Collecting Digital Evidence for Your Criminal Case

In many criminal cases — particularly domestic assault, uttering threats, criminal harassment, and sexual assault — the most important evidence is not physical. It is digital: text messages, social media conversations, call logs, photos, videos, voicemails, emails, and location data stored on your phone and in your online accounts.

This evidence can be the difference between a conviction and an acquittal. It can prove that the complainant’s account is inconsistent, establish your whereabouts, demonstrate the true nature of your relationship, or provide context that changes the meaning of an incident entirely.

But digital evidence is fragile. Messages can be deleted. Accounts can be deactivated. Platforms change their data retention policies. If you do not act quickly and methodically, critical evidence can be lost forever.

This guide explains what to collect, how to collect it, and how to get it to your lawyer in a format they can actually use.

The Golden Rule: Preserve Everything, Delete Nothing

The moment you are aware of criminal charges — or even that an investigation might be underway — stop deleting anything. Do not delete texts, photos, social media posts, voicemails, emails, or app data. Even if something seems embarrassing, irrelevant, or potentially harmful, do not delete it. Let your lawyer decide what is relevant and how to use it.

Deleting evidence after you know charges are pending can:

• Constitute obstruction of justice — a separate criminal offence
• Create an adverse inference at trial — the judge may assume the deleted material was harmful to your case
• Deprive your lawyer of evidence that may have been helpful in ways you do not anticipate

Preserve everything. Delete nothing.

What to Collect

1. Text Messages (SMS and iMessage)

Text messages are the single most important category of digital evidence in most criminal cases. They can establish timelines, reveal the complainant’s state of mind, contradict their account, and provide context for the events in question.

iPhone users:

• Screenshots: The simplest method. Open the conversation, scroll to the relevant messages, and take screenshots (press the side button and volume up simultaneously). Make sure each screenshot shows the contact name or phone number at the top of the screen and the date and time of the messages. Scroll through the entire relevant period and capture everything.
• iTunes/Finder backup: Connect your iPhone to a computer and create a full unencrypted backup using Finder (Mac) or iTunes (Windows). This preserves all message data, including deleted messages that may still be in the backup. Your lawyer or a forensic analyst can extract the messages from the backup file.
• Third-party extraction tools: Programs like iMazing (Mac/Windows) can export entire text conversations from an iPhone backup into PDF, CSV, or text format — complete with timestamps, contact names, and attachments. This produces a clean, organized record that is easy for your lawyer to review. iMazing can be downloaded from imazing.com and does not require jailbreaking your phone.

Android users:

• Screenshots: Same process — capture the contact name, date/time stamps, and message content.
• Google Messages backup: If you use Google Messages, your messages may be backed up to your Google account. Check Settings > Google > Backup.
• Third-party extraction tools: Apps like SMS Backup & Restore (available on the Google Play Store) can export your entire message history to XML files, which can be converted to readable formats. Dr.Fone is another option for exporting Android messages to your computer.

Critical: Always capture the full conversation thread — not just the messages you think are helpful. Cherry-picked messages can be challenged by the Crown. The complete thread provides context and credibility.

2. WhatsApp, Facebook Messenger, Instagram DMs, Snapchat, and Other Messaging Apps

Each platform has its own export process:

• WhatsApp: Open the conversation > tap the contact name > scroll down > “Export Chat” > choose “Attach Media” or “Without Media.” This generates a .txt file with all messages and timestamps. Email it to yourself.
• Facebook Messenger: Go to Facebook Settings > “Your Facebook Information” > “Download Your Information.” Select “Messages” and the specific conversations you need. Choose JSON or HTML format. Facebook will generate a downloadable file.
• Instagram DMs: Go to Instagram Settings > “Your Activity” > “Download Your Information.” Request a download that includes messages. Instagram will email you a link to download your data.
• Snapchat: Snapchat messages disappear by design, but your account data may still contain message logs. Go to Settings > “My Data” > “Submit Request.” Snapchat will email you a download link. Note: the content of expired messages is generally not recoverable, but the metadata (who you messaged, when, and how often) may be preserved.
• Telegram, Signal, and other encrypted apps: These vary. Check each app’s settings for export or backup options. Signal, in particular, does not support cloud backups by design — evidence must be captured via screenshots or local backup.

3. Call Logs and Phone Records

Your phone’s call log shows incoming, outgoing, and missed calls with timestamps. Screenshot or export this data for the relevant time period.

