Introduction

Evidence lies at the heart of any dispute and investigation. In this installment of Alvarez & Marsal’s Raising the Bar series, we draw on our professional experience to examine the evolution of evidence in disputes and forensic investigations over the last two decades. We focus on how new technologies, regulatory trends in the EU, and the shift toward remote work have disrupted legacy processes and we further explore associated challenges and emerging solutions across the evidence lifecycle, covering acquisition, processing, and analysis.

The Importance of Evidence and Its Preservation for Disputes and Forensic Investigations 

At its heart, a dispute or forensic investigation is a search for truth. Because truth relies on facts, and facts are proven by evidence, the quality of evidence is paramount. Encyclopaedia Britannica defines evidence as “something which shows that something else exists or is true” and “material that is presented to a court of law to help find the truth about something."¹

Given this function, it is critical that evidence and the source data from which it is obtained are preserved from alteration or falsification before, during, and after acquisition. This necessitates the use of preservation holds, a rigorous chain of custody, and specialized forensic verification, validation, processing, and analysis methodologies to ensure and maintain integrity throughout.

Historically, investigators drew evidence from three main sources: human knowledge (by means of interviews and expert opinions), structured data (e.g., extracts from databases), and unstructured data (e.g., electronic files or hardcopy documents). 

However, while the function and purpose of evidence have remained unchanged, its form, acquisition, and subsequent processing and analysis have undergone radical change over the last two decades. During this period, we have seen a shift from a largely manageable set of physical and electronic records to a vast volume of heterogeneous digital data.

A Timeline of Evolution

The Rise of Data Volumes, Data Security, and Data Diversity (Mid-2000s - 2020)

In the mid-2000s, documentary investigational evidence mainly comprised of electronic mailboxes, hardcopy documents, and local hard drives. As part of the ongoing shift from analog to digital, Optical Character Recognition (OCR) was frequently applied to physical files to make them more efficiently searchable electronically. At the same time, OCR came with the challenge of assuring and improving OCR-quality, especially for handwritten documents. Poor OCR quality meant that critical keywords and therefore relevant information could be left undiscovered.

The continuing rise of mobile phone use over traditional landlines shifted the primary function of the telephone from a voice-only tool to a multimedia platform. This, in turn, led to the development of mobile phone forensics, which allowed the acquisition of new, related evidence types such as geolocation and SMS data. A variety of specialist mobile forensics software tools and adapters were required to handle the different types of mobile phones and extract the Electronically Stored Information (ESI) from them. With this, mobile phone forensics took its dedicated space in many forensic labs.

An increasing awareness of data security and cyber incidents led to the widespread use of data-encryption techniques that investigators had to address when accessing electronic evidence. When data decryption keys were lost or withheld, critical evidence could either not be accessed or could be examined only after delays using forensic bypass techniques.

By 2012, the so-called Big Data era had arrived. Technological progress led to exponential growth of data volumes, requiring investigators to use advanced data analytics tools to process the increased volumes that legacy tools struggled to handle.

The rise of blockchain and cryptocurrencies that followed led to new types of evidence requiring expert knowledge and analytics platforms for their acquisition and analysis. Particular challenges arose in tracing the flow of funds and linking specific transactions to real-world individuals and entities.

In 2018, a major regulatory shift occurred in the EU with the introduction of the General Data Protection Regulation (GDPR). While its impact varied across EU member states and depended on preexisting national data protection frameworks, it generally forced a move toward a more targeted data collection approach governed by data minimization. In addition, significant delays could occur because of the involvement of various stakeholders in newly required legal processes. 

Another important regulatory shift in the EU was the mandatory recording of phone calls related to securities trading for certain EU banks. This made phone recordings a more widespread source of evidence, yet it also introduced new hurdles. For example, identifying and allocating recordings to the correct user accounts posed challenges for many institutions, necessitating confirmatory analyses. Furthermore, phone recordings could not readily be searched by traditional search tools. To avoid listening to potentially thousands of hours of audio, investigators had to employ new tools to efficiently analyze and search recordings for relevant content. 

Looking beyond Europe, investigators faced increased complexity because of geopolitical fragmentation. Examples include the favoring of specific and/or encrypted communication and collaboration tools by some countries, which may render acquisition of the underlying evidentiary data impossible. In addition, strict data transfer or access restrictions, imposed by certain countries or internally, e.g., by workers’ councils, further complicated or even precluded data acquisition.

The Impact of the COVID-19 Pandemic (2020-2023)

The COVID-19 pandemic created a lasting shift to remote work and a wide-spread use of collaboration tools which became an important source of evidentiary data. Examples of new challenges arising from the use of collaboration platforms are:

• Single chat messages need to be linked to conversation threads to maintain context and make them efficiently searchable electronically.
• Message edits must be analyzed to investigate message histories.
• Emojis need to be captured as evidence, as they could signal approval or disapproval of the underlying message.
• Attachments used in chats shifted from static documents to dynamic links to other information or file sharing sources. Because these linked documents could have been modified long after they were originally shared, it became necessary to forensically acquire the specific version at the time it was linked. In addition, it became equally important to consider permissions more broadly, as the ability for users to allow or restrict access to documents, data rooms, etc. shifted from being managed purely by the IT department down to the individual user.

In addition, the COVID-19 pandemic also saw social media become more important for the evidentiary record as professional and personal digital lives blurred due to the shift to remote work. On one hand, this meant that firms had to implement new policies on social media use to prevent grey zones that could render the acquisition of potentially private social media data illegal. On the other hand, social media data can be altered easily and, therefore, similar to linked attachments, its timely acquisition is critical. 

