England and Wales civil proceedings
Digital Evidence Expert Support for Civil Litigation
Independent examination and expert opinion for solicitors, counsel, organisations and parties dealing with disputed emails, documents, device activity, data movement and electronic disclosure.
Direct access to Alistair Ewing · Scope based on the issues and evidence available · No evidence through the public form
Start with the disputed proposition
What does the digital evidence need to establish?
A civil digital evidence instruction is most useful when it begins with a defined factual question. Did a particular email exist in native form? Does a document’s history support the account given for its creation? Were files copied to removable storage or a synchronised account? Can a supplied chronology be reconciled with records from the relevant computer, mailbox or service?
Those questions are different from asking an examiner to search broadly for anything helpful. The available sources, the period in dispute and the procedural purpose of the work shape the proportionate method. An early review may identify that a focused extraction or schedule is sufficient. It may instead show that original devices, native mailbox data, a forensic image or disclosure from another party will be needed before a reliable opinion can be offered.
Alistair works directly with the instructing team from scoping through examination and reporting. He can explain the technical evidence and its limits, but does not advise on pleading, disclosure obligations, privilege or litigation strategy.
Common civil instructions
Questions encountered in commercial and private disputes
- Email authenticity and provenance. Comparing native messages, headers, attachments, mailbox records and surrounding correspondence where a message, date, sender or attachment is disputed.
- Document and PDF history. Examining metadata, embedded components, revisions, export characteristics and related file-system records to test an account of creation or alteration.
- Employee and business data movement. Looking for evidence relevant to copying, deletion, remote access, cloud synchronisation, external media or use of transfer applications.
- Electronic disclosure and collection. Planning targeted preservation, search and delivery from computers, mailboxes, storage media and online sources.
- Messaging and collaboration records. Assessing the context, sequence, attachments and source limitations of chat, meeting and workspace material.
- Review of existing technical evidence. Testing another report, schedule, extraction or methodology before deciding whether further work is justified.
Sources that may matter
The best evidence is not always the screenshot
- Original computers and storage media, or preserved forensic images.
- Native email files, mailbox exports, server records and delivery information.
- Original documents, earlier versions, attachments and surrounding directory records.
- Mobile extractions, message databases, media and linked-device records.
- Cloud audit, synchronisation and access records retained by an organisation or provider.
- System, application, security and remote-access logs.
- Existing expert reports, schedules, disclosure notes and the data on which they rely.
A screenshot can be useful evidence, but it normally contains less technical context than the source record. Absence from one device or export does not prove that an event did not occur. Retention, synchronisation, deletion, account scope and collection method all need to be considered.
Civil procedure
Expert evidence under CPR Part 35
In civil proceedings in England and Wales, an expert’s overriding duty is to help the court on matters within the expert’s expertise. That duty overrides any obligation to the person who instructs or pays the expert. The court controls expert evidence, including whether it is reasonably required and the issues it may address. See the current Civil Procedure Rules Part 35.
Practice Direction 35 (PD35) sets out matters expected in an expert report, including relevant qualifications, the material and instructions relied on, the distinction between facts within the expert’s own knowledge and those supplied by others, the range of opinion where one exists, qualifications to an opinion, and a clear summary of conclusions. It also addresses discussions between experts and the statement of truth.
The work can be staged before permission for expert evidence is sought. A private advisory review may help the legal team understand whether a technical issue is material, what sources are missing and what a proportionate expert instruction might involve. A report intended for reliance in proceedings has a different purpose and format. The intended status of each output should therefore be agreed before drafting begins.
The court may direct a single joint expert or permit written questions to an expert. Where a single joint instruction is proposed, the questions, access arrangements, source set, assumptions, timetable and payment responsibility should be agreed clearly. Independence does not change according to who provides the data or pays the invoice.
Electronic disclosure
Preservation and search decisions need a technical foundation
Where Practice Direction 31B (PD31B) on disclosure of electronic documents applies, the parties should address electronic sources, preservation, search methods and production in a proportionate way. A forensic expert can assist with the technical aspects of identifying sources, preserving selected data, explaining file formats, testing search assumptions and documenting a controlled collection.
