Cross-border electronic evidence rarely moves through a single, uniform process. It may be requested under an international cooperation mechanism, obtained from a service provider, transferred between investigative teams, converted into another format, translated and ultimately presented to a decision-maker in a different jurisdiction.
At each stage, questions arise that are both legal and technical: who authorised the acquisition, what exactly was obtained, how was its integrity checked, who handled it, what changed, and can the resulting account be explained and reproduced?
These questions were central to the Council of Europe workshop on the admissibility of electronic evidence, organised by the CyberSPEX project in cooperation with the ULTRAXL project in The Hague on 24–25 September 2026. The Council of Europe stated that the workshop brought together prosecutors and law-enforcement representatives, including national desks from Eurojust, Europol and SIRIUS, and that its discussions would contribute to a planned white paper on admissibility.
The white paper had not been published at the time of the research supporting this article. It would therefore be premature to attribute any specific conclusion, standard or agreed minimum evidential bundle to the workshop. The narrower practical point is that provenance can inform authentication, evidential assessment and challenge risk. It does not, by itself, determine admissibility across jurisdictions.
The central issue is not simply whether data exists
Electronic evidence can be technically available without being readily usable in a proceeding. A collection may contain relevant messages, files, account records, device data or provider logs, yet still raise questions about authenticity, integrity, continuity and context.
For litigation lawyers and investigations professionals, the relevant question is not only whether a file or record can be produced. It is whether the evidence can be explained with sufficient precision:
- What was the source of the item?
- Which authority or legal instrument supported its acquisition?
- What method was used to collect it?
- What kind of material was obtained: source-native material, a provider-produced record, a forensic acquisition or a later derivative?
- Were copies or derivatives verified, and what exactly did the verification address?
- Who handled or transferred the material?
- Were formats, translations or timestamps changed?
- Can the technical and procedural history be demonstrated to the relevant decision-maker?
The answers will depend on the jurisdictions involved, the nature of the evidence and the applicable procedural rules. No international instrument or documentation practice eliminates the need for jurisdiction-specific legal review. Consistent records can, however, give counsel and investigators a clearer basis for assessing evidential risk before the material reaches presentation.
The legal and operational landscape is not uniform
The Budapest Convention and its Second Additional Protocol are central Council of Europe instruments shaping cross-border cooperation concerning electronic evidence. The Council of Europe describes the Second Additional Protocol as providing tools for enhanced cooperation and disclosure, including mechanisms involving service providers, joint investigations and emergency channels.
Within the European Union, Regulation (EU) 2023/1543 and Directive 2023/1544 form part of the EU e-evidence framework. The package includes European Production Orders and European Preservation Orders, as well as provisions concerning designated legal representatives. SIRIUS, Eurojust and Europol provide operational and knowledge-support functions relevant to cross-border access and preservation.
That framework should not be treated as globally uniform. The EU instruments apply within their defined EU context and do not automatically extend to evidence held in non-EU jurisdictions. Similarly, ratification and implementation of the Second Additional Protocol are state-dependent. Signatures, ratifications, domestic implementation and operational practice should not be assumed to be identical across jurisdictions.
This distinction matters at the start of an investigation, not only at the point of challenge. The legal channel used to obtain evidence forms part of the evidence history. A technical record that omits the acquisition authority or the circumstances of production may leave an important gap in the account of how the material came into existence within the case file.
Build a provenance record before the evidence moves
A useful operational approach is to create a provenance record for every significant cross-border evidence item. This is not a claim that a particular “forensic provenance bundle” has been adopted by the Council of Europe workshop. It is a practical way of organising information that may be relevant to acquisition, preservation, transfer and processing.
Technical guidance and practitioner materials, including ISO/IEC 27037, NIST SP 800-86, ENFSI materials and INTERPOL guidance, may inform such documentation. They are distinct sources with different scopes and contexts, and should not be treated as a single binding or universally harmonised international standard. Their relevance to a particular matter should be considered alongside the evidence type, applicable procedure and jurisdiction.
The record should identify, where applicable:
-
The acquisition authority. Record the legal instrument or authority used, the issuing body, the relevant date and time, and the producing organisation or service provider. Depending on the matter, the route may involve a warrant, an EU production or preservation mechanism, mutual legal assistance, direct provider disclosure or another form of authorised production. The appropriate legal classification requires counsel’s review.