The shift to remote work and the use of collaboration tools also broke the traditional acquisition model which focused on a custodian’s mobile, laptop, and electronic mailbox. Today, physical devices are not always accessible, while their contents are often synchronized with a central data repository. Therefore, physical devices are more rarely acquired and instead, investigators take direct extracts from cloud environments and load them into cloud analysis platforms. Bring-Your-Own-Device (BYOD) policies, which became standard for many companies during the COVID-19 pandemic, further contributed to this change.

Lastly, interviews as a source of evidence shifted from face-to-face to remote video conferencing. While this increased scheduling efficiency and reduced travel costs, it negatively affected the ability to build personal rapport with the interviewee and to assess nonverbal cues. In addition, investigators could no longer fully control the interviewee’s environment to ensure confidentiality and privacy. With the lifting of the pandemic restrictions, investigators were able to return to in-person interviews to avoid these issues, particularly for high-stake interviews.

Taking stock of the developments outlined in this article so far, it has become increasingly challenging for investigators to:

• Identify, acquire, and process newly emerging data sources.
• Manage analysis of rapidly increasing data volumes of various data types.
• Combine and overlay information fragmented across various sources, e.g., integrating and reconciling information from voice calls and/or collaboration chats to actual entries in an accounting system or blockchain, to create a complete, contextualized picture and enable fact-based conclusions.

The Impact of Artificial Intelligence (AI) (2023–Today)

We have now entered the era of the wide-spread adoption of AI both in business as well as private life. AI has transformed content creation, and autonomous agents are now capable of achieving goals through multi-functional workflows.

AI offers an unprecedented ability to analyze the vast volumes of evidentiary data faced today and to contextualize them, including by combining and reconciling information from heterogenous sources into an integrated picture from which to draw conclusions.

However, AI also presents a double-edged sword.

For one, AI enables the creation of highly convincing deepfakes and seemingly original documents that challenge the very notion of document integrity and the concept of evidence. Identifying such deepfakes requires investigators to take a much more detailed look, for example, by identifying inconsistent file metadata, email routing discrepancies, and linguistic anomalies and visual inconsistencies in images and videos. 

Furthermore, the black-box nature of AI can make it difficult to explain its outputs - a key requirement for evidence to remain reliable and defensible. Organizations can address this challenge by: 

• Documenting prompts used for generative AI. This turns AI prompts themselves into a new category of investigative evidence.
• Using AI that provides reasoning for its decisions and references the original source data on which those decisions are based.
• Conducting human review and validation of AI generated results.
• Employing technical experts to explain AI algorithms.

AI has also changed how we collect evidence, for example:

• AI chat histories are usually stored in the cloud and require specialized forensic tools and scripts for acquisition, inter alia to also include the exact AI model prompted. AI chat histories can also be partially retrieved through computer memory imaging and browser artifact analysis.
• Log analyses must be performed to prove which documents were uploaded to AI systems.

From a regulatory perspective, the extensive and fast-paced evolution of AI is also keeping forensic investigators on their toes. Entering into force in 2024, the EU AI Act introduced new standards for the use of AI technology, with regulations phased in until 2030.² While independent investigators are not expected to fall under the more stringent requirements for justice and law enforcement (unless directly engaged by these authorities), they should ensure adequate risk management, data governance, transparency, explainability, and human oversight.³ Only by doing so can investigators ensure that AI-generated evidence is of high quality, remains admissible, and survives adversarial challenges.

Conclusion

Driven mainly by globalization and rapid technological advancement over the past two decades, the volume and variety of evidentiary data have surged, and evidence is now predominantly digital.

This shift necessitates specialized expertise, tools, and techniques for analysis, including big‑data platforms, mobile device forensics, blockchain analytics, and solutions for chat, voice, and video recording analysis.

Investigators must integrate heterogeneous data from diverse sources to construct a coherent, holistic evidentiary picture suited to address the key questions in a dispute or forensic investigation.

In parallel, increasingly stringent data-protection and transfer regimes, jurisdictional fragmentation of data sources, and the emergence of centralized cloud-based data repositories and new evidence types have radically changed evidence acquisition and often require coordination with legal, regulatory, and technical specialists.

The rapid emergence of AI in the last two years has been transformative: it enhances the ability to process and analyze high-volume, heterogeneous evidence, which now has become the norm, but also enables the fabrication of increasingly convincing false evidence (e.g., deepfakes) that can be difficult to detect. It also will be key to explain AI outputs for evidence to remain reliable and defensible.

As a result, the acquisition, processing, and analysis of evidence for disputes and forensic investigations have become a multidisciplinary team endeavor involving investigators, specialized technologists, legal, regulatory, and subject-matter experts. Furthermore, new data governance policies and procedures need to be implemented to manage these evolving complexities, and it is critical that these frameworks safeguard data integrity and quality.

If the challenges posed are successfully navigated, organizations can unlock greater efficiency, reducing time and cost, while simultaneously strengthening the evidentiary record for any dispute and forensic investigation.

The views and opinions expressed in this article are those of the authors.

References

[1] Encyclopaedia Britannica Dictionary, under “evidence,” accessed May 15, 2026, https://www.britannica.com/dictionary/evidence 

[2] Cf. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act), articles 111, 113.

[3] Marcinowski-Prażmowski, M. (2025) ‘Forensics under the Artificial Intelligence Act’, Forensic Science International, 380, article number 112775.