For a complete and authoritative record, you can request your call detail records (CDRs) from your phone carrier (Rogers, Bell, Telus, etc.). These records show every call and text with timestamps and duration, and they come directly from the carrier — making them difficult to challenge at trial. You can typically request these through your carrier’s website or by calling customer service. Note: carriers retain records for a limited period (typically 1-2 years), so request them promptly.

4. Social Media Posts and Activity

If the complainant posted on social media around the time of the alleged incident — or at any time that is relevant to the case — that content should be preserved. This includes:

• Posts, stories, and reels on Instagram, Facebook, TikTok, etc.
• Comments on posts
• “Check-ins” and location tags
• Profile changes (relationship status, bio updates)
• Photos and videos with metadata (timestamps, location data)

How to preserve social media:

• Screenshots with the URL visible (on a computer, this appears in the address bar)
• Web archive tools like the Wayback Machine (web.archive.org) — paste the URL to create a permanent archived copy
• Screen recordings — use your phone’s built-in screen recording feature to scroll through a profile, story, or post. This captures content that might be deleted before trial.
• PDF printing — on a computer, right-click the page and choose “Print” > “Save as PDF.” This preserves the content with the URL and date.

Important: Social media content is frequently deleted after charges are laid. Act fast. If the complainant deletes posts or deactivates their account, the evidence may be gone unless you have already preserved it.

5. Photos, Videos, and Voicemails

• Photos and videos stored on your phone may contain metadata (EXIF data) including the date, time, and GPS location where they were taken. This metadata can be critically important — for example, proving where you were at a particular time.
• Voicemails can be saved by pressing and holding the voicemail in your phone app and selecting “Share” or “Save.” On iPhone, voicemails can be shared as audio files via AirDrop or email.

6. Location Data

Your phone tracks your location constantly. This data can prove where you were — and where you were not — at a critical time.

• Google Maps Timeline (Android and iPhone with Google Maps): Go to timeline.google.com or open Google Maps > “Your Timeline.” This shows a detailed log of everywhere your phone has been, with timestamps. You can export this data.
• Apple Maps / Significant Locations (iPhone): Go to Settings > Privacy & Security > Location Services > System Services > Significant Locations. This shows places your iPhone has recorded you visiting.
• Find My (iPhone): The “Find My” app may have historical location data for your devices.

Location data can be powerful evidence, but it can also be challenged (your phone was somewhere does not necessarily mean you were with your phone). Discuss with your lawyer how best to use it.

How to Organize and Deliver Evidence to Your Lawyer

Raw screenshots dumped into an email are better than nothing — but organized evidence is far more useful. Here is how to make your lawyer’s job easier:

1. Create a Timeline

List the relevant dates and events in chronological order. Note which pieces of digital evidence correspond to which events.

2. Label Your Files

Name screenshots and files clearly: 2026-01-15_text_messages_complainant.png is far more useful than IMG_4392.png.

3. Use a Shared Folder

Create a Google Drive folder, Dropbox folder, or USB drive with subfolders:

• /Text Messages
• /Social Media
• /Call Logs
• /Photos and Videos
• /Location Data
• /Other

4. Include Context

Write a brief note explaining what each piece of evidence is and why you think it is relevant. Your lawyer does not have the same context you do — a sentence of explanation can save significant time.

5. Deliver Securely

Digital evidence may contain sensitive personal information. Use a secure method to transfer it to your lawyer:

• In-person USB delivery
• Password-protected cloud folder shared directly with your lawyer’s email
• Encrypted email if your lawyer supports it

Do not post evidence publicly, share it on social media, or send it through unsecured channels.

What Your Lawyer Does With Digital Evidence

Once we have your digital evidence, we:

1. Review it for relevance — identifying the specific messages, posts, records, and data that support your defence
2. Cross-reference it with the Crown’s disclosure — comparing the complainant’s account to what the digital record shows
3. Identify inconsistencies — finding contradictions between the complainant’s statement and the digital evidence
4. Prepare it for court — organizing it into exhibits that can be entered as evidence at trial or used in cross-examination
5. Assess authentication — determining whether the evidence can be properly authenticated under the rules of evidence (this is why complete, unedited records are so much more valuable than isolated screenshots)

A Warning: Do Not Manufacture or Edit Evidence

This should go without saying, but: never fabricate, alter, or edit digital evidence. Do not create fake messages, photoshop screenshots, or modify timestamps. Digital forensic analysis can detect alterations, and fabricating evidence is a criminal offence (obstruction of justice) that will destroy your case and your credibility.

Need help understanding what evidence matters in your case? Contact us — we can guide you on exactly what to collect and how.