CyberCode.ph · Philippines

Electronic Evidence Preservation Philippines: Chain of Custody, Integrity and Authentication

Last updated October 12, 2026 · Practical privacy, cybersecurity and technology-law guidance
Digital evidence investigation and preservation for electronic evidence guidance

What Digital Evidence Should I Preserve After Online Fraud or Hacking in the Philippines?

Preserve four trails, in this order: the money — transaction reference numbers, amounts, timestamps, recipient account or wallet numbers, and your bank or e-wallet dispute reference; the account — login and device alerts, password-reset and email-change notices, active sessions, and recovery contact changes; the contact — the full conversation, profile URLs and account IDs; and the device, left switched on and unwiped. Tell your bank or wallet the same day. Get to the NBI or PNP quickly: only law enforcement can order a provider to preserve its own records.

What each trail should contain, and the deadline that governs it, is set out trail by trail below. The reason speed matters more than completeness is the six-month preservation clock. Then work the handling checklist and keep a handling log.

What Preservation Actually Means

Preserving electronic evidence means keeping enough information to show what the data is, where it came from, when it was created or obtained, whether it changed, and who handled it. Philippine law does not reduce digital evidence preservation to one universal “chain-of-custody” form, but the Electronic Commerce Act and Supreme Court Rules on Electronic Evidence make reliability, integrity, origin, timestamps and authentication central to evidentiary weight.

Primary authorities: Republic Act No. 8792 — Electronic Commerce Act, the Supreme Court Rules on Electronic Evidence (A.M. No. 01-7-01-SC), and the Rule on Cybercrime Warrants (A.M. No. 17-11-03-SC).

What to Preserve, Trail by Trail

After online fraud or hacking, the useful question is not what counts as evidence but what will be gone next week. Each trail below sits with a different custodian, and each custodian discards on its own schedule. Preserve in this order, because the money trail has the shortest usable window and the device has the longest.

Trail What to preserve Why it carries weight Clock that governs it
The money Transaction reference or confirmation number, exact amount, date and time with time zone, sender and recipient account or wallet numbers and registered names, in-app receipt screens, SMS and email confirmations, and the dispute or case reference your bank or wallet gives you. It identifies the receiving account, which is the only part of the chain a financial institution can act on directly. A bank or e-wallet may hold disputed funds for not more than 5 calendar days initially, extendable by not more than 25 more, 30 calendar days in all (BSP Circular No. 1215).
The account Login and new-device alerts, password-reset and email- or phone-change notices, the active-sessions or login-history page, two-factor prompts you did not request, and any security email the provider sent. Export or capture these before you clean up the account. It fixes when control of the account changed hands and from where, which separates unauthorised access from an authorised transaction the account holder regrets. Provider-held records fall under the six-month preservation period in RA 10175, Sec. 13.
The contact The whole conversation rather than the single incriminating message, with surrounding context, the profile URL and account ID or username rather than just the display name, the phone numbers or email addresses used, and any webpage or listing, captured as an image as well as a link. A display name proves nothing about who operated an account; the identifier is what an investigator can trace. The same six-month provider period. Pages and listings can be edited or deleted at any time, so capture first.
The device The phone or computer involved, left switched on, not wiped, not factory-reset and not handed to a repair shop. Stop using it for anything else where that is possible. It holds the material no provider can supply, and a reset destroys it permanently. No external clock. The risk here is your own cleanup.

Two common mistakes cost more than any missing document. The first is a factory reset to clean a compromised phone, which destroys the only copy of local artefacts. The second is deleting the scam conversation or blocking the account before exporting it, which usually removes your own access to the thread as well.

The Six-Month Clock You Cannot Start Yourself

This is the part most victims learn too late. Under RA 10175, Section 13, traffic data and subscriber information must be preserved by a service provider for a minimum period of six months from the date of the transaction. Content data is preserved for six months from the date of receipt of the order, and law enforcement authorities may order a one-time extension for another six months. The Supreme Court Rule on Cybercrime Warrants, Section 3.1, carries the same periods and also requires the provider to keep the order and its compliance confidential.