That does not transfer the solicitor’s disclosure decisions to the examiner. Custodian selection, relevance, privilege and the legal scope of disclosure remain matters for the legal team and the court. Technical work should support those decisions with a clear record of what was collected, from where, by whom, using which method and with what exceptions.
A proportionate route
Not every matter needs a full device examination
- Conflict and suitability check. Party and entity names are checked before case detail or evidence is received.
- Question-led scoping. The instruction identifies the propositions to test, available sources, date range, intended use and fixed dates.
- Initial technical review. Where appropriate, a limited source set is assessed to establish feasibility, gaps and the most useful next stage.
- Targeted examination. Agreed artefacts and records are examined with relevant versions, settings, errors and limitations recorded.
- Appropriate output. Findings may be delivered as advice, a chronology, a technical schedule, a conference note or an expert report, according to the instruction.
Illustrative civil evidence patterns
How source records can change the shape of a dispute
A disputed email exists only as a printout or PDF. What can be tested?
The visible content can be compared for internal consistency, but a stronger examination usually needs native message data or a mailbox source. Headers, message identifiers, transport records, attachments and surrounding messages may help test provenance. None is infallible on its own, and a message can be genuine while an interpretation placed on it is wrong.
A document is said to have been created or changed on a particular date. Does metadata decide the issue?
Metadata can support a chronology, but timestamps may reflect copying, export, synchronisation, clock settings or software behaviour. The original file, earlier versions, email attachments, file-system records and application history may provide a more complete account. Conclusions should distinguish observed properties from an inference about who acted and why.
A former employee is suspected of taking company files. What should be preserved?
Useful sources may include the allocated computer, relevant accounts, cloud audit and synchronisation records, external-device history, transfer-application logs and security telemetry. Routine IT actions such as reimaging, account removal or device reissue can destroy context. Lawful authority, employment process and the precise business question should be settled before collection.
The other side has served a large technical schedule. Must the whole exercise be repeated?
Not necessarily. A focused review can examine the stated method, source coverage, timestamps, assumptions, exclusions and support for key conclusions. That may identify a narrow test or missing source. If the underlying data cannot be inspected, the limits of the review need to be stated rather than filled with speculation.
What to provide for a useful estimate
- Party, related entity and previous expert names for the conflict check.
- The court or tribunal, jurisdiction and current procedural stage.
- A concise statement of each technical question, preferably tied to an allegation or pleaded issue.
- The source types available, their present location and whether originals or exports are held.
- Any existing reports, schedules or known gaps, described without attaching them initially.
- Dates for advice, report, experts’ meeting, questions, conference or hearing.
- The proposed output and any permission, budget or funding constraint.
Limits worth identifying early
- Digital records rarely prove a human actor or intention without corroborating context.
- Deletion, retention limits, encryption, damaged media and incomplete disclosure can leave questions unresolved.
- A file timestamp or application entry must be interpreted according to the system and version that produced it.
- A matching hash can show that two data streams match. It does not prove the source’s earlier history or meaning.
- No examination can promise a favourable finding, complete recovery or acceptance of an opinion by the court.
Explore the digital evidence artefact and forensic tools guide
Digital evidence for Employment Tribunal matters
Disputed messages, document dates, account activity and employee file copying may call for a focused technical review. The useful output could be a chronology, an explanation of source limitations or a report addressing defined questions. The work is independent whether instructed by an employer, employee or their legal representative.
Employment Tribunals operate under their own rules and directions. Do not assume the civil-court CPR Part 35 framework applies automatically. The legal representative should confirm the tribunal’s permission, timetable and required report format. The official Employment Tribunal rules and guidance are the starting point. For suspected copying or deletion, see employee data theft investigation.
Conflict check first
Discuss a digital evidence question in a civil matter
Send the party names, jurisdiction, disputed proposition, available source types and the next fixed date. Do not attach evidence or confidential case papers to the public enquiry. If the matter is suitable, a secure route and itemised estimate follow.