How Do Journalists Preserve Digital Evidence?

Digital Evidence Preservation Explainer

Digital evidence can include photographs, video, audio, messages, documents, databases, web pages, and files from a source’s device. Unlike a paper record, a digital file can be copied perfectly but also changed without leaving an obvious mark. Journalists therefore separate preservation from analysis. They first secure the best available original, record how it arrived, and avoid opening or converting it in ways that could alter metadata. Working copies are then made for transcription, editing, redaction, or technical examination.

Provenance is the documented history of the material. Reporters note who supplied it, when and how it was transferred, what device or platform produced it, and whether anyone else handled it. They save accompanying messages and record the source’s explanation while memories are fresh. This history does not automatically prove authenticity, but it helps editors identify gaps and allows later reviewers to understand why the newsroom believed a file was connected to a person, place, or event.

A cryptographic hash is a digital checksum calculated from a file. If even one bit changes, a secure hash will normally change too. Newsrooms can calculate a modern hash for the original and store the value separately, creating a way to show that a later copy matches the preserved version. A hash does not reveal whether the file was truthful before collection; it only helps demonstrate that the captured file has not changed since the checksum was made.

Secure storage includes access controls, backups, encryption where appropriate, and a log of who retrieved or transferred sensitive material. Reporters should avoid casually uploading confidential files to consumer tools because automatic syncing, transcription, or artificial-intelligence services may create new copies or expose sources. File names, folders, and case notes should be consistent enough that another authorized editor can find the original without mixing it with derivatives. Retention decisions also consider legal obligations, source promises, and the risks of holding personal data.

Web evidence poses a special challenge because pages and posts can disappear or change. Journalists may save the page, capture screenshots, record the URL and time, download available original media, and use a reputable web archive. A screenshot alone may omit surrounding context or be easy to fake, so the newsroom preserves the underlying link and supporting records whenever possible. If a platform provides an account identifier or upload timestamp, those details are recorded separately from the visible caption.

Preservation supports accountability inside and outside the newsroom. It allows editors to reproduce a finding, experts to examine the same material, and reporters to answer questions about an investigation. The process should be proportionate: routine public documents may need simple organized storage, while leaked records alleging serious misconduct require stricter controls. In every case, the goal is an understandable trail from receipt to publication, with the original protected and every significant transformation disclosed.

Editors should decide responsibility before a sensitive investigation begins. One person may control the originals, another may maintain the access log, and a small group may approve transfers to experts or lawyers. The plan should cover what happens if a device fails, a reporter leaves the project, or a source asks for material to be destroyed. Clear roles prevent a well-intentioned colleague from renaming, compressing, or sharing a file in a way that breaks the record. Preservation is therefore not only a storage problem; it is an editorial workflow that protects evidence and people.