You cannot issue that order. The six-month duty is a floor that runs from the transaction, and both the extension and the content-data preservation order belong to law enforcement authorities. A service provider is under no obligation to act on a preservation request from a private person. The practical consequence is this: the records that would identify whoever accessed your account sit on a clock you have no control over, and the route to them is a complaint with the NBI Cybercrime Division or the PNP Anti-Cybercrime Group, followed by a court-issued Warrant to Disclose Computer Data, on which disclosure must be made within seventy-two hours from receipt of the order (Rule on Cybercrime Warrants, Secs. 4.1 and 4.2).

Two further timing points from the same Rule. A cybercrime warrant is valid for the period the court sets, which shall not exceed ten days from its issuance, extendable once for up to ten more days on motion for justifiable reasons (Sec. 2.5). And evidence procured without a valid warrant or beyond its authority is inadmissible under RA 10175, Section 18, which is why self-help attempts to hack back or to enter someone else account to gather proof tend to destroy a case rather than build it.

What this means for the order you do things in

  1. Same day, the bank or wallet. Report the disputed transaction through the institution own assistance channel and get a case reference. Under the BSP consumer assistance standards, a complaint should be acknowledged within 2 days, a simple complaint resolved within 7 days with the outcome communicated within 9, and a complex complaint resolved within 45 days with the outcome communicated within 47, all periods reckoned from receipt of the complaint. Do this first, because the holding window for the funds themselves is measured in days.
  2. Same day, lock the account, but export first. Change the password, revoke active sessions and restore your own recovery email and phone number. Capture the alerts and the session history before you do it, because some providers clear them once the session is revoked.
  3. Within days, the law-enforcement complaint. Bring sworn statements and your preserved material to the NBI Cybercrime Division or the PNP Anti-Cybercrime Group, so that a preservation order and a warrant application can be made while provider records still exist. Our guide to filing a cybercrime complaint sets out the two stages and the copy counts.
  4. If personal data was exposed, the privacy route in parallel. That is a separate filing with its own prerequisite, set out immediately below.

If Personal Data Was Exposed, That Is a Separate Filing

Where the incident exposed personal data held by an organisation, such as an employer, a shop, a platform or a lender, a complaint to the National Privacy Commission runs alongside the criminal route rather than replacing it. It carries a prerequisite that catches people out. The Commission mechanics for complaints require the complainant to have informed the respondent in writing of the privacy violation or personal data breach, with proof attached, and allow the complaint to proceed where there is no response within fifteen calendar days from receipt of that written information. The filing itself is a notarised complaint-assisted form or a verified complaint, accompanied by supporting documents and affidavits as evidence, and a complaint insufficient in form or substance, or lacking sufficient evidence, may be dismissed outright.

So the material to preserve for this track is slightly different: your written notice to the organisation, proof that it was sent and received, the date of receipt, and whatever reply came back, or a record of the silence. Keep that correspondence with the same care as the incident material itself. Where it is the organisation rather than you that carries the duty to notify, see when the NPC must be notified of a breach.

How do I preserve electronic evidence? A practical checklist

Use this checklist for records you can lawfully access. Copy it into your own notes and mark each step when completed. These are practical preservation steps, not a court-issued form or a guarantee that evidence will be admitted.

  1. Keep the original source and an untouched copy. Retain the original file, message, email or available native export, including attachments. Keep the source device or account available where possible. Do not crop, annotate, convert or overwrite your only copy. Make a separate working copy for review or redaction.
  2. Save the full relevant context. Include the surrounding conversation, participants, profile or account identifiers and relevant attachments. For video or CCTV, preserve the relevant sequence before and after the event where available. Note missing messages, gaps or unavailable material rather than filling them in.
  3. Record where it came from. Save the exact page or post URL, account ID or username, device or system, and original filename. Keep a capture as well as the link: online material may later change or disappear. A display name alone may not establish who operated an account.
  4. Separate event time from collection time. Record the date and time displayed in the evidence, and separately when you captured or exported it. Include the time zone, such as Philippine time (UTC+08:00). Note any known device or CCTV clock difference without changing the source timestamp.
  5. Keep a simple handling record. Give each item an ID, such as E-001. Record who collected it, how it was captured or exported, and where the preserved copy is stored. Add an entry whenever it is copied, edited as a working copy, transferred or handed over.
  6. Store securely and check access. Keep a protected backup separate from the working copy and limit access to those who need it. Check a copy opens correctly. Preserve filenames and available metadata; avoid relying only on a messaging-app forward that may compress or alter a file.
  7. Act before records disappear. Promptly ask the lawful custodian to preserve relevant CCTV or system records that may be overwritten. Record your request and any reply. If collection requires specialist access, involve the investigator or a qualified examiner; record any unavoidable changes you make.