-
The acquisition method and evidence type. Document what was collected, from which source, by whom and using which method or tool. A source-native artefact, a provider-produced response, a forensic acquisition and a presentation derivative are not interchangeable descriptions. The preservation and verification steps appropriate to each depend on the evidence and the circumstances in which it was obtained. Retain relevant tool versions and supporting records. For provider-held data, preserve the response as received together with available production or delivery records, without assuming that the response is the original underlying data.
-
The source material and verified copies. Preserve source-native material where it is available and appropriate, while recognising that some records are produced by a provider or generated through an acquisition process rather than collected as a conventional native file. Forensic guidance identifies acquisition documentation and integrity verification as relevant parts of a defensible workflow. Cryptographic hash values may be recorded for particular objects at particular stages, together with the algorithm, value, tool and process used. A hash does not by itself establish source, authenticity, completeness or evidential meaning. Any reliance on equivalence between independently produced hashes requires technical validation of the relevant toolchain and process.
-
The custody and transfer history. Record each significant custody step, including the actor, action, timestamp, location or system, purpose and method of transfer. For cross-border movement, retain relevant transfer receipts, transport records, integrity checks and any authorisation documents. The record should make clear whether the evidence was copied, repackaged, encrypted, transmitted or accessed during transit.
-
Changes to format or content. Format conversions, exports, transcoding, indexing and other processing should be recorded with the purpose, operator, date and time. Source-native material or the received provider record should be retained where possible. A derivative may be useful for review or presentation, but it should not silently replace the material from which it was derived.
-
Translations. Preserve the source text alongside any translated version. Record who performed the translation, when it was performed, the method used and any relevant software or certification information. Translation is not merely a presentation step if it changes the material being relied upon; it is part of the evidence history.
-
Timestamp context. Preserve original timestamp fields and the relevant timezone or device-clock context. If timestamps are normalised for indexing or comparison, record the original values, the normalised values and the method used. Differences between provider logs, device clocks and timezone assumptions may affect the ordering of events. Such reconciliation requires technical validation where the timeline is material.
Authentication requires more than an integrity check
Authentication should not be reduced to a single hash value. A hash can support an integrity check for a particular object at a particular stage, but it does not by itself explain the object’s source, the circumstances of its acquisition, the reliability or completeness of provider metadata, or the meaning of a timestamp.
A fuller evidential account connects several layers:
- the authority and route by which the data was obtained;
- the source system, device or provider;
- whether the material is source-native, provider-produced, acquired through a forensic process or derived for presentation;
- the acquisition or export method;
- the preservation of source material and relevant received records;
- the integrity checks applied to particular objects;
- the custody and transfer history;
- any transformation, translation or processing; and
- the technical and contextual explanation of relevant timestamps.
Provider-supplied records may, depending on the provider, product, retention period and production process, include extraction logs, server timestamps, delivery timestamps, internal identifiers, API receipts or other administrative metadata. Such artefacts may not be available, may cover only part of the production process and may have different evidential meanings. An API receipt or administrative record does not, by itself, authenticate or establish the completeness of the underlying data. Where possible, the producing organisation’s records should be retained in the form received and assessed in accordance with the requirements of the matter.
The same caution applies to forensic tools. A claim that a particular vendor tool produces “court-accepted” images would require supporting validation and cannot be inferred from the existence of a standard or guidance document. Tool versions, configurations, workflows and the intended use of the output all matter.
Presentation should preserve the evidence history
By the time electronic evidence reaches a hearing, report or settlement discussion, it may have been converted into a searchable review format, placed into a chronology, translated or presented through selected screenshots and extracts. Those steps may be operationally necessary, but they can obscure the distinction between source material, a provider-produced record and a presentation derivative.
A defensible presentation should identify the relationship between the material being shown and the preserved source or received record. It should explain relevant processing, identify omissions or limitations and preserve enough information for another suitably qualified person to understand how the presented item was derived.
This is particularly important for timelines. Normalising timestamps to a common reference zone may make a chronology easier to review, but the original timezone, clock state and timestamp fields should remain available. No single, universally adopted international standard for timestamp normalisation and provider metadata exchange was identified in the research supporting this article. Different choices can produce different event sequences, especially where clock offsets or ambiguous timezone labels are involved.
