Digital evidence review concerns material such as emails, messages, website pages, account notices, payment confirmations and other electronic records relevant to a defined question. It focuses on how information is collected, described and considered, rather than assuming that an item proves a particular allegation.
Preserve source and context
Where possible, retain the original file or message and note how and when it was obtained. Record dates, time zones, account names, web addresses and any surrounding conversation that helps explain an item. A screenshot can be useful, but it may omit metadata or context; keep the underlying record where it is safe and lawful to do so.
Do not edit the original material to add highlights or commentary. Keep working notes separate, and make clear whether a date or name comes from the source itself or was added later.
Compare without overclaiming
Records can be compared to build a timeline or identify points that need clarification. Differences may result from time zones, incomplete exports, changing web content or inaccurate reporting. An inconsistency should be described and assessed, not treated as proof of deliberate deception by itself.
Scope and limitations
The review depends on the available material, its provenance, the agreed question and any technical limits. It is not a substitute for a specialist forensic acquisition where that is required, nor does it certify that a document is genuine merely because it can be opened or viewed.
For organising records into a structured output, see evidence and reporting support. For public-source collection, see open-source intelligence.