What digital forensics actually changes in a case
Worked examples for attorneys — what the digital evidence appeared to show, what an independent examination found, and the principle behind it. Body-worn and surveillance video, phone extractions, cell-site records, deleted data, and devices declared unreadable. Written to be useful before you have a case that needs it.
Deleted files in an employee-theft prosecution: what the artifacts proved, and what they couldn't
A company discovered roughly $185,000 had moved over eight months to a vendor account management didn't recognize, approved through the financial controller's user account. Shortly after questions started, spreadsheets, PDF invoices, and emails disappeared from the controller's work laptop. Charges followed for theft, computer crime, and falsification of business records.
Read the case studyDeleted texts and edited screenshots: the one-hour timestamp error that moved a message before the order took effect
A defendant faced harassment, stalking, and protection-order violation charges. The complaining witness provided screenshots of threatening messages appearing to come from the defendant's number, and said he deleted his copies to conceal them. He denied sending the threats, said the screenshots had been edited, and said some messages predated the order entirely.
Read the case studySurveillance video deleted after a preservation letter: proving spoliation without recovering the footage
A customer sued a private security company and a shopping center alleging excessive force by security officers in a parking garage. Plaintiff's counsel sent a preservation letter two days after the incident requesting all video, access-control records, incident reports, and communications. Three months later the defendants said the relevant video no longer existed because the system overwrites after 30 days.
Read the case studyThe video played at trial wasn't the video in discovery: PowerPoint, transcoding, and normalized audio
In a felony assault prosecution the State intended to prove the defendant threatened someone outside a nightclub. Rather than presenting the original exported surveillance file, the prosecutor embedded video in a PowerPoint containing selected segments, captions, enlarged stills, a shortened audio track, and a timeline. During trial preparation the defense noticed the PowerPoint audio sounded louder and clearer than the discovery copy, and the video looked shorter and smoother.
Read the case study"No other footage exists": what the body-camera audit logs actually showed
A driver was charged with assaulting a police officer during a traffic stop. The officer's report said the driver exited aggressively and reached toward him; the driver said he was pulled from the car without warning. Three officers were present. The prosecution produced one body-camera video, a partial dash-camera recording, and one audio-only recording. The defense later learned all three officers had been assigned functioning body cameras.
Read the case studyA phone recording of a security screen, six generations from the event
During a robbery prosecution a store employee recorded a security-monitor playback on a personal phone. The original surveillance system was later overwritten. The prosecution offered the phone recording — 22 seconds of a longer event, appearing to show someone in clothing similar to the defendant's.
Read the case studyA converted MP4 broke the speed calculation: variable frame rate, duplicated frames, and 1.8 seconds that didn't exist
In a vehicular-homicide case a roadside business gave police a proprietary surveillance export. A detective couldn't play it on a standard computer, converted it with free online software, saved the result as an MP4, and deleted the proprietary export from the working folder. The converted video appeared to show the defendant's vehicle crossing the center line.
Read the case study"Download all" didn't mean all: what an evidence platform gives the defense, and what it keeps
A prosecutor uploaded digital discovery — police videos, photographs, audio, reports, mobile extractions, surveillance clips — to a commercial evidence-sharing platform and sent defense counsel a secure link. Counsel downloaded everything visible. What the platform also held, and did not include in that download, was the evidentiary record around the files.
Read the case studyThe chain of custody started at upload — everything before it rested on testimony
An off-duty officer witnessed a fight and recorded part of it on a personal phone, then uploaded the video to a police evidence platform through a mobile application. The prosecution offered the platform copy at trial. The defense asked whether the officer's original phone file still existed. It did not.
Read the case studyPersuasive and technically weak: a reposted protest video with no original, no audio, and synthetic frames
A person was charged with throwing an object at police during a protest. The prosecution relied on a 14-second video reposted on social media. The account that originally posted it had been deleted. The available version carried a text overlay, background music, cropping, slow motion, a zoom effect, and a username watermark.
Read the case studyA screen recording was the only surviving record of the conversation — what made it hold up
In a civil fraud case the plaintiff presented a screen recording showing a messaging conversation with the defendant, stating the defendant later deleted the messages. The phone had since been replaced and was unavailable. The screen recording was the only surviving representation of the conversation.
Read the case studyThe drone video looked decisive until the flight logs put the camera 70 feet away
Two landowners disputed whether construction equipment had crossed a property boundary. One party submitted drone video showing equipment near a fence line. The exported video contained no visible coordinates, and the original drone memory card had been reformatted.
Read the case studyThe muted seconds contained an officer saying "he may not be able to hear us"
In a resisting-arrest case defense counsel received a redacted body-camera file. The image was blurred during portions involving bystanders and some audio was muted to protect private information. The defense noticed the muting overlapped the moment when the defendant allegedly refused an order.
Read the case studyAbout these examples: the scenarios below are illustrative. They are built to show how digital evidence is examined, challenged, and presented in court — they are not accounts of individual client matters, and client work is confidential. The techniques, failure modes, and principles described are real.
Twenty questions to ask about every digital exhibit
Every case study on this page traces back to one of these going unasked. Terms you don't recognize are defined in the evidence terminology guide.
- What is the original source of this file?
- Is this the original, a forensic copy, an export, a platform preview, a redacted version, or a demonstrative exhibit?
- Who created the file being offered, and on what system?
- What software processed it between the event and the courtroom?
- Was the codec changed?
- Was the audio normalized, filtered, muted, or enhanced?
- Were frames duplicated, dropped, interpolated, or converted?
- Is the file complete, or is it an excerpt?
- Does the file retain its original metadata?
- Is GPS or device-location information available?
- Was the native file preserved?
- Were cryptographic hashes calculated, and by whom?
- Does the discovery copy match the evidence-system master?
- Did a third-party platform generate a derivative preview?
- Were any files replaced, redacted, reclassified, or deleted?
- Are platform audit logs available?
- Is the timing based on embedded metadata, a visible display clock, server time, or witness recollection?
- Can the evidence establish the person responsible, or only the account or device involved?
- What information is missing?
- What conclusions can this evidence not reliably support?
Not sure whether your case needs an examiner?
That's what the scoping call is for. Tell us the case, the device, and the deadline, and we'll tell you what's realistically recoverable and whether it's worth the cost. Free, and no obligation.