Digital evidence has to clear the same hurdles as any other: authentication, relevance, a hearsay exception where one is needed, and expert testimony that satisfies Rule 702. What is distinctive is how it is authenticated — through documented acquisition, hash verification, and an unbroken account of handling.
Authentication is the hurdle that actually gets litigated
Rule 901 requires evidence sufficient to support a finding that an item is what its proponent claims. For a paper contract, a witness saying "that is the agreement I signed" usually does it. For a disk image, an email, or a chat log, the equivalent showing has to be constructed.
What constructs it is process: an acquisition performed with a documented method, a hash value recorded at acquisition and re-verified before analysis, and an unbroken chain of custody. Those three together let a witness testify that what the court is looking at is what was seized, and that nothing changed in between.
Rules 902(13) and 902(14) also allow certain electronic records and copies verified by hash to be self-authenticating with a qualified person's certification, which can avoid calling a live witness. This is underused — it is available precisely when the acquisition was done properly, which is another reason to do it that way.
Hearsay, and why much of it is not
A great deal of digital evidence is not hearsay at all, and the analysis is worth getting right because it is often argued incorrectly.
Machine-generated records — server logs, GPS data, automatic timestamps — are generally not hearsay, because there is no human declarant making an assertion. The reliability question about them is authentication, not hearsay.
Human communications in emails and messages are statements, and need an exception or an exclusion. In practice most are covered by the business-records exception, by party-opponent admission, or by being offered for something other than their truth.
Business records require the foundation the rule specifies — made at or near the time, by or from someone with knowledge, kept in the regular course. Data pulled from a system is not automatically a business record; someone has to establish how the system captures and retains it.
The expert layer
Where a witness will explain what artifacts mean, Rule 702 and the Daubert gatekeeping analysis apply. Digital forensics satisfies the reliability factors comfortably as a field; challenges succeed against particular engagements — an unverified acquisition, a method the report does not describe well enough to reproduce, or an opinion that reaches past the artifacts.
Where evidence is actually lost
Almost never on a subtle legal point. It is lost at collection: a screenshot with no provenance, files copied by an administrator with no record, a device examined without write-protection, or an original that was reimaged before anyone thought to preserve it.
The practical rule follows from that. Admissibility is decided by what happens in the first days, usually before a lawyer is involved, and it cannot be repaired afterwards by a better brief.
From our work
Need this looked at properly?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.