Digital Evidence Toolbox
Free Digital-Evidence Resources for Defense Attorneys & Investigators
The Digital Evidence Toolbox is the central working resource of the National Digital Evidence Readiness Framework for Public Defense, developed by the Digital Innocence Initiative (DII).
Early and independent assessment allows the defense to identify time-sensitive and missing evidence, evaluate what law enforcement collected, and determine when qualified forensic assistance is needed. Used early, the framework preserves opportunities to prove innocence and prevent wrongful convictions.
Assess–Baseline–Collect
The Toolbox organizes its working resources around Assess–Baseline–Collect, a repeatable process for moving from identification to informed action.
1. Assess: Identify, Map & Triage
Start by identifying potential digital-evidence sources and determining what requires immediate attention.
The assessment resources help the defense identify what may exist, where it may be found, what may disappear, what law enforcement collected or did not collect, and what should happen next.
Digital Evidence Standards & Best Practices →
Digital Forensics Standards & Accreditation →
Digital Evidence Admissibility & Rules of Evidence →
Post-Conviction Digital Evidence Review →
2. Baseline: Understand the Evidence & Determine What Is Needed
After identifying the potential evidence, establish the case baseline.
The evidence-discipline resources help the defense understand what the evidence may contain, what was actually obtained, what methods were used, what may be missing or inaccessible, what limitations matter, and whether additional examination or qualified assistance may be warranted.
Computer Forensics & Data Recovery →
Mobile Forensics & Cell Phone Data Extraction →
Call Detail Records & Cell-Site Analysis →
GPS & Location Data Forensic Analysis →
Audio & Video Forensic Analysis →
Social Media Forensics & Online Evidence →
3. Collect: Preserve, Obtain & Evaluate
Once the defense understands what may exist and what is needed, use the collection resources to preserve and obtain the evidence through the appropriate legal, investigative, or technical process.
These resources also help the defense evaluate whether the material produced is complete and whether the underlying source evidence and technical documentation have been provided.
Digital Evidence Retention Schedules & Preservation Letters →
Digital Evidence Service Provider Subpoena Guides & Templates →
Digital Evidence Discovery Motions & Templates →
Digital Evidence Can Prove Innocence—If the Defense Finds It
Digital evidence can corroborate an alibi, establish location or movement, document communications, identify another person, test a timeline, challenge attribution, expose missing evidence, or contradict an investigative theory.
The defense should not begin with the assumption that the relevant digital evidence is limited to what appears in discovery.
A source that would normally be expected but is absent should be examined early. It may not support the prosecution, may never have been sought, or may no longer have been available when someone finally looked for it.
The earlier the defense identifies the source, the greater the opportunity to preserve and evaluate it before that opportunity is lost.
Use the Toolbox Throughout the Life of the Case
The same assessment approach applies across the life of a criminal case.
Active Cases
Use the Case Assessment Checklist and Time-Sensitive Digital Evidence Guide early to identify sources, preservation risks, missing evidence, and immediate next steps.
Discovery & Litigation
Use the discipline guides, standards, provider resources, discovery materials, and admissibility guidance to evaluate what was collected, what was produced, and whether the evidence supports the conclusions being offered.
Post-Conviction Review
Use the Post-Conviction Digital Evidence Review resources to examine older evidence, missing records, prior forensic limitations, surviving devices or source data, and opportunities for renewed examination using current methods.
Individual Toolbox Access & DERU Agency Partnership
The Digital Evidence Toolbox is the practical individual entry point for eligible defense professionals.
The Digital Evidence Review Unit (DERU) is the agency-level pathway for public defender offices that want to introduce the same resources through a repeatable office process.
A public defender office that joins DII as a DERU partner also becomes part of the Digital Innocence Coalition and receives access to the approved DERU partner resources and coalition pathway.
Learn About the DERU Partnership →
Begin With the Next Case
Digital-evidence readiness does not require the defense to build a forensic laboratory or become expert in every technology.
It begins by asking the right questions early:
What digital evidence may exist?
Where can it be found?
What may disappear?
What did law enforcement collect—or fail to collect?
What should the defense do next?
Explore the National Digital Evidence Readiness Framework →
Digital Evidence Toolbox
Part of the National Digital Evidence Readiness Framework, developed by the Digital Innocence Initiative (DII), the Digital Evidence Toolbox provides practical resources for defense attorneys and investigators to identify, preserve, understand, collect, evaluate, and challenge digital evidence.
Build digital-evidence readiness from investigation through litigation and post-conviction review.
Learn More About DII
Learn how the Digital Innocence Initiative advances practical approaches to digital evidence to prevent and overturn wrongful convictions.