Meaning
Procedural steps taken to secure digital data at the time of a suspected breach ensure that the resulting files remain admissible during formal litigation or administrative review. Effective electronic evidence preservation captures metadata, logs and file content in a way that prevents subsequent alteration and proves the state of a system at a specific moment. It stops applying once the data has been hashed and stored on a trusted platform or when the storage media has been decommissioned without a secure backup.
Within the Chinese legal framework, this process is governed by the Civil Procedure Law and the specific evidentiary rules of the Internet Courts.
Data Capture
Collection of digital information must happen immediately after an incident is detected to avoid the overwriting of temporary files or cache data. This electronic evidence preservation involves creating bit-for-bit copies of hard drives or capturing live network traffic before any corrective action is taken. The process must be documented by a neutral third party or through an automated system that generates a verifiable log of the capture event.
Using a simple screenshot is often insufficient in Chinese courts because it does not include the underlying source code or the server logs that prove where the image originated. A forensic expert often uses specialized software to ensure that the integrity of the original data is maintained during the transfer. The resulting image file is then hashed, and this hash value is used to verify the evidence in the future.
Notarial Intervention
Notary offices in China provide a high-tier service for the preservation of digital evidence by witnessing the access and recording of the data. When a notary officer observes an investigator logging into a system and downloading files, the resulting notarized report carries a presumption of authenticity that is difficult to challenge. This form of electronic evidence preservation is particularly useful for capturing website content or social media posts that can be deleted in seconds.
The notary office provides a secure environment and a neutral observer who can testify that the process followed the legal requirements. This service has been expanded to include mobile applications and cloud storage, allowing for a more flexible approach to modern data sources. The cost of this service is often recoverable as part of the legal fees in a successful lawsuit.
Evidentiary Weight
The strength of the preserved data depends on the chain of custody and the technical standards used during the capture. Chinese courts evaluate electronic evidence preservation based on the reliability of the system used and the degree to which the data could have been manipulated. If the plaintiff preserved the data using their own internal IT department without independent verification, the court might view the evidence as a mere private record.
To achieve the status of conclusive evidence, the data should ideally be stored on a blockchain or a court-certified platform. This ensures that the record is immutable and that the court can verify its authenticity without a separate forensic audit. The boundary of this weight is the ability of the opposing party to show a flaw in the preservation software or a gap in the logging sequence.
A failure to preserve data correctly often leads to the loss of a case, even if the underlying claim of infringement or breach is true. The court has no obligation to accept data that has been handled in a way that allows for tampering.
