Digital evidence is information stored or transmitted in electronic form that can be used to establish facts in an investigation or legal matter. Almost every modern dispute leaves a digital trail, and how that evidence is handled can mean the difference between facts that stand up in court and information that is lost forever.
Messages, emails, photographs, call logs, cloud backups and location data are now routinely examined in matters from fraud and employee misconduct to divorce and criminal defence. Because digital evidence can be altered or deleted in seconds, the way it is collected and preserved matters as much as what it contains.
What Is Digital Evidence?
Digital evidence is any data created, stored or communicated by electronic devices. Common examples include:
- Emails and instant messages, including WhatsApp and other chat applications
- Call logs, contact lists and voicemail
- Photographs, videos and audio recordings
- Documents and files stored on computers and servers
- Internet browsing history and search records
- Social media posts, messages and account activity
- Cloud storage files and backups
- GPS and location data from phones and vehicles
- Metadata — the hidden timestamps and usage records attached to files
Metadata is often as valuable as the files themselves: it can show when a document was created, modified or last opened, and on which device.
Why Digital Evidence Matters
Digital evidence can confirm or contradict statements, place a person at a location, reconstruct timelines and expose hidden communications or assets. In South Africa it is regularly used in civil litigation, criminal proceedings, labour disputes and internal corporate investigations, provided it is obtained and handled correctly.
Unlike a paper document, digital data is volatile — switching a device on, opening files or updating software can overwrite or destroy evidence. South Africa's Protection of Personal Information Act (POPIA) governs how personal information, including evidence, may be collected and processed, another reason a lawful, professional approach is essential.
Common Scenarios Involving Digital Evidence
Digital evidence frequently arises in matters such as:
- Fraud, theft or financial misconduct in a business
- Employee data theft or breaches of company policy
- Cybercrime such as hacking, account compromise or online harassment
- Matrimonial and domestic matters
- Criminal defence, where device data may support a version of events
- Insurance claim investigations
- Civil litigation and litigation support for attorneys
How Digital Evidence Is Handled Professionally
Proper handling protects the integrity and admissibility of evidence, and typically follows several stages.
Identification and Preservation
The investigator identifies relevant devices, accounts and data sources and secures them so nothing changes. This may mean isolating a phone from the network rather than searching a device on the spot.
Forensic Acquisition
Examinations are performed on forensic copies, not originals. Using specialist tools, the examiner creates a bit-for-bit image of the device, leaving the original untouched so the analysis can be repeated and verified.
Examination and Analysis
The forensic copy is searched for relevant communications, files, images and activity records. Deleted data can often be recovered, although this depends on the device, how much it has been used since deletion and whether it is encrypted.
Documentation and Chain of Custody
Every step is documented: who collected the evidence, when, how it was stored and who examined it. A clear chain of custody, supported by a written report, allows the evidence to be scrutinised and, where necessary, presented in court or to the South African Police Service.
Practical First Steps You Can Take
- Stop using the device in question — do not keep opening files or apps to check them.
- Do not factory reset, delete messages or attempt a cleanup; this can destroy recoverable data.
- Keep devices, SIM cards and storage media secure and powered down where appropriate.
- Save relevant account details and passwords, but avoid repeated failed login attempts that may trigger lockouts.
- Engage a professional early — delayed preservation is one of the most common reasons evidence is lost.
For more plain-language guides on investigations and digital forensics, return to our Knowledge Centre.
Digital evidence often decides cases, but only when handled correctly from the start. Careful preservation and a professional examination give evidence the best chance of being found, understood and relied upon.