Common Digital Evidence Mistakes

What most often damages digital evidence before an examiner is ever called, and what to do instead. Adapted from the original evestigate.com library, with collection and scope limits clarified October 7, 2026.

Electronic information can be relevant evidence. Its usefulness depends on the question, lawful authority, source, collection method and ability to explain what changed or was omitted. A matter-specific source plan identifies the records that may answer the question and the limits of each source.

Mistake #1: Treating a casual copy as a documented collection

An IT employee may be an appropriate collector when trained, authorized and equipped for the task. The distinction is the method and documentation, not whether the collector works inside or outside the organization. Opening a file, printing it or saving a new copy can change timestamps or omit message headers, versions, attachments and application context. That does not automatically make all collected information inadmissible, but the changes may limit the conclusions it supports.

Record the source, account or device, collection time, method, filters and transfers. Retain available original formats and explain integrity checks. If data has already been copied, preserve that copy and document the actions taken; an examiner can assess what remains and whether an additional acquisition is useful. Recovery of overwritten or unretained artifacts is not assured. Counsel evaluates legal duties and the consequences of a collection issue.

Mistake #2: Delaying preservation because analysis is uncertain

Preservation and examination are different decisions. Relevant logs can expire, devices can be reused and cloud accounts can lose accessible content when retention or licenses change. A limited preservation step may retain sources while the parties decide whether broader analysis is proportionate. Do not wait for certainty about trial before discussing material that may disappear.

A disk image can preserve acquired sectors, but a live system or cloud export may require a different method and will have different limits. Document the data obtained and collection period rather than call every acquisition a complete snapshot. Estimate acquisition, processing, analysis and reporting separately. Cost and urgency depend on actual sources, access and work.

Mistake #3: Choosing a scope that cannot test the disputed facts

Collecting too little can omit the source needed to test an explanation; collecting everything can add unnecessary cost and privacy exposure. Begin with the conduct, time period and systems in question. A departing employee's messages, file activity and sharing logs may answer different parts of the same question. A financial dispute may require structured transaction data and the software rules that produced it.

Use an initial source map, agreed custodians and justified date ranges. State the sources excluded, sample selection and conditions for expanding the work. A targeted export is not automatically a complete device examination. Tool support varies by version, platform and artifact, including UNIX, Mac and mainframe sources. Ask the examiner to explain the proposed coverage and validation.

Mistake #4: Giving preservation instructions without an operational plan

Counsel determines preservation duties and issues appropriate instructions. Technical owners identify retention settings, scheduled deletion, device replacement, backup rotation and account lifecycle events that could affect the relevant sources. Record what has already happened and which person can authorize and implement each action.

Do not reflexively power down, disconnect or reconfigure a device. Those actions can lose accessible volatile data or disrupt essential operations, while continued use can also change evidence. Obtain source-specific handling instructions. Life safety and urgent containment take priority. Keep a log of response actions so later analysis can distinguish them from the activity being investigated.

Mistake #5: Selecting a team without examining its proposed work

Ask who will perform the acquisition and analysis, what relevant experience they have, which tools and versions will be used, and how they will check important results. A credential or a tool name alone does not establish suitability for the particular system. Request a scope that separates collection, processing, interpretation and reporting, with assumptions and decision points.

Agree the deliverables: an acquisition inventory, handling records, relevant native data, a source-supported chronology or report, and expert assistance if retained. The report should identify material collection gaps and alternative explanations. Do not rely on an unnamed case, an asserted universal success rate or a promised court outcome to select the examiner.

A practical first discussion

Prepare the question, deadline, available sources, authorized contacts and actions already taken. The goal is a proportionate plan that preserves useful material and makes the result explainable. Admission and weight remain decisions for the court, and legal scope belongs with counsel.

Technical background: NIST forensic-method guidance and its scope (opens in a new tab). NIST’s publication concerns integrating forensic techniques into incident response; it is not universal legal advice. For service and client questions, see Digital Forensics FAQ.