Electronic Evidence Checklist Philippines: What to Preserve

Last materially reviewed: September 6, 2026

Direct Answer

Before filing a complaint, report or case involving digital evidence, preserve the original source, full context, identifying information and a clear record of how the evidence was collected. Do not rely only on cropped screenshots or edited copies. The stronger your preservation process, the easier it is to authenticate the evidence later.

Electronic Evidence Checklist

1. Preserve the Original Source

Keep the original phone, computer, camera or account where practical.
Do not factory-reset, reinstall or delete the relevant app.
Save native files and exports.
Keep backups.

2. Capture Full Context

full conversation thread;
URL and account/profile information;
timestamps and timezone;
messages before and after the key item;
comments, shares and replies where relevant.

3. Preserve Identity Information

phone numbers;
email addresses;
usernames and account IDs;
profile URLs;
device identifiers where relevant.

4. Preserve Technical Data

metadata;
email headers;
system or application logs;
cloud exports;
file properties;
hash values for important forensic files.

5. Preserve Media Properly

keep original photos, audio and video;
do not edit the only copy;
retain longer recordings, not just clips;
save source files before social platforms recompress them.

6. Document Collection

who collected the evidence;
date and time;
device or account used;
how the file was copied or exported;
where it was stored afterward.

7. Build a Timeline

Create a dated chronology linking the digital evidence to the real-world event: payment, conversation, login, delivery, threat, post, breach or incident. A timeline helps investigators and lawyers understand what each item proves.

8. Keep Supporting Records

receipts and transaction IDs;
bank or e-wallet records;
delivery or order records;
complaint references;
support tickets;
witness names;
business or account records.

What Not to Do

Do not crop away usernames, dates or URLs from the only copy.
Do not annotate or draw over the only original.
Do not forward files repeatedly if it changes quality or metadata.
Do not use random recovery tools on an important device without understanding the risk.
Do not assume a screenshot alone proves who controlled an account.

When to Get Forensic Help

Consider technical or forensic assistance when evidence was deleted, authenticity will likely be disputed, a device must be imaged, system logs are complex, a deepfake is suspected, or the case is serious enough that preservation errors would be costly.

Frequently Asked Questions

Do I need a hash for every file?

No. Hashing is especially useful for forensic copies and high-stakes evidence, but it is not required for every screenshot or message.

Should I print everything?

Printed copies can be useful for review, but keep the native electronic source as well.

Should I give investigators my only device?

Follow lawful instructions, but keep an inventory of what was provided and ask about proper evidence handling or imaging where appropriate.

Related Cybercode Guides

Official Sources

This checklist is not a substitute for forensic procedure tailored to a specific case.

Disclaimer

Important:

Continue through the electronic-evidence workflow

Admissibility is only one part of the analysis. Use these guides to preserve the source, prove authenticity and prepare the record:

This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.

Electronic Evidence Checklist Philippines: What to Preserve Before Filing a Complaint or Case