Criminal lawPractical guidesMobile phone data extraction and the digital chain of custody

How the contents of a seized telephone are preserved, and challenged.

What it is and what the law says

Access to the contents of a mobile phone affects fundamental rights (privacy and the secrecy of communications) and, except with consent or in a justified emergency, requires court authorisation. The forensic extraction must be carried out while preserving the integrity of the data, normally by means of a copy with verification (hash) and documentation of every step. Any unauthorised access, or access without guarantees, or a broken chain of custody may lead to the nullity of that evidence and of everything derived from it.

Three keys: access to the phone usually requires court authorisation; the forensic extraction must include integrity verification; and a break in the chain of custody voids the evidence.

What it means for your defence

The defence reviews the authorisation, the scope of the access and the forensic methodology used. A rigorous examination of the extraction and its documentation often makes it possible to question the prosecution’s star evidence. Technical expertise is decisive here.

Digital evidence: attack and defence

In cases involving phone extractions, the digital evidence is at the centre: its value depends on the lawfulness of how it was obtained and on the integrity of the chain of custody. With expert support, the defence examines how the evidence was accessed and preserved and whether it could have been manipulated. Evidence that was badly obtained or preserved can be challenged, and authorship is rarely automatic: it must be proved, not presumed, and IT expertise is decisive.

How to act and why to rely on a specialist

In technology-related offences, digital evidence and its correct collection and preservation decide the case. Speed and technical judgement are determining factors: it is not advisable to improvise or to make a statement without advice, because the first decisions condition the whole procedure and, often, the final outcome. An individualised analysis identifies the strengths and weaknesses of the case, anticipates the strategy of the other side and chooses the most favourable path. Recommended steps: keep all the evidence (screenshots, emails, devices) without altering it; do not delete or change anything on your devices or accounts; and contact a criminal lawyer specialising in digital evidence as soon as possible.

Source: the firm’s practical guide to evidence in criminal proceedings.

The legal framework: Articles 588 sexies of the Criminal Procedure Act

Since the 2015 reform, the examination of the contents of a mobile phone or of any mass storage device is a specific investigative measure governed by Articles 588 sexies a) to c) of the Criminal Procedure Act. The seizure of the device during a search or an arrest does not by itself authorise access to its contents: a reasoned judicial decision is needed which defines the scope of the examination and its purpose. Only in cases of urgency may the police access the device without prior authorisation, and they must inform the judge immediately, who confirms or revokes the action within a short period. An extraction carried out outside this framework is a breach of the rights to privacy and to the secrecy of communications and leads to the nullity of the evidence under Article 11.1 of the Organic Law on the Judiciary.

What a sound extraction report contains

The technical report accompanying the extraction should identify the device (make, model, serial number and IMEI), the state in which it was received (on or off, locked, in airplane mode or isolated from networks), the tool and version used, the type of extraction performed (logical, file system or physical) and, above all, the hash values calculated on the forensic image at the time of extraction and at the time of analysis, which must coincide. It should also record who performed each operation, when and where, and whether the device was altered in any way before imaging. The absence of a hash, discrepancies between the values, unexplained gaps in custody or the use of a tool without a stated version are the flaws most often exploited by the defence.

Cross-examining the expert

At trial the analyst who prepared the report appears as an expert and may be questioned by the defence, which may also bring its own expert. The questions concentrate on the points that determine reliability: whether the original device or a copy was analysed, whether write-blocking was used, whether the hash was verified before and after each operation, whether the tool is capable of recovering deleted content and, if so, how the dating of messages is established, whether the data attributed to the accused could have been generated by another user of the device or by an application, and whether the analysis went beyond the scope authorised by the judge. Where the answers are unsatisfactory, the court may reject the evidence or, at least, deny it the weight required for a conviction.

Frequently asked questions

Is the digital evidence in my case valid?

It depends on how it was obtained (with court authorisation and proportionately, where required) and on the integrity of the chain of custody.

Can they access my phone or computer?

As a general rule only with consent, court authorisation or a justified emergency; otherwise it may be prohibited evidence.

Is it certain who is behind an account?

Not always: attribution of authorship requires technical verification and is open to argument.

What should I do if I am the victim of a cybercrime?

Keep the evidence (screenshots, emails, transactions) and report it as soon as possible.

Can the police read my phone once they have seized it?

No. Under Articles 588 sexies of the Criminal Procedure Act, access to the contents requires a reasoned judicial decision, except in urgent cases in which the judge must be informed immediately.

Why is the hash value so important?

Because it is the digital fingerprint of the extracted data: if the value calculated at extraction and at analysis coincide, the integrity of the evidence is demonstrated; if it is missing or differs, the reliability of the whole extraction is compromised.

Related guides

• Can the police search your phone without a court order?
• Chain of custody of evidence in Spain
• Interception of communications in Spain

This article is informative in nature and does not constitute legal advice. For a specific case, consult a lawyer.