Why these details matter: RA 8792, Sections 12 and 13, address evidential weight and retention, including that a record stay accessible for later reference, be retained in its original format or in a format that can accurately represent it, and preserve the information identifying its originator, addressee, date and time. Under the Rules on Electronic Evidence, Rule 5, Section 1, the person seeking to introduce an electronic document carries the burden of proving its authenticity, and Rule 7 allows the court to weigh the reliability of the method used to generate, store or communicate the document, the identification of its originator, and the integrity of the system it came from. A handling log supports that explanation; it does not replace authentication.

Next: copy the handling-log template or compare screenshots, messages, recordings and CCTV.

Decision Snapshot

Evidence Preserve
Email Original message, headers, attachments, sender/recipient and timestamp.
Chat Full conversation export, usernames/account IDs and timestamps.
Website URL, full-page capture, date/time, source files where available.
Video/photo Original file, metadata, device/source information and unedited copy.
Business system log Original log source, export method, system time and access record.

Why Does Integrity Matter?

RA 8792 provides that evidentiary weight depends on factors including the reliability of how an electronic record was generated, stored or communicated and how its originator was identified. The Supreme Court Rules on Electronic Evidence put the same test in the court hands: Rule 7, Section 1 lists the reliability of the method of generation, storage or communication, the identification of the originator, the integrity of the information and communication system, the familiarity of the witness with that system, and the nature and quality of the information that went into it. Rule 7, Section 2 adds the system-integrity factors, among them whether the record was recorded or stored by a party adverse to you, or kept in the ordinary course of business by someone who is not a party to the proceeding, both of which make a record harder to attack.

What Does RA 8792 Say About Retention?

Section 13 recognizes electronic retention when the record remains accessible for later reference, is retained in its original format or a format that can accurately represent it, and preserves information identifying the originator, addressee, date and time. That is the statutory reason the trail-by-trail table above asks for identifiers and timestamps rather than images alone. A note on sourcing: the Senate record of RA 8792 confirms the Act and its approval on 14 June 2000, but does not reproduce the section text, and no government host served a full copy on the recheck recorded below, so Sections 12 and 13 are summarised here rather than quoted.

What Is Chain of Custody for Digital Evidence?

In practical terms, chain of custody is documentation showing possession and handling from collection through storage, analysis, transfer and presentation. For electronic evidence, useful records include who collected the file, the device or system used, date and time, file path, export method, storage location, copies created and every person who subsequently handled it.

If the file shows several dates, use the capture, copy and screenshot timestamp example and the metadata provenance log to record what each field actually describes.

Should You Hash Digital Evidence?

Cryptographic hashes can help show that a file has not changed between collection and later examination. A hash is not a substitute for authentication, but it is useful technical evidence of integrity when correctly generated, recorded and reproduced.

How Should Screenshots Be Preserved?

  • capture the full relevant screen or conversation;
  • record the URL or account identifier;
  • preserve the original image file;
  • record the date and time of capture;
  • keep the underlying message or page accessible where possible;
  • avoid editing the only copy; and
  • save related emails, exports or platform records that corroborate the screenshot.

For the admissibility question, see Electronic Evidence Philippines: Are Screenshots, Emails and Chats Admissible?.

A simple evidence handling log you can copy

Keep one item record for each file or related set, then add a handling entry for each action. Use your own secure document or notebook. This page does not collect your evidence or log entries.

