Digital Evidence Management System: What It Is and What It Does

A single arrest can produce body-worn video, dash-cam footage, CCTV from nearby businesses and a full extraction of a suspect's phone. Each file has to reach the courtroom unchanged, with a record of everyone who handled it.

What is a digital evidence management system?

A digital evidence management system (DEMS) is software that collects, stores and organizes digital evidence, such as video, photos, phone extractions and documents, by case. A DEMS controls who can open each file, records every action taken on it, and lets agencies share evidence with prosecutors and defense counsel without breaking the chain of custody.

Digital evidence management is the wider practice of handling digital evidence from capture to disposal. A DEMS is the system that carries out that practice and keeps the record of it.

Types of evidence a DEMS holds

• Video: body-worn camera, dash-cam, CCTV and interview room recordings.
• Phone extractions: forensic copies of the data on a mobile device, with any report the extraction tool produces.
• Photos: scene, injury and property images.
• Documents: statements, reports, warrants and records received from third parties.

What a DEMS does across the evidence lifecycle

1. Collect: evidence comes in from officers' devices, interview rooms, forensic tools, businesses and the public.
2. Store: files are kept encrypted in their original form, with room for large video files.
3. Manage by case: each file is linked to a case, so everything about an incident is in one place.
4. Share: investigators, partner agencies and prosecutors get access to what they need, with permissions per person or group.
5. Disclose: defense counsel receive evidence during discovery, with a record of what was provided and when.
6. Retain: files are kept as long as law and policy require, then disposed of under a documented process.

Chain of custody and audit trails

Chain of custody is the documented history of a piece of evidence: who collected it, who handled it, where it was kept and whether it changed. Under Federal Rule of Evidence 901(a), the party offering an item of evidence must show that it is what they claim it is. For digital files, two records support that showing.

• A hash value: a fingerprint calculated from a file's contents with an algorithm such as SHA-256, from NIST's Secure Hash Standard (FIPS 180-4). If the file changes, the hash changes. Since December 1, 2017, Federal Rule of Evidence 902(14) has let copied data be authenticated by a qualified person's certification of a process of digital identification, which the advisory committee's note says is ordinarily a hash comparison.
• An immutable audit trail: a log of every view, download, share and access change, showing who acted, on which file and when, that no user can edit or delete.

Our article on chain of custody shows how the chain breaks in practice.

Sharing evidence through access, not copies

In the US, prosecutors must disclose evidence favorable to the accused that is material to guilt or punishment, a duty set out in Brady v. Maryland, 373 U.S. 83 (1963). Rule 16 of the Federal Rules of Criminal Procedure governs discovery in federal cases, and each state has its own discovery rules.

Meeting those duties with discs or USB drives creates a copy for every recipient, and each copy leaves the agency's audit trail. A DEMS instead gives prosecutors and defense counsel access to the same record investigators work from, with a permission level, an end date and a log of what each person viewed or downloaded.

Why on-premises servers, USB drives and discs fall short

• On-premises servers: the agency buys storage in advance, maintains and secures the hardware itself, and must export copies or open its network to share with outside parties.
• USB drives and discs: they can be lost, damaged or copied without a record, and their fixed capacity limits how much video they hold.
• Email: attachment limits are often too small for video, and messages can be forwarded with no record in the agency's systems.

None of these keeps one complete log of who handled a file, and chain of custody depends on that log.

DEMS vs shared drives, USB drives and email

What to look for in a DEMS

• Access control: permissions by user, group, agency and case, and two-factor authentication.
• Audit trail: an immutable, exportable log of every view, download, share and permission change.
• Integrity checks: hash values recorded at collection and verifiable later.
• Encryption: modules certified under FIPS 140-3, or AES with 256-bit keys as defined in FIPS 197, the two options the CJIS Security Policy accepts.
• CJIS Security Policy: controls that support the FBI's requirements for criminal justice information (see our guide to CJIS compliance).
• External sharing: access for prosecutors and defense counsel without copies, and a way for the public to submit files.
• Retention: rules by case or evidence type, with a record of disposal.
• Hosting and exit: where evidence is stored, and how you get it out in its original form.

Does your agency need a DEMS?

An agency needs a DEMS when it handles more digital evidence than it can track by hand. Common signs are evidence spread across drives, discs and devices, chain of custody kept on paper, and disclosure that depends on making copies. Disclosure duties apply to agencies of every size.

Where DekkoDEMS fits

DekkoDEMS collects, stores, shares and discloses digital evidence, with a record of every action on each file and immutable audit trails on every file and case. Prosecutors and defense counsel get access to evidence instead of copies, citizens and partner agencies can submit evidence through a secure link or QR code with no account, and evidence is encrypted with AES-256. Weber County, Utah moved more than 130 TB of evidence into DekkoDEMS: read the Weber County case study.

Common questions

Frequently Asked Questions