What practitioners can do before transfer or presentation
For a cross-border matter, counsel and investigators should consider the following sequence:
1. Map the jurisdictions and legal route
Identify where the evidence is located, where the producing entity is established, where the data will be processed and where it may be presented. Confirm the proposed legal channel and obtain jurisdiction-specific legal advice before collection or transfer.
2. Define the evidence item and its status
Assign a unique identifier and specify the source, scope, relevant account or device, date range and expected format. Record whether the item is source-native material, a provider-produced record, a forensic acquisition or a later derivative. This reduces ambiguity when the item is copied, transferred or transformed.
3. Capture and preserve the available source material
Avoid destructive transformations before relevant copies have been created. Retain native files, source outputs or the provider response as appropriate to the evidence type, and document acquisition methods, tools, versions and integrity checks. Do not assume that a provider response is the original underlying data or that a copy is interchangeable with its source.
4. Maintain a live custody record
Record actors, actions, timestamps, locations or systems, transfers and integrity checks as the matter progresses. The record should distinguish custody events from later processing or presentation activity.
5. Record every transformation
Log format changes, exports, translations, indexing and other processing. Hash pre- and post-transformation objects where appropriate, while recognising that a hash does not itself establish the legal or factual significance of a transformation. Any assertion that a transformation is non-destructive requires appropriate technical validation.
6. Identify material technical assumptions
Before relying on a cross-border timeline, tool output, hash comparison or provider record, identify the assumptions that require technical validation. Timestamp reconciliation, toolchain behaviour and provider metadata authenticity should not be treated as settled merely because the output appears internally consistent.
7. Preserve the distinction between legal and technical conclusions
Technical documentation can describe how evidence was acquired, preserved, transferred and processed. It does not determine whether the evidence is admissible in a particular jurisdiction. That conclusion requires the applicable legal framework and qualified local review.
A developing debate, not a settled global standard
The Council of Europe’s workshop indicates continuing international attention to the practical relationship between cross-border cooperation mechanisms and evidential requirements. Its announced intention to inform a future white paper makes the subject relevant to practitioners, but the content and conclusions of that paper were not available in the research snapshot used for this article.
There are also unresolved practical questions: how implementation of the Second Additional Protocol varies between states; how EU mechanisms interact with evidence held outside the EU; what case law will emerge under the newer EU framework; and whether practitioners will converge on common approaches to timestamps and provider metadata.
Those gaps counsel against presenting any single workflow as universally determinative. A complete, intelligible and technically bounded account of the evidence may nevertheless help counsel identify weaknesses earlier and ask more precise questions of the producing authority, service provider or forensic team.
IVIDENTIA perspective
For cross-border electronic evidence, evidential risk can accumulate through acquisition, transfer, processing and presentation. The practical objective is not to claim that documentation guarantees admissibility. It is to ensure that the evidence history is sufficiently precise to be examined, challenged and explained, while keeping legal conclusions separate from technical observations.
IVIDENTIA’s Digital Evidence Intelligence perspective begins with that distinction: what does the evidence establish, what supports that conclusion, and what remains uncertain? For matters involving multiple jurisdictions, a structured provenance record, appropriately preserved source or provider-produced material and targeted technical validation can provide a more reliable foundation for that analysis.
If your matter involves cross-border electronic evidence, the appropriate next step is a focused review of the acquisition route, provenance record, technical transformations and jurisdiction-specific legal requirements before the material is transferred or presented.
Sources
- CyberSPEX and ULTRAXL projects: Workshop on the admissibility of electronic evidence — Council of Europe — Cybercrime Programme (C-PROC).
- Second Additional Protocol to the Convention on Cybercrime — Council of Europe — Cybercrime / Treaty Office.
- Convention on Cybercrime — Council of Europe.
- E-evidence: cross-border access to electronic evidence — European Commission.
- SIRIUS — Eurojust / SIRIUS.
- ISO/IEC 27037:2012 — ISO / standards repositories.
- NIST Special Publication 800-86 — National Institute of Standards and Technology.
- ENFSI Best Practice Manuals — European Network of Forensic Science Institutes.
- Digital forensics guidance — INTERPOL.
