Hash it early. Prove it later.

// 01The screenshot gets in. Then what?

Most digital evidence disputes we see in Ontario are not about whether a message exists. They are about whether the version in front of the court is the whole of it. A screenshot taken by a party, cropped by a party and explained by a party says exactly what that party wants it to say. That is not an accusation. It is just the shape of a screenshot.

The Ontario Court of Appeal has been consistent on the first half of the problem. In R. v. Shaw (2023) and again in R. v. M.S.A. (2024) the court said the authentication threshold for electronic documents is low, direct or circumstantial evidence will do, and arguments about possible alteration usually go to weight, not admissibility. A witness saying "yes, that is the text I received" is enough to get it in.

The second half is where it gets interesting. In R. v. N.G. (2023) the same court upheld the exclusion of a WhatsApp printout because the party offering it had controlled the phone and could not show the printout was a complete record. Completeness, in that case, was an admissibility question. And in 2025 an Ontario criminal trial that made national headlines saw a text message kept out, not because nobody could say who sent it, but because the court was not satisfied it was reliable enough to act on.

Authentication opens the door. Reliability decides whether you get a chair.

Civil practice is moving the same way. Ontario's civil rules reform, expected to start rolling out in 2026, pushes parties toward an up-front evidence model: show your documents and witness statements early. Good news if you already hold a verified copy. Bad news if the plan was to sort out the phone later.

// 02What a custody ledger actually records

People imagine chain of custody as an evidence bag with a signature across the seal. That is part of it. The useful part is a ledger, and a ledger is just answers to five questions, asked every time the evidence moves: who, what, when, where and why.

Who received it and from whom. What exactly: make, model, serial, condition, powered on or off, locked or not. When, to the minute, in Eastern time and labelled, because the other side's expert is in Vancouver and the server logs are in UTC. Where: a sealed bag, a locker, a target copy on KLUETEK in-house storage. Why: acquisition, verification, processing, production, return.

The ledger is boring on purpose. A custody record that reads like a thriller has something to explain. We want each line so dull that opposing counsel skims it, finds nothing and moves on.

// 03Hashes are seals, not truth serum

A hash tells you the copy you are looking at is identical, bit for bit, to the copy hashed before. That is all. It does not tell you the phone's owner was honest or that the timestamps are right. Hashes answer "is this the same data?" and leave "is this data true?" to the rest of the case.

That narrow job is why hashes work so well in court. The question is yes or no, anyone can repeat the computation, and the number sits in the report for the other side's expert to check. When we hand over an image we hand over its SHA-256 and, for older workflows, an MD5. Illustrative only, a SHA-256 looks like 9f2c…a41b: sixty-four hex characters that will not match if a single byte differs.

Where it falls down is when the hash is computed too late. A hash of a screenshot proves the screenshot has not changed since somebody took it. It proves nothing about the phone. A hash of exported emails proves the folder has not changed since the export, and nothing about what was left out of it. The hash has to be taken where the evidence first becomes a fixed thing, as close to the original device as the law and the circumstances allow.

Hash at the source. Verify at every arrow. Write both down.

// 04Where chains break, in the order we see them

Most breaks are not malice. They are convenience. Someone wanted to help and helped in the wrong order.

The IT person who "had a look" at the laptop before calling anyone, so every file they opened now carries a fresh access time. The phone that went back into daily use after counsel said to keep it safe, so the deleted-message recovery has to explain six weeks of overwriting. The mailbox export on a shared drive that three paralegals touched, each renaming the folder slightly. The "I'll just email you the files" moment that stripped the metadata that was the whole point.

Cloud evidence has its own version. A Microsoft 365 collection has no device to bag, so the chain is built from logs: the audit record showing who ran the search and when, the export manifest, the hash of each container as it lands on in-house storage, and the examiner's notes. Skip the audit record and you have a folder of PSTs with a story attached. Keep it and you have a collection you can defend line by line.

Data recovery jobs cross the same line more often than people expect. A drive comes in for recovery, the files turn out to matter in a dispute, and now the question is whether the recovery altered anything. So we image before repair, hash the image and work on the copy. Every time.

// 05Making it stand up

The courtroom test is simple. Can one person, under oath, walk the exhibit from the device to the binder without saying "I assume" or "someone must have"? If so, the chain holds. If the answer involves three people and a group chat, it does not.

That is why the examiner's affidavit matters more than the evidence bag. Ours follow the ledger: what we received, from whom, when in Eastern time, in what condition; how we acquired it and with which tools and versions; the hashes recorded at acquisition and verified at each later step; that a target copy and a working copy were held on KLUETEK in-house storage with the target left untouched; who accessed the working copy and why; and what was done to produce the exhibits. Nothing the examiner cannot personally vouch for. Nothing an opposing expert cannot reproduce.

On mobile matters the acquisition is done by Cellebrite-certified staff (CCO and CCPA), and the UFED extraction log and its hashes go into the file beside our ledger, because two independent records of one event are harder to argue with than one. On cloud matters the M365 export logs play the same role. Every production set we send carries a manifest with per-file hashes, so the receiving party can prove what they got and we can prove what we sent. For expert work the same ledger feeds the demonstratives: a timeline showing custody events next to evidence events is often the most persuasive page in the binder.

// 06The runbook we hand over

This is the one-page version counsel gets on day one. It assumes a dispute is foreseeable and nothing has been collected yet.

1. Stop the clockIsolate the device or account from networks and sync the moment a dispute is foreseeable. Airplane mode, Faraday bag or power off. Note the time in Eastern time, labelled.
2. Record the handoverLog who handed over what, when, where and in what condition. Photograph the device, screen, serial and seals. Get the passcode in writing, or the refusal in writing.
3. Acquire with a verified toolImage the device or export the tenant with a forensic tool that writes its own log. Write blocker or read-only method wherever the media allows. Record tool and version.
4. Hash at the sourceCompute SHA-256 (and MD5 if the workflow needs it) the moment acquisition finishes. Put the values in the ledger and the report.
5. Split target and working copiesTarget copy untouched on in-house storage. Work only from a verified working copy. The target is what goes to court if anyone asks for "the original image".
6. Verify at every transitionRe-hash before processing, before production and before any transfer. Log the match. A mismatch is a stop-work event, not a footnote.
7. Keep the ledger continuousEvery access, transfer and re-verification gets one line: name, purpose, time in Eastern time. Dull is the goal.
8. Package for the courtroomExhibit, hash, acquisition log, ledger and an examiner's affidavit that read together as one story. Build any custody timeline from the ledger, not from memory.

// 07Questions we get asked

Case references are to reported Ontario Court of Appeal decisions and public trial coverage. Hash values shown are illustrative. Engagement details, where mentioned, are composites with names and indicators redacted. Field note, not legal advice.