You have WhatsApp messages that prove harassment, a post that defames you, an email that proves a breach of contract or a profile impersonating you. You have saved it all as screenshots. But when the matter reaches a Spanish court, the other side claims the screenshots have been tampered with. That is where a digital forensic report (informe pericial informático) comes in.
What it actually is
It is a document prepared by an IT expert witness (perito informático) who analyses digital evidence with a technical method and explains the conclusions to a judge who need not be an expert. It can be used to:
- Prove that a conversation, an email or a post exists and has not been altered.
- Establish who is behind a profile, an account or a message, when that is technically possible.
- Reconstruct what happened on a device or a system.
- Analyse whether audio, an image or a video has been manipulated or generated with artificial intelligence.
- Rebut a technical report submitted by the other side.
How much weight it carries in court
In Spain, expert evidence is governed by the Civil Procedure Act (Ley de Enjuiciamiento Civil, Articles 335 to 352) and the Criminal Procedure Act (Ley de Enjuiciamiento Criminal). The judge assesses it according to the rules of sound judgement (sana crítica, Article 348 of the Civil Procedure Act): the judge is not bound to accept it, but a rigorous, clear and well-defended report carries a great deal of weight.
The key issue is the challenge. In its judgment 300/2015 of 19 May, the Spanish Supreme Court made it clear that when the authenticity of a conversation submitted as screenshots is challenged, it is up to the party submitting it to prove that it is authentic, and that the appropriate way to do so is expert evidence identifying the origin, the identity of the participants and the integrity of the content.
In other words: a screenshot may be enough if nobody disputes it, but if it is disputed, it is very hard to sustain without a forensic report.
Screenshot, notary or expert
In Spain a notary can certify what they see on a screen at a given moment, but does not analyse the origin or the technical integrity of the content. A forensic expert does. That is why, when the other side is likely to challenge the evidence, a forensic report is usually the more solid option.
How it is prepared, step by step
1. Case study
The expert needs to understand what is to be proved and in what proceedings. Proving harassment is not the same as analysing impersonation or a leak. This determines which evidence must be obtained and how.
2. Acquisition of the evidence
This is the most delicate stage. The expert obtains a copy of the evidence without altering it: an extraction from the device, a forensic capture of a website, a copy of a mailbox. A digital fingerprint (hash) is calculated so that it can later be shown that nothing has changed. Standards such as ISO/IEC 27037 set out good practice for identifying, collecting, acquiring and preserving digital evidence.
3. Chain of custody
The report records who has held the evidence, when, where and what has been done with it. If there are gaps in the chain of custody, the other side can attack the evidence.
4. Analysis
Working on the copy, never the original, the expert analyses metadata, logs, app databases, email headers or whatever is relevant. Another expert must be able to repeat the conclusions using the same method.
5. Writing the report
The report describes the subject, methodology, tools, analysis and conclusions in plain language. The Spanish standard UNE 197010 sets general criteria for expert reports in information technology. For Spanish proceedings the report is written in Spanish.
6. Ratification and defence in court
The expert may be called to ratify the report and answer questions from the parties and the judge. A good report that is poorly defended loses value, which is why courtroom experience also counts.
What makes a report solid
- Timing. Digital evidence is deleted, edited or expires. The sooner it is acquired, the better.
- A verifiable method. Recognised tools, documented hashes, reproducible steps.
- An independent expert with proven training in digital forensics.
- Clarity. A judge must be able to understand it without a technical background.
- Limiting itself to what can be proved, with no conclusions the technique cannot support.
What not to do
- Forward, edit or reorganise the messages on your phone before the expert has seen them.
- Delete the app or change phones.
- Wait until the day before the hearing to commission the report.
- Rely on automatic "certification" tools without an expert who can defend the result in court.
The person behind Olvidum is a court-appointed IT forensic expert, IT specialist and SEO analyst with a master's degree in cybersecurity, and works with a law firm when a case requires it. You can see how we work, in English and remotely, on our IT forensic expert page.
