Guide for submitting individual or small batches of digital files for forensic examination

DataLab considers the provenance of digital evidence to be almost as important as the evidence itself. Being able to identify and document the device, system or account from which evidence originated strengthens the forensic process and supports the assessment of its authenticity and reliability.

We recognise, however, that some examinations involve individual files or small collections of evidence where full forensic documentation may not be necessary, or where the original source is no longer available.

This guide is intended to assist in circumstances where evidence is supplied to DataLab by a client or third party, rather than collected directly by our examiners from the originating device, system or account. It explains how to submit such material while preserving as much relevant information as possible and understanding the limitations that may arise when the original source cannot be independently examined.

What types of individual files can I submit?

DataLab can assist with a wide range of digital material, including:

• Images and photographs: JPEG, PNG, HEIC and all other image formats, including examination of available metadata, AI modification, image editing and file properties.
• PDFs and documents: PDF, Microsoft Word and other document formats, including examination of document properties, metadata, modification history and relevant content.
• Spreadsheets: Microsoft Excel and other spreadsheet formats, including worksheets, formulas, workbook properties and relevant metadata.
• Emails and email attachments: Individual email messages, email threads, attachments and associated files.
• Audio recordings: WAV, MP3, M4A, AAC, WMA, FLAC, AMR, Interviews, voice recordings, telephone recordings and other audio files.
• Video recordings: Digital video files from cameras, mobile devices, dashcams and other recording systems.
• CCTV footage: Surveillance footage exported from DVRs, NVRs and other recording systems, including proprietary video formats and system logs.
• Other digital material: Files, archives, logs and other electronic information relevant to an investigation.

If you are unsure whether your material can be examined, contact DataLab to discuss what you have and what you need to establish.

How can I supply my evidence?

Evidence can generally be supplied electronically or on physical storage media. The most appropriate method will depend on the size, sensitivity and nature of the material.

Option A: Electronic submission

Electronic transfer is often the simplest option for individual files and smaller collections.

Depending on the circumstances, suitable methods may include:

• An agreed secure file-sharing service.
• A secure download link or file-transfer service.
• An approved cloud storage link.
• Email for small attachments where appropriate and within the applicable attachment limits.

Please contact DataLab if you are unsure which transfer method to use. Large video files and CCTV exports may exceed email attachment limits, while confidential or legally significant material may require a more suitable transfer method.

If files are encrypted or password-protected, arrange to provide the password separately using an agreed communication method.

Where possible, retain an untouched copy of the original evidence and provide a separate copy for examination.

Option B: Physical submission

Evidence can also be supplied on suitable physical storage media, including:

• USB flash drives.
• External hard drives and SSDs.
• Memory cards.
• Other suitable storage devices.

Physical submission may be preferable for larger collections of files, CCTV exports or material that is impractical to transfer electronically. Please arrange the delivery method with DataLab if you are unsure how best to send your device.

Ensure that the device is securely packaged and labelled with your name or organisation, contact details and any DataLab job or reference number you have been given.

If the device contains the only available copy of important evidence, please tell us before sending it. Avoid making further changes to the evidence and retain a separate copy where possible.

Preparing your evidence for examination

A few simple precautions can help preserve important information and reduce the risk of compromising the evidence.

Keep the original files unchanged: Avoid editing, renaming, converting, recompressing or otherwise modifying the original files unless necessary. These actions may alter metadata, file properties or other information relevant to the examination.

Supply files in their original format wherever possible: For example, provide the original Excel workbook rather than a screenshot or PDF printout of the spreadsheet. Provide the original image file rather than an image pasted into a Word document.

Include relevant supporting material: If a file depends on associated information, provide it where available. This may include related documents, email messages, attachments, metadata files, export logs or software needed to view a recording.

Tell us about any known issues: If a file will not open, appears corrupted, has been recovered, was supplied by another party or has been edited or converted, let us know. This information may help determine the appropriate examination method.

Email evidence: supply original .MSG or .EML files

If you have received evidence by email, please supply the original email message as an .MSG or .EML file, rather than simply forwarding the email or copying its contents into a new message.

These formats can preserve important email information, including sender and recipient details, timestamps, subject lines, message content and, where retained in the saved message, associated attachments and thread information.

Simply forwarding an email may change the message structure or omit information from the original message. Screenshots and copied text are even more limited because they generally do not retain the underlying email headers and other technical information.

To save an email, use your email application's available Save As, Download or Export function. The exact process will depend on the email application or service you use.

Where an email thread contains multiple relevant messages, please supply the original messages in their native format where available, together with their associated attachments.

Please do not rely solely on forwarded emails, screenshots or copied text when the original email files are available.

Evidence sourced from social media

Digital material obtained from social media platforms may have been processed before it reaches DataLab. When images and videos are uploaded to or downloaded from social media platforms, the platform may resize, recompress, convert or otherwise process the files. Metadata may be removed or altered in the process.

Consequently, a file downloaded from a social media platform may no longer contain all the original metadata or other information present in the file when it was first created.

Where possible, provide the original file from the device or source on which it was created, rather than a copy downloaded from or forwarded through a social media platform.

If the social media content itself is relevant to your investigation, retain the original post, message or conversation wherever possible. Include any available contextual information, such as:

• The platform and account associated with the content.
• The URL or link to the relevant post or material.
• Relevant dates and times.
• Associated messages, comments or conversation history.
• The original file, if it remains available.

