Requirements for investigation and evidence collection of electronic data evidence

Electronic data includes the following information and electronic files: information published by web pages, blogs, Weibo and other network platforms; Communication information of network application services such as short messages, emails, instant messaging and communication groups; User registration information, authentication information, electronic transaction records, communication records, login logs and other information, etc. Article 14 of the Supreme People's Court's Provisions on Evidence in Civil Proceedings stipulates that electronic data includes the following information and electronic documents: (1) information published by web pages, blogs, Weibo and other network platforms; (2) Communication information of network application services such as short messages, e-mails, instant messaging and communication groups; (3) User registration information, identity authentication information, electronic transaction records, communication records, login logs and other information; (four) documents, pictures, audio, video, digital certificates, computer programs and other electronic files; (5) Other information stored, processed and transmitted in digital form that can prove the facts of the case.

Legal basis:

Provisions on Several Issues Concerning Handling the Collection, Extraction, Examination and Judgment of Electronic Data in Criminal Cases Article 6 Electronic data collected and extracted during the initial investigation, as well as electronic data extracted online through the Internet, may be used as evidence. Article 7 The collection and extraction of electronic data shall be carried out by two or more investigators. The method of obtaining evidence shall conform to the relevant technical standards. Article 8 If the original storage medium of electronic data can be seized by collecting and extracting electronic data, the original storage medium shall be seized and sealed, and a written record shall be made to record the sealed state of the original storage medium. The original storage medium of electronic data shall be sealed, and it shall be guaranteed that electronic data cannot be added, deleted or modified without releasing the sealed state. Before and after sealing, the sealed original storage medium should be photographed to clearly reflect the sealing or sealing. When storing storage media with wireless communication functions such as mobile phones, measures such as signal shielding, signal blocking or power off should be taken. Legal basis: Article 93 of the Supreme People's Court's Interpretation on Several Issues Concerning the Implementation of the Criminal Procedure Law of People's Republic of China (PRC) should focus on the following contents: (1) whether electronic data such as e-mail, electronic data exchange, online chat records, blogs, micro-blogs, mobile phone short messages, electronic signatures and domain names are transferred with the original storage medium; When the original storage medium cannot be sealed, it is inconvenient to move, or it should be kept, processed and returned by the relevant departments according to law, whether the extraction and copying of electronic data are carried out by more than two people, whether it is enough to ensure the integrity of electronic data, and whether there is a written explanation and signature on the extraction and copying process and the storage location of the original storage medium; (2) Whether the collection procedures and methods comply with laws and relevant technical specifications; Whether the electronic data collected through investigation activities such as inquest, inspection and search are accompanied by transcripts and lists, and signed by investigators, electronic data holders and witnesses; If there is no signature of the holder, whether to indicate the reason; If overseas or remote electronic data are retrieved remotely, whether relevant information is indicated; Whether the specifications, categories and file formats of electronic data are clearly marked; (3) Whether the content of electronic data is true, whether it has been deleted, modified or added, etc. ; (four) whether the electronic data is related to the facts of the case; (five) whether the electronic data related to the facts of the case are fully collected. If there is any doubt about electronic data, it shall be identified or checked.