AIP 410 · Legal & Justice
Digital Evidence for Legal Teams
Awareness training on preserving, authenticating and working with digital evidence, including AI-generated media, without becoming a forensic expert. It is NOT legal advice and NOT CLE credit; AIP has not sought CLE approval.
What you will be able to do
- List common sources of digital evidence and explain why prompt, careful preservation matters.
- Describe chain of custody and authentication in plain terms.
- Explain, in general terms, how platform records and legal process work, and when to involve counsel.
- Explain why ‘Is it real?’ is the wrong first question for suspected AI-generated media.
- Know what to ask a qualified forensic examiner, and what a sound report contains.
1 Module 1 of 5 · 35 min
Sources of digital evidence and preservation
- Identify common sources of digital evidence in these matters.
- Explain, in plain terms, what a preservation letter is for.
- Describe what to preserve and what never to copy.
Scope reminder
This is awareness training. It is not legal advice and not CLE credit; AIP has not sought CLE approval. Legal process, deadlines and rules of evidence vary. Confirm everything with qualified counsel and primary sources.
Digital evidence is fragile. Messages disappear, accounts are deleted, phones are reset and platforms delete data on their own schedules. In these matters, speed and care matter more than completeness. The goal in the first hours is to avoid losing what exists and to avoid creating new harm.
| Source | Examples | Typical risk |
|---|---|---|
| Devices | Phones, tablets, game consoles, computers | Resets, trade-ins, auto-delete settings, lost passwords |
| Accounts | Social media, chat, gaming, email, cloud storage | Deletion, takeover, expiring content |
| Platform records | Account details, login history, reports | Retention limits; held by the provider |
| Payment and money records | Gift cards, cash apps, bank transfers, crypto wallets | Fast movement of funds |
| Third-party records | School, employer, hotel, rideshare, telecom | Routine deletion cycles |
A preservation letter (sometimes called a litigation hold request) is a written request that someone keep relevant records and not delete them while a matter is pending. In plain terms, it asks an organization to stop routine deletion for specific data. Whether and how to send one, to whom, and with what authority is a legal judgment for counsel. A letter does not by itself compel production.
- Usernames, profile links, phone numbers, email addresses, payment handles and wallet addresses.
- The text of messages and threats, with dates and times, noted in a log.
- A simple record of devices: who owns them, where they are kept, who has touched them.
- The names of platforms and organizations that may hold records.
- Sexual images or videos of a minor, in any form, including screenshots.
- Any material you would not want on your own device if it were examined.
Related
A distressed parent tells your office they plan to delete their child’s account and factory-reset the phone tonight ‘so this nightmare is over’. A court date is not yet set.
What should you tell the parent, and what should you escalate?
Show the debrief
Empathize first, then explain that deleting the account or resetting the phone may erase the trail that helps law enforcement and the court. Advise them to capture identifiers and message text (not images), keep the device powered and untouched, block and report within the app after capturing, and contact NCMEC and the police. Escalate to the supervising attorney to consider preservation steps and whether other parties hold records. Do not tell them to destroy anything, and do not ask for images.
Knowledge check
2 Module 2 of 5 · 35 min
Chain of custody and authentication basics
- Explain chain of custody in plain terms.
- Describe why documentation can matter as much as the data.
- Recognize practices that put authentication at risk.
Chain of custody is the record of who held evidence, when, where, and what they did with it. If the record has gaps, a court may doubt whether the item is what it claims to be. Authentication is the process of showing that an item is what its proponent says it is. The rules and standards vary and are a matter for counsel.
- Identify the item: what it is, where it came from, and who gave it to you.
- Record each handoff with date, time, names and purpose.
- Store it safely and limit who can access it.
- Avoid changing it. If handling cannot be avoided, note exactly what was done.
- Hand it to the right person, such as law enforcement or a qualified examiner, and record that too.
| Practice | Why it matters |
|---|---|
| Logging every handoff | Shows continuity and reduces doubt |
| Working from copies made by a qualified examiner | Protects the original |
| Using personal devices and accounts for review | Mixes evidence with personal data; creates disputes about what changed |
| Forwarding evidence by ordinary email | Alters metadata, spreads copies and loses control |
| Neutral labels and notes | Avoids appearing to shape the evidence |
Documentation is evidence too
A clear log of what you did and why, written at the time, is often what makes the rest of the work credible. Write it in plain, neutral language and keep it with the file.