If the only available material is a copy obtained from social media, DataLab can discuss what examination may still be possible. However, the absence or alteration of original metadata may limit the conclusions that can be drawn about the file's origin, history and authenticity.

Note: Datalab has the tools to preserve evidence directly from Social Media accounts such as Facebook, Instagram etc. If the evidence to be provided is Social Media content, it may be better to discuss a preserve and analyse process under a guided statement of works.

Evidence supplied through court disclosure

Evidence received through court disclosure or from another party may have been reproduced, converted or incorporated into a larger disclosure document before it reaches you. For example, photographs, images, screenshots and other digital material may have been embedded into PDF documents, Word documents or compiled disclosure bundles.

A PDF or disclosure document containing an image is not a substitute for the original digital file.

The image may have been resized, recompressed, cropped or otherwise altered during preparation of the document. Original metadata and other information associated with the source file may also be absent.

Where images or other digital material have been compiled into a PDF or similar document, examination may be limited to visual assessment of the reproduced material and whatever information remains available within the document. It may not be possible to examine the original file's metadata, establish its original properties or reliably assess whether the source material has been altered.

For this reason, DataLab does not recommend supplying images or other digital evidence solely in compiled disclosure documents when the original files can be obtained.

Where possible, request the original digital files in their native format, together with any relevant contextual information or associated records.

If the original files cannot be obtained and the disclosure documents are the only material available, contact DataLab before submission. We can assess the material and explain the scope and limitations of any examination that may be possible.

Screenshots are not a substitute for original digital evidence

Screenshots are frequently supplied as evidence of messages, social media content, photographs, documents or other information displayed on a device.

A screenshot can illustrate what was visible on a screen at a particular point in time. However, it does not preserve the underlying digital content in its original form and should not be treated as a substitute for the original evidence.

A screenshot may omit important information, including:

• Original file metadata and properties.
• Email headers and message information.
• The surrounding conversation or application context.
• Information about the source, origin or history of the material.
• Other data that may be available from the original file or device.

A screenshot alone may be insufficient to establish the origin, completeness or authenticity of the material depicted.

Where the underlying evidence remains available on a mobile phone, computer or other device, DataLab would ordinarily recommend preserving the device and independently acquiring or extracting the relevant evidence using appropriate forensic methods.

This approach may allow us to examine the underlying material, its associated context and other relevant information rather than relying solely on a visual representation.

If screenshots are all that remain available, contact DataLab to discuss the circumstances. We can assess whether a limited visual examination is possible and explain what can, and cannot, reasonably be established from the screenshots provided.

Our preference is always to examine the underlying digital evidence wherever it remains available, rather than relying on screenshots or reproduced copies.

Special considerations for CCTV, audio and video

Recordings can require additional care because an exported file may not contain all the information available from the original recording system.

CCTV footage

Where possible, provide the original or native export from the CCTV system. Some systems use proprietary formats that require the manufacturer's playback software.

Where available, include:

• The original exported video files.
• An output of the systems logs in full if possible
• The manufacturer's playback software or viewer.
• Associated export files or instructions.
• The make and model of the recording system, if known.
• The relevant date and time period.
• The relevant camera number or location.
• Any known discrepancy between the system's displayed time and the actual time.

Avoid recording a screen playing CCTV footage as a substitute for the original export unless no better option is available. A screen recording may lose image quality, timestamps and other relevant information.

If you are unsure how to export the footage, contact DataLab before making changes to the recording system.

Audio and video recordings

Where possible, provide the original recording files rather than edited clips or files that have been recompressed or cropped. If you have created a shorter clip for convenience, retain the original recording and supply it as well.

Please tell us what you need examined, such as the sequence of events, the timing of an incident, the content of a recording or whether relevant information can be identified within the available material.

Tell us what you need to establish

Providing context helps us determine the most appropriate examination approach.

When submitting your evidence, please explain:

• What the files are: For example, photographs, documents, spreadsheets, audio recordings or CCTV footage.
• Where they came from: For example, a computer, mobile device, email, cloud service, social media platform or recording system.
• What you need to establish: Identify the questions you need answered or the issue you are investigating.
• Relevant dates or time periods: Particularly important for recordings, file timelines and metadata examinations.
• Any known limitations: For example, files that have been edited, exported, recovered, converted or supplied by another party.
• Any relevant deadlines: Let us know if the examination is time-sensitive.

You do not need to know the technical details of the examination in advance. If you are unsure what can be established from the available evidence, explain the circumstances and we can discuss the options.

Security, confidentiality and evidence integrity

Digital evidence may contain confidential, commercially sensitive or personal information. Please use an appropriate transfer method and share only the information necessary for the agreed examination.

If your matter involves mediation/litigation, an investigation, an employment dispute or another formal process, let us know before submission. We can discuss relevant evidence-handling requirements, including preservation, documentation and maintaining a record of how the evidence was supplied.

The method used to collect, export, transfer and preserve digital evidence may affect what can subsequently be established.

Submitting individual files can be appropriate for many examinations, but it may not preserve all the information available from the original device or system.

DataLab can discuss whether your matter is best suited to individual-file examination, a broader collection of material or forensic acquisition of the original device or storage media.

Ready to submit your evidence?

Reach out to us via 0800 DATALAB (328 2522) or via enquiries@datalab.co.nz to discuss the evidence you wish to submit and any requirements for processing.