The legal and evidential framework. The rules that shape how digital evidence is gathered, handled and used, in outline.

The ACPO principles. The ACPO Good Practice Guide for Digital Evidence (version 5, 2012) sets four principles: no action should change data that may later be relied on in court; where original data must be accessed, the person doing so must be competent and able to explain the implications; an audit trail of all processes should be kept so that an independent third party could repeat them and reach the same result; and the person in charge is responsible for ensuring the law and the principles are followed. Written for the police, they are widely treated as the standard for digital evidence work generally, and our method follows them. There is no such thing as ACPO accreditation.

The Forensic Science Regulator. The Forensic Science Regulator Act 2021 put the Regulator on a statutory footing, and its statutory Code of Practice has been in force since 2 October 2023. It applies to forensic science activities for the criminal justice system in England and Wales, including digital examination, and it builds on ISO/IEC 17025 accreditation. Reports for criminal proceedings there must state whether the work is covered by the Code and whether it complies. The Code does not govern civil, employment or family work, and it does not apply in Northern Ireland.

Expert reports. In civil proceedings in England and Wales, CPR Part 35 gives an expert an overriding duty to help the court on matters within their expertise, above any obligation to the party paying them, and Practice Direction 35 prescribes the content of a report, including the statement of truth. In criminal proceedings, Part 19 of the Criminal Procedure Rules requires opinion that is objective, unbiased and within the expert's expertise, with prescribed contents and declarations. In Northern Ireland, the Rules of the Court of Judicature and the practice directions apply, and incorporate the same principles of independence, known from the Ikarian Reefer case.

Weight and admissibility. Documents and computer records are generally admissible in civil proceedings, with the argument going to their weight; in criminal proceedings the hearsay provisions of the Criminal Justice Act 2003 apply, and the courts have presumed computers to be working properly unless shown otherwise, a presumption the Ministry of Justice consulted on in 2025 and which may be reformed. In every setting, a verified image, an intact chain of custody and a repeatable method are what defend the weight of digital evidence.

Unauthorised access. Section 1 of the Computer Misuse Act 1990 makes it an offence to cause a computer to perform a function with intent to secure access to data, knowing the access is unauthorised. It applies throughout the UK, and it is why authority is a condition of every examination.

Interception. Section 3 of the Investigatory Powers Act 2016 makes it an offence to intercept a communication in the course of its transmission without lawful authority, which can include reading messages held on a system for collection. Examining stored data on a device an organisation owns, on a lawful basis, is different from accessing another person's live accounts, which we do not do.

Personal data. Under UK GDPR and the Data Protection Act 2018, an examination needs a lawful basis, usually legitimate interests or the establishment, exercise or defence of legal claims, and should be proportionate and minimised; we act as the client's processor. The ICO's 2023 guidance on monitoring workers expects workplace examinations to be necessary, proportionate and not routinely covert, and it is under review following the Data (Use and Access) Act 2025. Workplace privacy also engages Article 8 of the European Convention on Human Rights, as the Grand Chamber held in Barbulescu v Romania (2017).

Family matters. In Tchenguiz v Imerman [2010] EWCA Civ 908 the Court of Appeal held that taking a spouse's confidential documents without authority is a breach of confidence; the lawful route is disclosure through the court.

Preservation. Once litigation is in contemplation, a party must take reasonable steps to preserve relevant documents, which include electronic and deleted material; Practice Direction 57AD sets this out for the Business and Property Courts in England and Wales, with Practice Direction 31B and the common law elsewhere, and Northern Ireland's discovery rules to similar effect. A device wiped or reimaged after that point can harm the case it concerns.