A paralegal takes a client’s phone to ‘look through the messages’ and then reads and scrolls, opens several apps, and sends screenshots of the threats to the attorney’s personal email. There is no log.
What went wrong and how would you repair it?
Show the debrief
Examining a live device changes it, using personal channels spreads copies, and the missing log leaves gaps. Stop further handling, write down from memory exactly what was done, note the device’s current state, and consult the supervising attorney about engaging a qualified examiner. The screenshots, if they contain only message text and no illegal material, should be moved to approved systems under the attorney’s direction. This is a process failure to fix, not a person to blame.
Knowledge check
3 Module 3 of 5 · 35 min
Platform records and legal process in general terms
- Describe the kinds of records platforms may hold.
- Explain in general terms why access to records often requires formal legal process.
- Know when to involve counsel and law enforcement.
Online platforms hold records about accounts: details provided at sign-up, login history, and sometimes content. What a platform may disclose, to whom, and under what process depends on the type of data, the requester and the law. At a general level, federal law such as the Stored Communications Act (18 U.S.C. §§ 2701-2712) limits what providers may disclose, and different kinds of records generally require different kinds of process. Verify current text and how it applies with counsel.
| Who is asking | What is generally true | Your role |
|---|---|---|
| Law enforcement | Can use criminal legal process and may ask providers to preserve data | Report promptly; share your log; do not interfere |
| Private civil litigants | Access is typically through court-supervised process, and limits on content apply | Consult counsel on strategy and timing |
| The victim or family | May be able to access their own account data through platform tools | Help them capture identifiers; do not log in as them to snoop |
| The public | Generally has no right to account records | Direct questions to the proper process |
- Report to the CyberTipline and local law enforcement early, so they can use their own preservation and legal tools.
- Keep a list of platforms and account identifiers for counsel.
- Expect delays and deletions: platforms retain data on their own schedules.
- Don’t log in to someone else’s account to gather evidence without guidance from counsel and law enforcement.
- Don’t promise a client that a platform will hand over data quickly.
- Don’t impersonate a government agency or send informal ‘demand’ messages that could be misread.
A well-meaning advocate suggests that the family ‘guess the password’ of the blackmailer’s account or hire someone to get in, ‘to find out who they are’.
How should you respond?
Show the debrief
Do not. Unauthorized access to an account can be a crime, can contaminate evidence, and can tip off the offender. Capture identifiers, report to NCMEC and law enforcement, and let them use proper process. Counsel can advise on lawful civil options. Patience protects the child and the case.
Knowledge check
4 Module 4 of 5 · 40 min
AI-generated and manipulated media
- Explain why a fake image can still be an exploitation matter.
- Describe provenance and why ‘Is it real?’ is the wrong first question.
- Identify sound, careful steps when manipulated media is suspected.
Generative AI can place a child’s face onto sexual imagery, or alter an ordinary photo. The harm to the child, and the response required, does not depend on whether a camera ever captured a real event. Legal treatment of synthetic material varies and is evolving, so verify the current law with counsel. In general terms, the TAKE IT DOWN Act and other laws address AI-generated intimate imagery.
Why ‘Is it real?’ is the wrong first question
Asking whether an image is real first delays protection. A child may be harmed, extorted or humiliated by a fake. The first questions are: Is a child at risk now? Is there a threat or demand? Where is it posted? Who can remove or preserve it? Authenticity is a later question for a qualified examiner.
| Concept | Plain meaning | Why it matters |
|---|---|---|
| Provenance | Where a file came from and how it moved | Helps assess origin and reliability |
| Metadata | Data about a file (dates, device, edits) | Can help, but is easy to alter or strip |
| Content credentials / watermarks | Signals some tools add about how media was made | Useful when present; their absence proves little |
| Detection tools | Software that estimates whether media was manipulated | Imperfect; can be wrong in both directions |
| Corroboration | Independent evidence that supports or contradicts a claim | Often stronger than any single tool |
- Treat suspected fakes of a minor as an exploitation matter from the start.
- Preserve links, accounts, posting dates and who saw it; do not copy the image.
- Report to the CyberTipline and use Take It Down for removal when the person is under 18.
- Ask a qualified examiner, not a detection app, for any opinion about authenticity.