Item record

  • Evidence ID: [E-001]
  • Description and original filename: [What the item is; filename or export name]
  • Source: [Device, system, account identifier and exact URL if available]
  • Event/message time: [Date, time, time zone as displayed; unknown if unavailable]
  • Collected by and collected at: [Name; date, time and time zone]
  • Collection method: [Screenshot, native export, download or other method; tool where relevant]
  • Preserved copy and backup: [Secure storage locations; do not include passwords]
  • Known limitations: [Missing context, clock differences, unavailable source or other gaps]
  • Optional integrity check: [Hash algorithm, value, tool and date if used; otherwise not used]

Repeat this entry for each handling action

  • Evidence ID and action time: [ID; date, time, time zone]
  • Handled by: [Name]
  • Action and purpose: [Collected, copied, reviewed, redacted working copy or transferred; reason]
  • From → to: [Source and destination location or person]
  • Result: [New filename, changes to the working copy, and checks performed]
  • Transfer acknowledgement: [Recipient confirmation or receipt reference, if available]

Illustrative entry: E-001 · 3 October 2026, 10:15, UTC+08:00 · A. Santos · copied chat-export.zip from the preserved folder to a review folder for reading · preserved copy unchanged · working copy opened successfully · no transfer to another person.

A matching hash helps compare file integrity; it does not establish who created the file or whether its contents are true. If an agency provides its own evidence inventory or turnover form, follow its instructions and retain your handling history.

What comes after preservation?

Prepare to explain the source and authenticity, then use the cybercrime first-contact summary or the privacy complaint guide to prepare for the appropriate filing route.

Frequently Asked Questions

What digital evidence should I preserve after online fraud or hacking in the Philippines?

Four trails. The money trail: transaction reference numbers, amounts, timestamps, the recipient account or wallet number and registered name, and the dispute reference your bank or wallet issues. The account trail: login and new-device alerts, password-reset and email- or phone-change notices, the active-sessions list and any unrequested two-factor prompts. The contact trail: the full conversation, the profile URL and account ID rather than the display name, and any listing or page, captured as an image as well as a link. And the device itself, switched on and not reset. Report the money to the bank or wallet the same day, and the incident to the NBI Cybercrime Division or PNP Anti-Cybercrime Group within days, because the provider records that identify an intruder sit on a six-month clock only law enforcement can act on.

Can I ask a platform, telco or bank to preserve records myself?

You can ask, but nothing obliges them to agree. RA 10175, Section 13 sets a six-month minimum preservation duty running from the transaction, and the one-time six-month extension and the content-data preservation order belong to law enforcement authorities, not to a private complainant. Keep a copy of your request and any reply, then get the complaint filed so an order can issue.

Should I factory-reset a hacked phone or computer?

Not if you intend to complain or sue. A reset destroys local material that no service provider can supply later, and it cannot be undone. Secure the account instead by changing the password from a different device, revoking active sessions and restoring your own recovery email and phone number, and keep the affected device switched on and set aside.

Does it matter if I only have screenshots and not exports?

Screenshots are usable, and Rule 11 of the Rules on Electronic Evidence makes photographic, video and audio evidence admissible where it is shown to the court and identified or authenticated by the person who made it or another competent witness. A native export is usually stronger because it carries more context, identifiers and timestamps, and Rule 5 puts the burden of proving authenticity on whoever offers the document. Capture screenshots first if that is all you can do, then export if the account is still reachable.

Do I need forensic software to preserve every screenshot?

No. But higher-risk investigations benefit from more rigorous collection, metadata preservation and forensic methods.

Should I edit sensitive information out of the original evidence?

Keep an unaltered original. Create a separate redacted working copy if disclosure must be limited.

Does a hash prove who created a file?

No. A hash can help prove file integrity; it does not by itself establish authorship or origin.

Can exported chats be better than screenshots?

Often yes, because an export may preserve more context, timestamps and message history. Its authenticity still needs to be established.

