Imagine you suspect that an employee, business partner, or service provider has committed a wrongful act, possibly even a crime, or at the very least a breach of contract. Yet the pieces of evidence you have gathered resemble isolated data points: disjointed, scattered, and largely in the form of computer data — logs, screenshots, emails and similar digital traces. How do you make use of these to confirm your suspicion in order to take appropriate legal action?

Evidence is the means by which a fact in issue is established. When the pieces of evidence collectively prove what must be shown, the burden of proof is discharged. This burden refers to the duty of a party to present evidence on the facts in issue necessary to establish a claim or defense by the amount of evidence required by law. Once this is satisfied, the burden of evidence shifts to the opposing party.

However, relevance alone does not guarantee admissibility. Evidence must also be competent — that is, not excluded by the Constitution, the law, or the rules on evidence. Courts decide cases only on evidence that has been formally offered and admitted. To do otherwise risks violating statutory or constitutional safeguards, including the right to due process.

Evidence may be classified as object, documentary, or testimonial. A computer device, if presented for the court’s direct observation, is object evidence. The data it contains, however, when offered to prove its contents, constitutes documentary evidence.

Under the Rule on Electronic Evidence (REE), references to writings or documents include electronic documents. This aligns with the E-Commerce Act, which recognizes the need for legal certainty in digital transactions. The 2019 Revised Rules on Evidence has since incorporated much of the REE.

Electronic evidence presents unique challenges — its susceptibility to manipulation, the absence of traditional “originals,” and the need to demonstrate proper preservation. Thus, beyond relevance and competence, electronic evidence must also be authenticated. In essence, this involves two elements: the electronic document and the electronic signature.

Traditionally, proving the contents of a document requires presentation of the original. In the digital context, any printout or output that accurately reflects the data satisfies this requirement. A printed email, or a digital audio or video file stored in a device, may thus serve as the “original,” provided it is shown to be accurate.

Authentication requires proof of integrity and reliability — that the evidence is what it purports to be. This may be established through witness testimony or circumstantial evidence. Electronic signatures may likewise be authenticated by evidence sufficient to convince the court of their genuineness.

Issues may also arise regarding the systems or processes through which the data was handled — especially in forensic investigations. It is therefore essential to establish not only the condition of the data at presentation, but also how it was collected, processed, preserved, and transmitted.

A clear and documented chain — from collection to analysis to turnover — helps demonstrate that the data has not been altered or compromised. The law does not mandate specific technical methods, but it requires measures sufficient to establish authenticity and integrity.

Questions may also arise as to the reliability of the data itself. For example, if a party denies being the sender of a digital message, the issue shifts from admissibility to evidentiary weight. One key factor is the reliability of how the originator was identified. Mere belief, unsupported by independent proof, may not suffice.