- Don’t tell a victim ‘it is obviously fake, so no harm done’.
- Don’t rely on one detection tool’s score as proof either way.
- Don’t circulate the image to ‘see if people believe it’.
A school administrator tells a family that since the explicit image of their daughter ‘was clearly made by AI’, it is ‘not a real problem’ and no report is needed.
How should you advise the family and the administrator?
Show the debrief
A fake sexual image of a child is still a serious harm and may be a crime, and the school has duties to respond to harassment and exploitation. Advise the family to preserve links and identifiers (not the image), report to NCMEC and law enforcement, use Take It Down, and put the school’s notice in writing. Advise the administrator that authenticity is not the threshold for action. Confirm specific legal duties with counsel.
Knowledge check
5 Module 5 of 5 · 35 min
Working with a qualified forensic examiner
- Describe what a qualified examiner does and does not do.
- List questions to ask before engaging one.
- Recognize the contents of a sound, signed report.
A digital forensic examiner uses documented methods to collect, preserve and analyze digital evidence, and reports findings in a way others can check. Legal teams usually need an examiner when a device or account may become evidence, when authenticity is in doubt, or when the stakes are high. The examiner is a neutral technical expert, not an advocate.
- What training and experience do you have in this kind of matter?
- What methods and tools will you use, and what versions?
- How will you preserve the original and document every step?
- Will you produce verification values (such as hashes) for the evidence you collect?
- How do you handle illegal material, and what is your protocol if you find some?
- Will your report be signed, and will it state limitations and what you did not examine?
- What are your fees, timelines and conflicts of interest?
| A sound report includes | Why |
|---|---|
| Scope and questions asked | Shows what the work was for |
| Methods, tools and versions | Lets others repeat or challenge the work |
| Evidence list and verification values | Shows what was examined and that it did not change |
| Findings stated separately from opinions | Keeps facts and judgment distinct |
| Limitations and uncertainty | Honest work says what it cannot show |
| A signature and date | Accountability for the author |
Be careful with AI ‘verdicts’
Software can assist, but a tool’s output is not an examiner’s opinion. Insist on a human expert who takes responsibility, signs the report and can explain their work.
A vendor sends your office a one-line email: ‘Our AI analysis says the video is 97% likely to be fake.’ No method, no report, no name.
What do you ask for before using this in any way?
Show the debrief
Ask for the methods, tool names and versions, what was analyzed, limitations, and a signed report from a named qualified person who will stand behind it. A score without a method is a claim, not evidence. Consider a second, independent review for important matters. Protect the child in the meantime without waiting for the analysis.
Knowledge check
★ Capstone
Evidence-handling checklist for a hypothetical matter
The capstone is how you show you can do the work, not just answer questions. It produces something real that you keep.
- Invent a hypothetical matter (for example, a teen is being threatened with an intimate image and an AI-generated fake is also circulating). Do not use real names or real material.
- Write a one-page evidence-handling checklist for the first 72 hours: what to capture, what never to copy, who to notify, and how to log every handoff.
- Include a preservation-letter plan: which organizations may hold records, and who would decide whether to send letters.
- List five questions you would ask a forensic examiner before engaging them, and what a sound report should contain.
- Add a short plain-language script for explaining to a parent why they should not delete accounts or reset devices.
How it is reviewed
- The checklist is specific, ordered and usable by someone new to the matter.
- It prohibits copying or forwarding illegal material and offers a lawful alternative.
- It includes a chain-of-custody log template or clear logging instructions.
- It treats authenticity as a later question for a qualified examiner, after protection and preservation.
- It identifies decisions that belong to counsel and does not claim legal conclusions.
- It states plainly that it is awareness training and not legal advice or CLE credit.
Pass every module check at 80% or better, finish the capstone, then follow the steps on the credentials page to request your certificate.
Counts toward
Companion playbooks
- Preserving evidence: a guide for families
- AI-generated fake images (“nudify” and deepfakes): the response playbook
- Is this real? Grading what you read and who told you
- Intimate image or sextortion on campus: the school incident playbook
AIP Academy courses are awareness and skills training. They are not legal, medical or clinical advice, and an AIP certificate is not a license, state or professional accreditation, CLE credit, or a promise of employment. In an emergency call 911.
Safety is built before the crisis
Pick your part and see it through. Prevention works when people follow through.