification, explanation, or authentication by the person who made the recording or another competent person who can testify to its accuracy. Ephemeral electronic communications may likewise be proved through a participant or person with personal knowledge, subject to applicable evidentiary rules.

The treatment of electronic material depends on the proceeding and the governing evidence rules. The Rules on Electronic Evidence state their scope for civil, quasi-judicial and administrative cases; criminal admissibility must be analyzed under the applicable rules and jurisprudence. A screenshot is not automatically admissible or inadmissible merely because of its format.

In a civil dispute, identify the witness and supporting foundation when collecting the evidence. Do not wait until trial to find out who can authenticate an old CCTV export.

Metadata is valuable because it can test the story behind the document.

Metadata can help establish dates, authorship information, file history, device or application data, or other characteristics associated with electronic records. Its significance depends on the technology and factual issue, so metadata should not be treated as infallible proof.

Avoid destroying useful information while preparing review copies. Converting files to screenshots or PDFs may make them easier to read but remove information contained in the source version.

Preserve an original or native copy where appropriate, use working copies, record the collection method and limit alteration. Forensic assistance may be needed where deletion, manipulation, unauthorized access or authorship is disputed. It is not required in every case.

The evidence record should be built before memories and systems change.

I suggest keeping an evidence index with the item, source, custodian, relevant date, original location, preservation method, possible witness and fact the item may prove.

Prepare the witness to explain what the witness personally knows. A litigation summary does not supply personal knowledge. The rules confine testimony to facts known through the witness’s own perception, subject to the applicable rules and exceptions.

The file should show how the event was recorded, how the record was preserved and who can competently explain it. That allows counsel to assess the foundation for admissible proof.

Preserve provenance and lawful access

Collection must respect lawful access, privacy and other applicable restrictions, including the Anti-Wiretapping Act where relevant. Authority to preserve business records is not unrestricted authority to access an employee’s private account or device. Record how material was obtained and preserve the source without altering its context.