The expanding evidence surface

For years, “digital evidence” meant a computer, and later a phone. That is no longer the boundary. The record of what someone did, where they were and who they spoke to is now spread across cloud accounts, wearables and a growing field of connected devices — and each of them can matter in a dispute.

Where the evidence lives now

Much of the relevant data is no longer on the device at all. Messages, photos, location history and documents sync to cloud accounts that may hold more than the handset itself. A smartwatch can place a person and timestamp their activity. Vehicle systems, smart-home devices and other connected hardware quietly log events. Individually these are fragments; together they can corroborate — or contradict — an account of events.

More sources, more complexity

A wider evidence surface is not simply more of the same. Each source has its own formats, its own retention behaviour and its own access requirements, and cloud data raises questions of jurisdiction and authority that on-device data does not. Collecting it defensibly takes the right tooling and, more importantly, the judgement to know what is reliable and what is not.

• Cloud accounts often retain more than the device — and on their own schedule.
• Wearables and IoT devices add independent, timestamped corroboration.
• Each source needs a collection method that preserves integrity and provenance.
• Scope matters: the goal is the relevant record, not everything that exists.

What it means for litigation

For practitioners, the practical shift is that early scoping is more valuable than ever. Knowing which sources are likely to hold relevant material — and which can be preserved before they expire — shapes both strategy and cost. Casting too wide a net is expensive; missing a source can be worse.

The principle has not changed: find the relevant record, preserve it defensibly, and explain it clearly. The surface it lives on simply keeps growing.