Electronic Evidence Preservation Philippines: Chain of Custody, Integrity and Authentication

Last materially reviewed: September 3, 2026

Direct Answer

Preserving electronic evidence means keeping enough information to show what the data is, where it came from, when it was created or obtained, whether it changed, and who handled it. Philippine law does not reduce digital evidence preservation to one universal “chain-of-custody” form, but the Electronic Commerce Act and Supreme Court Rules on Electronic Evidence make reliability, integrity, origin, timestamps and authentication central to evidentiary weight.

Primary authorities: Republic Act No. 8792 — Electronic Commerce Act and Supreme Court Rules on Electronic Evidence.

Key Takeaways

• Preserve the original electronic source whenever possible.
• Do not rely only on cropped screenshots.
• Keep metadata, timestamps, URLs, account identifiers and file names.
• Document who collected, copied, exported or transferred the evidence.
• Use read-only or verified copies for analysis where practical.
• Authentication is easier when preservation steps are documented.
• RA 8792 specifically recognizes retention methods that preserve accessibility, accurate representation, originator/addressee information and date/time data.

Decision Snapshot

Why Does Integrity Matter?

RA 8792 provides that evidentiary weight depends on factors including the reliability of how an electronic record was generated, stored or communicated and how its originator was identified. Section 12 addresses admissibility and evidential weight.

What Does RA 8792 Say About Retention?

Section 13 recognizes electronic retention when the record remains accessible for later reference, is retained in its original format or a format that can accurately represent it, and preserves information identifying the originator, addressee, date and time. See Section 13 of RA 8792.

What Is Chain of Custody for Digital Evidence?

In practical terms, chain of custody is documentation showing possession and handling from collection through storage, analysis, transfer and presentation. For electronic evidence, useful records include who collected the file, the device or system used, date and time, file path, export method, storage location, copies created and every person who subsequently handled it.

Should You Hash Digital Evidence?

Cryptographic hashes can help show that a file has not changed between collection and later examination. A hash is not a substitute for authentication, but it is useful technical evidence of integrity when correctly generated, recorded and reproduced.

How Should Screenshots Be Preserved?

• capture the full relevant screen or conversation;
• record the URL or account identifier;
• preserve the original image file;
• record the date and time of capture;
• keep the underlying message or page accessible where possible;
• avoid editing the only copy; and
• save related emails, exports or platform records that corroborate the screenshot.

For the admissibility question, see Electronic Evidence Philippines: Are Screenshots, Emails and Chats Admissible?.

What Should an Evidence Log Contain?

Frequently Asked Questions

Do I need forensic software to preserve every screenshot?

No. But higher-risk investigations benefit from more rigorous collection, metadata preservation and forensic methods.

Should I edit sensitive information out of the original evidence?

Keep an unaltered original. Create a separate redacted working copy if disclosure must be limited.

Does a hash prove who created a file?

No. A hash can help prove file integrity; it does not by itself establish authorship or origin.

Can exported chats be better than screenshots?

Often yes, because an export may preserve more context, timestamps and message history. Its authenticity still needs to be established.

Official Sources

• RA 8792 — Electronic Commerce Act
• Supreme Court — Rules on Electronic Evidence

General educational information only. Formal investigations and litigation may require professional forensic or legal procedures.