The discipline began in criminal casework — indecent images, computer misuse, drug-supply conspiracies — and the tooling and case law grew up around that world. What has changed since is not the tooling but the scope. Digital evidence is now a routine feature of commercial litigation, employment tribunals, family proceedings and regulatory investigations. In each forum, the value of the evidence rises or falls on how early it was preserved and how tightly the examination was scoped.
Where digital forensics shows up in UK practice
| Setting | Typical dispute | Where the evidence lives |
|---|---|---|
| Commercial | Fraud, IP theft, breach of restrictive covenants, disputed contract formation over messaging. | Corporate email, endpoint devices, Microsoft 365 / Google Workspace audit logs, WhatsApp Business. |
| Employment | Misconduct, data exfiltration on exit, harassment allegations, disputed dismissal. | Endpoint devices, mailbox and OneDrive/Drive exports, badge access, MDM logs, messaging apps. |
| Family | Coercive control, disputed communications between parents, hidden assets, safeguarding. | Personal phones, iCloud/Google account exports, social media, financial-app history. |
| Regulatory | SRA, FCA, ICO or HSE matters where preservation and disclosure are scrutinised. | Firm-wide mailboxes, chat platforms, case-management systems, cloud tenants. |
| Public inquiry | Historic decision-making, contested timelines, disclosure to counsel. | Archived mailboxes, ministerial WhatsApps, government file-share tenants. |
The common thread
Across all of these forums the same three failures recur: preserving too late, scoping too broadly, and treating screenshots as evidence. Preservation late in the day loses material that the platform has already rotated out. Broad scoping produces expensive reports that do not engage the pleaded issues. Screenshots collapse the moment the opposing side asks for the native file — because a screenshot cannot answer the questions a native message database can.
In every one of these settings, the decisive moment is not the trial. It is the day the duty to preserve arises — and whether anyone treated that day as the emergency it was.
What good practice looks like across settings
- Preserve on the day the dispute is in reasonable contemplation, not when disclosure is ordered.
- Instruct an independent examiner early, even if only for scoping advice — the fee is small relative to the cost of missed material.
- Frame the instruction on the questions the tribunal needs answered, not on the device.
- Insist on native-format evidence — the message database, the mailbox export, the disk image — not screenshots and printouts.
- Document the chain of custody from acquisition onwards, in a form that can be handed to the court without further work.
Where the choice of forum changes the approach
The forum affects the standard the report must meet (CPR Part 35, CrimPR Part 19, FPR Part 25), the disclosure obligations that attach to the underlying material, and the tolerance for late-served evidence. It does not change the technical work — the extraction, the hashing, the analysis — because that work has to be defensible on the same principles wherever it lands. What changes is the frame around it, and the frame is set by the instructing solicitor at the point of engagement.
Frequently asked questions
No. A single-device instruction on a well-framed question — 'did this message exist, and on what date?' — is often the most cost-effective piece of evidence in a small matter. The economics of scope apply at every scale.
As soon as litigation is in reasonable contemplation. Early instruction may consist only of scoping advice and a written preservation direction to the client — the full analysis can wait, but preservation cannot.
Yes. FPR Part 25 mirrors CPR Part 35 on the expert's duty to the court and on the required declarations. Family courts are increasingly used to receiving Part 25-compliant forensic reports on phones and messaging accounts.
The material still needs to be preserved and examined to a defensible standard, because the regulator will scrutinise the process. In our experience the same rigour is a good idea, whether or not court proceedings ever follow.
It can, but the letter of instruction should say so at the outset, and the report should be framed to meet the highest applicable standard. Re-scoping a report for a second forum after service is expensive and often produces a weaker document.