Preserving digital evidence: what proves your case, and how it is lost

The single most common failure in online disputes has nothing to do with the merits. A client arrives some weeks after the event with a folder of phone screenshots. The post has been deleted. The account has been suspended or renamed. The screenshots have no URL, no timestamp, no metadata and no chain of custody, and the person who took them cannot say precisely when or how.

The claim may be perfectly good. It may also be unprovable.

Preserve before you complain

This is the rule that saves more cases than any other, and it is counter-intuitive.

The moment you contact a publisher, report to a platform, or send a letter, the material is at risk. A publisher who takes the point seriously deletes it. A platform that upholds a report removes it. An anonymous account that senses trouble deletes everything and disappears. In each case, the very action you took to solve the problem has destroyed the record of it.

Capture first. Complain second. The delay is measured in hours, not weeks, and it is the difference between a provable case and an assertion.

What Kenyan law requires

Electronic records are admissible in Kenya under section 106B of the Evidence Act (Cap 80), which allows computer output to be received as a document without production of the original, subject to conditions.

Section 106B(2) sets out four conditions:

1. The computer output was produced during a period of regular use by a person having lawful control over the use of the computer;
2. Information of that kind was regularly fed into the computer in the ordinary course of activities;
3. The computer was operating properly throughout the material period, or any malfunction did not affect the accuracy of the record; and
4. The electronic record reproduces information fed into the computer in the ordinary course of those activities.

Section 106B(3) treats multiple computers operating in succession as a single computer. Section 106B(5) defines when information is “supplied” to a computer.

Section 106B(4) is where matters are usually decided. It requires a certificate identifying the electronic record and describing the manner in which it was produced, signed by a person occupying a responsible official position in relation to the operation of the relevant device or the management of the relevant activities. The certificate is evidence of the matters stated in it.

In practice, the certificate is the pinch-point. Screenshots and messaging-application exports are routinely challenged, and excluded, for want of a compliant certificate. A folder of images with no accompanying certificate is not, without more, a body of admissible evidence.

Two practical consequences follow. First, preserve in a way that allows someone to honestly sign a certificate — which means a documented, describable process, not an ad-hoc collection. Second, identify early who that person will be.

What a proper preservation record contains

The aim is to capture not only what the content said, but enough surrounding material that its authenticity can be established later by someone who was not there.

Capture the native artefact, not just an image of it.

• The full page, not the visible viewport. Full-page captures, and where possible a saved copy of the page as it was served.
• The URL, complete and unshortened, including any post or comment identifier.
• The date and time of capture, with the time zone, and the device clock’s accuracy noted.
• Metadata where it is available — file properties of any image or video, the underlying page source, and platform-side identifiers such as post and account IDs.
• The account as well as the content: profile page, display name, handle, account creation date if shown, follower count, and any other content that establishes who was posting.
• The reach, where visible: view counts, share and comment counts, and the comments themselves. Damage in an online matter is proved through reach.
• Republications. Search for the same text elsewhere and capture what you find. A defendant who deletes their own post has not deleted the reposts.

Corroborate with an independent source. Your own captures are yours. Independent third-party records are stronger: web archive captures made through a public archiving service, an emailed copy sent to yourself and to your advocate at the time of capture, and — where the matter is likely to be litigated — a witness statement of collection made contemporaneously by the person who did it, describing exactly what they did.

Keep the original device and file untouched. Work from copies. Do not crop, annotate, compress or re-save the originals, and do not re-photograph a screen with a second device. Every one of those steps is an opportunity for the other side to argue the record has been altered.

Record what you did, as you do it. A short, dated collection log — who captured, from what device, at what time, using what method, and where the file was stored — costs a few minutes and answers most authenticity challenges before they are made.

Formal preservation routes

Where the matter is serious enough, self-help capture should be supplemented.

Preservation requests to platforms. Most major services will preserve account records on request for a limited period pending legal process, even though they will not disclose them without an order. Making that request early can keep material alive that would otherwise age out of retention. It is not the same as obtaining the data, and it should not be relied on as though it were.

Criminal complaint. Where an offence is genuinely involved, the investigative powers under the Computer Misuse and Cybercrimes Act reach material a private party cannot obtain. Most of them — search and seizure, production orders, real-time collection under sections 48, 50, 52 and 53 — require a court order.

One does not, and it is the one that matters most for preservation. Under section 51, expedited preservation and partial disclosure of traffic data operates by a notice served by a police officer or authorised person, without prior court authorisation; a court order is needed only to extend the preservation beyond thirty days. Where material is at imminent risk of being lost, that is the fastest statutory lever available, and it is regularly overlooked because the rest of the Part requires a warrant.

In the UAE, digital evidence is given probative force under the cybercrime law. There is no general pre-action disclosure procedure onshore, and identifying an anonymous account is in practice done through the criminal complaint and the investigative work that follows it rather than through a civil application.

Independent forensic collection. Where the volume is significant, the device is contested, or deleted material may be recoverable, a properly instructed forensic examiner produces a defensible image and a report. This costs money and is not proportionate for a single post; it is often decisive where a device, an email account or a corporate system is at the centre of the dispute.

Identifying an anonymous publisher

Preservation and identification are different problems, and the second is usually harder.

Registrant contact data for domains is redacted by default, and the centralised request route approves only a minority of disclosure requests. Platforms will not disclose account details without legal process. Access providers, in several jurisdictions, cannot be compelled through the copyright-specific subpoena routes at all.

In Kenya, the practical avenues are a criminal complaint invoking the statutory investigative powers, and ordinary discovery within civil proceedings. The English disclosure jurisdiction against innocent intermediaries is in principle receivable as common law, but we are not aware of Kenyan authority adopting it, and any advice on that point should be given as an open question rather than a settled route. Any such application now also collides with data protection obligations and the constitutional protection of the privacy of communications, which an intermediary will invoke.

Where the relevant records sit with an entity licensed in the Dubai International Financial Centre, the DIFC Courts have granted disclosure relief of this kind, including in support of proceedings elsewhere — a route worth checking early in a cross-border matter.

Electronic signatures and records generally

Beyond litigation evidence, Kenya recognises electronic execution. The Kenya Information and Communications Act contains the electronic transactions framework, including the concept of an advanced electronic signature — one uniquely linked to the signatory, capable of identifying them, created using means solely under their control, and linked to the data such that any subsequent change is detectable.

The Business Laws (Amendment) Act, No. 1 of 2020, amended the Law of Contract Act to recognise electronic signatures where a contract must be in writing and signed, with parallel amendments to registration and land legislation. Specific exclusions and formalities apply to particular instruments, and these should be checked against the governing statute for the transaction in question rather than assumed.

The short version

Capture the full page, the URL, the timestamp, the metadata, the account and the reach. Corroborate independently. Do not touch the originals. Write down what you did. Then, and only then, complain.