The chain of custody started at upload — everything before it rested on testimony
The situation
An off-duty officer witnessed a fight and recorded part of it on a personal phone, then uploaded the video to a police evidence platform through a mobile application. The prosecution offered the platform copy at trial. The defense asked whether the officer's original phone file still existed. It did not.
What the other side said the evidence showed
That the platform copy was reliable evidence with a documented chain of custody — which was true from the moment of ingestion, and only from that moment.
A cloud platform can protect evidence perfectly from the second it arrives and still cannot restore what was discarded on the way in.
Mobile evidence-upload applications do more than transfer a file. They re-encode the video, generate a thumbnail, extract selected metadata, create a platform asset identifier, calculate a server-side hash, and frequently remove private device metadata — which is a deliberate privacy feature when the source is someone's personal phone. The resulting object is trustworthy as a platform record. It is not identical to what the camera produced.
The single most consequential loss is time. The platform retains an upload timestamp, and upload time is not recording time. When the original EXIF or QuickTime creation metadata is gone and the phone file has been deleted, nothing in the exhibit establishes when the recording was made. That fact has to come from the witness.
This is why the chain-of-custody question has to be asked in two halves. After ingestion, the platform documents everything. Before ingestion, the record is the officer's testimony — and if the original file was not preserved, testimony is the only thing holding that half of the chain.
What the examination involved
Reconstructed the acquisition path
Personal phone camera, to mobile evidence-upload application, to encrypted transfer, to the cloud evidence platform, to platform processing, to prosecutor download — identifying which step each characteristic of the exhibit came from.
Established what the upload application does to a file
Re-encoding, thumbnail generation, selective metadata extraction, asset identifier assignment, server-side hashing, and removal of private device metadata.
Catalogued the missing original metadata
Full EXIF or QuickTime metadata, original GPS coordinates, phone model, camera orientation data, file-system timestamps, and the original local filename — none present in the platform version.
Read the platform audit records
Account used for upload, device session, upload completion, processing event, hash at ingestion, subsequent access, and export actions — a complete record forward from ingestion.
Separated what testimony could establish from what it couldn't
The officer could testify to recording the event, that the video represents what was seen, that it was uploaded shortly after, and that it wasn't intentionally edited. Exact time, location, completeness, and generation remained open questions.
What the examination found
- The exhibit was a re-encoded derivative created by the upload application, not the file the camera wrote
- Original EXIF/QuickTime metadata, GPS coordinates, device model, orientation, and file-system timestamps were absent
- The platform's timestamp recorded upload, not recording — and the two were not established to be close together
- The original phone file had not been preserved and was unavailable
- Platform audit records documented the chain thoroughly from ingestion forward
Outcome
The prosecution could show a documented platform chain from upload onward. The defense could accurately argue that everything before upload — when it was recorded, where, whether it was complete, whether it had been edited on the device — rested on the officer's account rather than on the file.
Takeaways for counsel
- Ask whether the original device file was preserved. If it wasn't, half the chain of custody is testimony, and should be examined as testimony.
- Never treat a platform timestamp as a recording time. Upload time is the only thing it establishes.
- Upload applications strip device metadata by design when the source is a personal phone. That is a privacy feature with an evidentiary cost, and the cost is real.
- Ask what the platform's processing pipeline does on ingestion — re-encoding, metadata extraction, hashing — and get it in writing rather than assuming a straight copy.
- Where personal devices are used for evidence, ask about the department's policy on preserving the original. Its absence is itself a fact.
Services involved
Have a case that turns on digital evidence?
Tell us the case, the device, and your deadline. The scoping call is free, and we'll tell you honestly whether an examination is worth it.
Appointed counsel: see our Colorado public defender program.
More case studies
Deleted files in an employee-theft prosecution: what the artifacts proved, and what they couldn't
Deleted texts and edited screenshots: the one-hour timestamp error that moved a message before the order took effect
The video played at trial wasn't the video in discovery: PowerPoint, transcoding, and normalized audio
This case study is illustrative. It is written to show how digital evidence is examined, challenged, and presented in court; it is not an account of any client matter, and any resemblance to a specific case is unintended. The techniques and failure modes described are real. Nothing on this page is legal advice, and no result is a prediction or guarantee of the outcome of any other matter.