Most evidence does not arrive looking like evidence. It arrives as three years of text messages buried inside an active phone, photographs mixed into a camera roll with thousands of unrelated images, receipts in email accounts, voicemails nobody has listened to twice, police reports saved under whatever filename the download button assigned them, screenshots without dates, medical paperwork in a kitchen drawer, social-media posts that may disappear tomorrow, and a person trying to remember which incident happened before which.
The instinct is usually to start cleaning it up immediately: crop the screenshot, highlight the important sentence, rename the photograph, paste everything into a document, delete the duplicates, trim the video, organize the messages by topic, and make the whole thing easier for somebody else to understand. Some of that work may eventually be useful, but if the only surviving version is the cleaned-up version, the organization process can quietly erase the very information somebody may later need to evaluate what happened.
Digital evidence is unusually vulnerable to change because the useful information may extend beyond what is visible on the screen. Files can contain timestamps, metadata, embedded information, identifiers, formatting, or other data that are not reproduced by a screenshot or printout; phones can contain messages, call logs, photographs and their metadata, application data, location information, account information, and other artifacts that may never appear in the version a user sees. NIST therefore treats preservation, source documentation, integrity, backups, and the creation of working copies as distinct parts of responsible digital-evidence handling.
For most people, this does not mean turning a kitchen table into a digital-forensics laboratory or calculating cryptographic hashes every time somebody sends a threatening text. It means adopting a much simpler discipline: preserve what you actually received or created before you begin transforming it into something easier to read, keep the source and the organized version separate, record enough information that another person can understand where the material came from, and avoid making irreversible changes when litigation, criminal investigation, a protection-order proceeding, or another contested process may follow.
That distinction matters because courts do not evaluate evidence solely by whether it looks convincing. Authentication asks whether there is enough evidence to support that an item is what its proponent claims it is, and Washington ER 901 recognizes several ways that can happen, including testimony from someone with knowledge, distinctive characteristics and circumstances, evidence about a process or system, and specific authentication principles for email. At the same time, the rules governing writings, recordings, photographs, originals, duplicates, and summaries recognize that usable evidence may exist in multiple forms, which is precisely why preserving the underlying material while creating readable working or presentation copies is often the safer approach.
This resource hub is built for the part that happens before anybody argues about admissibility: preserving the source, identifying what else may exist, separating original material from working copies, documenting where information came from, protecting context, and turning a chaotic collection of records into something an advocate, investigator, attorney, law-enforcement officer, or court can evaluate without having to guess how it got there.
The goal is not to make evidence look stronger than it is. The goal is to preserve enough of the record that its strength can actually be tested.
