Electronic Evidence in Criminal Cases: How to Review Chats, Payments, and Device Data

Chat records, payment records, and mobile-phone data may look objective, but their legal value depends on source, collection procedure, integrity, relevance, and the complete chain of proof. This article explains the main review points and what families should preserve immediately.

Why Electronic Data Often Becomes Key Evidence

In criminal cases involving fraud, illegal fundraising, money laundering, cybercrime, bribery, or corporate disputes, investigators often rely heavily on chat messages, payment records, call logs, emails, platform back-end records, location data, and information extracted from mobile phones or computers. These materials may look objective because they are digital, but digital form does not automatically mean reliable or sufficient to prove a crime. The first question is not whether a screenshot appears to show a conversation. It is how the information was created, collected, stored, extracted, and presented in court. A proper defense review should identify the source device or platform, the collector and collection time, whether the original medium was preserved, and whether the data can be verified through a digital signature, hash value, platform record, or other supporting material. The second question is what the data actually proves. A transfer record may show that money moved, but not necessarily why it moved, who controlled the account, or whether it was connected to a criminal purpose. A chat message may be incomplete or taken out of context. Its evidentiary value depends on the whole chain of proof, not on an isolated image or sentence.

Four Questions for Testing Authenticity and Integrity

First, examine the source. A screenshot, forwarded file, exported chat, or spreadsheet is not the same as data obtained directly from the original device or platform. The defense should identify the account, device, phone number, user identity, and platform involved, and determine whether another person could have logged in or operated the account. Second, examine the collection process. Electronic data should be collected according to lawful procedures, with relevant records, lists, photographs, video, sealing information, and signatures preserved as required. If a mobile phone or computer was seized, the file should show how it was identified, preserved, unlocked, copied, and examined. Missing or contradictory records may affect the reliability of the extraction. Third, examine integrity. Digital information can be edited, deleted, substituted, or selectively exported. The defense should compare the presented material with the original medium, extraction report, verification information, and complete data set. A conversation that begins in the middle, omits attachments, or lacks timestamps may present a materially different picture from the full record. Fourth, examine context and connection. Even authentic data must be linked to the defendant, the alleged conduct, and the relevant time and amount. A username is not always a real identity, an account holder is not always the operator, and a payment received is not automatically criminal proceeds.

Common Problems in Chat Records and Payment Data

Chat records often raise questions about identity and completeness. The same phone may be used by family members, employees, or business partners. Accounts may be registered in one person’s name but operated by another. Nicknames and profile pictures may change, and a screenshot may not display the account identifier, device information, or surrounding conversation. These issues do not automatically invalidate the evidence, but they require corroboration. Payment records present a different risk: overinterpretation. A transfer may relate to a loan, salary, purchase, refund, investment return, repayment, or temporary account movement. In a criminal case, the meaning of the transaction should be assessed together with contracts, invoices, delivery records, accounting entries, communications, witness testimony, and the parties’ conduct before and after the transfer. A suspicious-looking payment is a starting point for investigation, not the conclusion of legal analysis. In cases involving multiple people, it is particularly important to distinguish knowledge, participation, management, and benefit. Being present in a group chat, receiving instructions, introducing a customer, or receiving a transfer does not by itself establish joint criminal liability. The evidence must show the person’s specific role and its connection to the alleged crime.

How to Build a Specific Electronic Evidence Challenge

An effective defense review should create an evidence map rather than merely state that a screenshot is false. For each item, identify its source, collection method, storage medium, extraction report, verification method, content, and intended proposition. Then ask whether it is authentic, complete, lawfully obtained, relevant, and sufficiently corroborated. The defense should distinguish an objection to admissibility from an objection to weight. If the data was obtained through a serious procedural violation or cannot be reliably attributed to its alleged source, the argument may concern whether it should be admitted or used at all. If the data is authentic but incomplete, ambiguous, or weakly connected to the alleged crime, the focus may be that it cannot support the required factual conclusion beyond reasonable doubt. Counsel should also compare electronic data with objective records pointing in another direction. A message suggesting control over funds may be inconsistent with bank authorization records, accounting records, logistics records, or testimony from the actual operator. Where technical issues are central, qualified technical assistance may be needed to explain extraction methods, metadata, account attribution, deleted-file recovery, or verification results. The goal is to translate technical defects into concrete legal consequences.

What Defendants and Families Should Preserve Immediately

The first practical rule is to preserve the original device and account information. Do not reset, replace, or casually clean a phone that may contain relevant evidence. Keep the device, SIM card, lawful account information, backup records, and relevant platform notices. If data must be exported, preserve the complete export and record the time, method, and person who performed it. Second, preserve context rather than isolated screenshots. Keep the messages before and after the disputed statement, attachments, voice messages, transaction details, order information, contracts, invoices, delivery documents, and records showing performance or repayment. Third, keep a factual timeline: when accounts were created, who had access to the device, when money was received or returned, when goods or services were delivered, and when communications occurred. Finally, do not alter or fabricate digital materials, and do not ask others to delete messages or coordinate statements. Such conduct may create new legal risks and damage the credibility of otherwise useful evidence. Preserve the original material, disclose it promptly to defense counsel, and allow counsel to decide how it should be submitted and challenged.

Conclusion: Digital Evidence Must Be Read as a Chain

Electronic evidence can be important, but importance should not be confused with automatic reliability. A proper review must ask where the data came from, how it was collected and preserved, whether it remains complete and unaltered, and what it proves in relation to the defendant and the charged conduct. For defense counsel, the central task is to connect each technical or procedural defect with a concrete legal consequence. For defendants and families, the immediate priorities are preserving original devices, retaining complete records and context, and providing materials to counsel without alteration. In criminal proceedings, a screenshot may be a clue, but a clue is not the whole proof. Whether electronic data can support conviction must ultimately be determined together with all other evidence and the applicable standard of proof. This is why systematic review matters.

※ This article is general legal information, not legal advice on any specific matter. For your individual case, please consult a lawyer.