Digital evidence in a criminal case: the path from incident to courtroom

Digital evidence is useful in a criminal case only if you can show where it came from, that it was not altered and who handled it from collection to filing. That requires fast preservation, full copies with cryptographic hashes, a register of every operation and a technical analysis that anyone can verify.

Key points

• Computer data disappears quickly: logs are overwritten, accounts are closed, messages are deleted. The first days matter more than the first months.
• The integrity of digital evidence is demonstrated through cryptographic hashes calculated at collection and through the chain of custody.
• The Romanian Code of Criminal Procedure provides for the preservation of computer data (art. 154), the search of computer systems carried out by a specialist (art. 168) and the handover of computer data (art. 170).
• Offences under articles 360-366 and 325 of the Criminal Code fall under DIICOT, the specialised prosecution directorate, whether or not an organised group is involved; computer fraud (art. 249) reaches DIICOT only when linked to an organised criminal group.
• The injured party can file a complaint and propose evidence. Solid technical documentation makes that proposal easier to assess.

What is digital evidence and why is it fragile?

In cybercrime, almost everything that matters exists as data: server logs, e-mail headers, sign-in history of a cloud account, an executable file, a messaging conversation, document metadata. Unlike a physical object, this data can be changed without visible traces, can vanish automatically after a retention period, or can be altered unintentionally by the very people trying to save it.

The classic example: after an incident, the system administrator opens the affected computer, browses through files, runs an antivirus scan and then reinstalls it. Each step changed file access times, erased traces from memory and finally removed any chance of reconstruction. The intention was good; the result is lost evidence.

The DNSC annual report for 2025 shows why this is no longer a niche topic: ransomware grew by 153%, account compromise reached 1,125 incidents (more than four times the 2024 figure), and fraud and attempted fraud reached 3,937. Many of these cases end up, sooner or later, in front of a prosecutor.

Chain of custody: “who touched the evidence?”

The chain of custody is the documentation that follows evidence from collection to filing. For every transfer or operation it records:

• what was collected (device, account, file, log export);
• from where, when and by whom;
• with which tool and method;
• the cryptographic hash calculated at collection;
• where it was stored and who had access;
• every later operation, with time and responsible person.

Why does the hash matter?

A hash function such as SHA-256 produces a unique value for any file or disk image. Change a single bit and the value changes completely. Calculated at collection and recalculated during analysis or in court, the hash shows that the examined data is identical to what was collected. Without it, any objection about integrity becomes hard to answer.

What does the Code of Criminal Procedure provide?

Without entering legal interpretation, which belongs to lawyers and prosecutors, several procedural tools are central for digital evidence:

Tool	CCP article	In short
Preservation of computer data	art. 154	The holder keeps data (including traffic data) when there is reasonable suspicion; the prosecutor can extend the measure once
Search of a computer system	art. 168	Examination of a system or storage medium, carried out by a specialist
Handover of objects, documents or computer data	art. 170	The holder is required to hand over the requested data

For the victim, the practical conclusion is simple: authorities can order these measures, but they work only if the data still exists. A company that exported logs in time, kept full copies and documented the incident gives the prosecutor material those measures can build on.

Where the case goes: DIICOT’s competence

Law 508/2004, article 12, sets DIICOT’s competence. Two situations stand out:

• Offences against the security of computer systems and data (articles 360-366 of the Criminal Code: illegal access, illegal interception, altering data integrity, disrupting system operation, unauthorised data transfer, illegal operations with devices or programs) and computer forgery (art. 325) fall under DIICOT regardless of whether an organised criminal group was involved.
• Computer fraud (art. 249, 2 to 7 years) and the other acts in articles 249-252 go to DIICOT when committed for the purposes of an organised criminal group. Otherwise, they remain with the ordinary prosecutor’s offices.

A public example: after the ransomware attack on Apele Române in December 2025, the criminal case was registered with DIICOT’s central structure on 22 December 2025, following the authority’s complaint.

Practical steps for a victim company

1. Stop unplanned interventions. Nobody reinstalls, formats or “cleans” affected systems before preservation.
2. Isolate, do not shut down. Disconnect systems from the network but keep them running if possible.
3. Export volatile logs. Cloud services, firewalls, VPNs and mail servers sometimes keep logs for only a few days.
4. Make full copies and calculate hashes. Disk and memory images, not just copies of a few files.
5. Open the custody register in the first hour.
6. Keep attacker communications in original format (with headers, not just screenshots).
7. Request a technical analysis that reconstructs the incident and separates facts from hypotheses.
8. Involve your lawyer before filing, so they decide what is submitted and how.

When the file becomes too large: the role of document analysis

In complex cases the problem is no longer missing evidence but its volume. A fraud or cyberattack case can include thousands of pages, hundreds of e-mails, bank account exports, system logs and audio-video recordings. The lawyer needs to find contradictions, gaps and links between documents quickly.

Independent technical analysis plays two roles here: it checks technical facts (what a log actually shows, whether an e-mail comes from where it claims, what metadata proves) and it organises the material into a verifiable chronology, with each statement traced to its source. The difference between an assertion and a data-backed finding is often the difference between an argument that is dismissed and one that is heard.

More on this stage in our article on large case file analysis, chronology and digital evidence.

How ProDefence can help

For companies and individuals affected by an incident, our cybercrime investigation service follows five stages: intake, preservation, analysis, documentation, remediation. Our role is technical: to establish what happened and document the evidence. We deliver a technical report, evidence documented in a form usable in criminal proceedings, indicators of compromise and technical support during the proceedings, at the client’s or the authorities’ request. The decision to refer the case is yours.

For lawyers, legal departments and compliance teams, ProCIS (procis.ro) turns large case files into verifiable information on three levels:

• Case file foundation: inventory, identification of each document, reconciliation with the index, factual summary;
• In-depth analysis: factual chronology, index of persons and entities, links between documents, version comparison, discrepancies and gaps;
• Investigation and technical analysis: electronic messages, files, metadata, system logs, including ransomware and other cybercrime cases.

Every file receives a cryptographic hash on receipt, every operation is logged, and AI tools only work on pseudonymised material, with analyst review. ProCIS does not provide legal advice and does not assess admissibility: the lawyer decides what is filed. ProCIS is currently contracted in Romanian; requests go through procis.ro.

Frequently asked questions

Sources

• Law no. 508/2004 on DIICOT, art. 12, legislatie.just.ro
• Romanian Criminal Code, articles 249, 325, 360-366
• Romanian Code of Criminal Procedure, articles 154, 168, 170
• DNSC, Annual Activity Report 2025 (August 2026)
• Public statements on the attack against Administrația Națională “Apele Române” (December 2025)

Alexandru Angheluș, ProDefence. Cybersecurity specialist who leads technical investigations of cyber incidents and case file analysis through ProCIS.