Related Cybercode Guides

Digital Evidence Integrity Guides

Official Sources

Verification Log

Checks made on 12 October 2026

Source What was asked of it What it returned
RA 10175, Sections 13 to 16 and 18 (Senate Legislative Digital Resource) The preservation periods, the disclosure deadline, the examination limit, the custody rule and the exclusionary rule Confirmed: traffic data and subscriber information preserved for a minimum of six months from the date of the transaction; content data six months from receipt of the order; a one-time extension for another six months; disclosure within seventy-two hours of receipt of the order; examination no longer than thirty days from court approval; deposit within forty-eight hours of expiry; and evidence procured without a valid warrant or beyond its authority inadmissible
Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC (Office of the Court Administrator) Whether a private person can compel preservation, and the warrant periods Confirmed: approved by resolution of 3 July 2018, effective 15 August 2018; Section 3.1 carries the same six-month periods and the one-time extension, vests the preservation order in law enforcement authorities, and requires the provider to keep the order confidential; Sections 4.1 and 4.2 give the Warrant to Disclose Computer Data and the seventy-two hour disclosure period; Section 4.5 requires a return within forty-eight hours; Section 2.5 caps warrant validity at ten days from issuance, extendable once for up to ten more
Rules on Electronic Evidence, A.M. No. 01-7-01-SC (published on the Senate Electoral Tribunal site, set.gov.ph) The authentication burden and the factors governing evidentiary weight Confirmed: Supreme Court en banc resolution of 17 July 2001, effective 1 August 2001; Rule 5, Section 1 places the burden of proving authenticity on the person offering the electronic document; Rule 5, Section 2 lists the accepted means; Rule 7, Sections 1 and 2 give the weight and system-integrity factors; Rule 4 treats an accurate printout as the equivalent of an original; Rule 11, Section 1 admits audio, photographic and video evidence identified or authenticated by the person who made it or another competent witness
BSP Circular No. 1215, s. 2025 How long a bank or e-wallet may hold funds in a disputed transaction Confirmed: an initial hold of not more than five calendar days, extendable by not more than twenty-five calendar days from the lapse of the initial period, for not more than thirty calendar days in all; the four grounds for treating a transaction as disputed; and coordinated verification within the thirty-day period, or within thirty calendar days where no funds are held, extendable for meritorious reasons to a total not exceeding sixty calendar days
BSP Manual of Regulations for Banks, Appendix 115 The periods for acknowledging and resolving a consumer complaint Confirmed: acknowledgement within 2 days; a simple complaint resolved within 7 days and communicated within 9; a complex complaint resolved within 45 days and communicated within 47; all periods reckoned from receipt of the complaint. The Appendix does not state whether these are banking days or calendar days, so this page does not say which
National Privacy Commission, mechanics for complaints The prerequisite to a privacy complaint and the documents required Confirmed: the respondent must have been informed in writing with proof attached, and the complaint may proceed where there is no response within fifteen calendar days of receipt of that written information; the filing is a notarised complaint-assisted form or a verified complaint accompanied by supporting documents and affidavits; a complaint insufficient in form or substance, or lacking sufficient evidence, may be dismissed outright
RA 8792, Senate legislative record A government copy of Sections 12 and 13 The record confirms the Act, its full title and its approval on 14 June 2000, but does not reproduce the section text

Sources that could not be used on this recheck

No claim on this page rests on any of the following. A full government copy of RA 8792 was not obtained: the Department of Trade and Industry e-commerce portal serves the Act as a PDF but refuses automated retrieval, its download page does the same, the Official Gazette returned a client error, and the Senate PDF path returned a client error. Sections 12 and 13 are therefore summarised on this page from the Act as previously read, not quoted from a copy retrieved on this date, and the summary is confined to points that are not in dispute. The Supreme Court E-Library refused automated retrieval, which is why the Rules on Electronic Evidence are cited to a government host that publishes the resolution in full rather than to the E-Library.

Continue through the electronic-evidence workflow

Admissibility is only one part of the analysis. Use these guides to preserve the source, prove authenticity and prepare the record:

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.

Sources rechecked as of: October 12, 2026

CyberCode updates

Get practical updates on Philippine technology law, data privacy, cybersecurity, and AI.

Email activity tracking

Unsubscribe any time. See our privacy policy below.