Deepfakes and AI are undermining the trustworthiness of digital evidence

Full text

AI -generated content and increasingly fragmented communications are changing how organizations assess digital evidence. For investigators, establishing authenticity is becoming as important as analysing the evidence itself.

For years, digital evidence carried an assumption of authenticity. A document was presumed genuine unless there was reason to believe otherwise.

A screenshot reflected a conversation. A photograph captured a moment in time.

But that assumption is becoming harder to sustain.

Advances in artificial intelligence and editing tools have transformed how digital content is created and shared. At the same time, investigations increasingly rely on evidence gathered from messaging platforms , cloud services and personal devices.

Together, these developments have made questions of authenticity far more prominent.

Before evidence can be relied upon, investigators need to understand where it came from, how it was obtained and whether it accurately reflects the underlying source material.

The end of assumed authenticity

Digital evidence remains central to most investigations. Documents help establish timelines and decision-making. Communications provide insight into intent and behavior. Yet both can present challenges that are not immediately visible.

A document may appear final and authoritative while representing only one version of a longer history. Earlier drafts may be unavailable, edits may leave few traces, and supporting material may never be disclosed.

Communications create similar difficulties. Screenshots and message extracts can appear highly persuasive because they seem direct and contemporaneous. Yet they often lack context. Messages may be missing, conversations may be incomplete, and edits or deletions may not be visible.

In some circumstances, entire exchanges can be fabricated before they are ever disclosed. The issue is not that digital evidence has become inherently unreliable. Rather, reliability cannot be assumed simply because something looks convincing.

Why screenshots deserve scrutiny

Screenshots are among the most commonly encountered forms of digital evidence, particularly in workplace investigations and disputes.

Consider two screenshots of what appears to be the same WhatsApp conversation. Both display realistic timestamps, the same participants and a seemingly authentic exchange. Yet the content differs in a crucial respect: one version appears to confirm a contractual agreement, while the other suggests different terms altogether.

To a casual observer, both screenshots may appear equally credible. For investigators, however, the image itself is only part of the story.

Questions about when the screenshot was created, who captured it and whether it can be traced back to the original data source are often more important than the image itself. Without access to the underlying message database , device or backup , it can be difficult to establish with confidence whether a screenshot accurately reflects the original conversation.

This is why screenshots are rarely treated as definitive evidence in isolation. Their value often depends on whether they can be corroborated by the underlying source data.

Deepfakes and synthetic content

The rise of generative AI has added another layer of complexity. Manipulated images and videos are not new, but the tools needed to create them have become far more accessible. Content that once required specialist skills can now be produced in minutes.

While sophisticated deepfakes remain relatively uncommon in most corporate investigations, their existence has changed expectations around digital evidence. Authenticity can no longer be taken for granted.

As a result, organizations increasingly need processes that establish whether content is genuine before it is used to support important decisions.

Testing evidence, not accepting it

In response, investigators are placing greater emphasis on validating evidence before drawing conclusions. The starting point is often provenance: understanding how material was obtained and whether it came directly from a source system. Evidence collected from original sources will generally carry more weight than material provided selectively by individuals.

Investigators also look for signs that content may have been altered. Metadata, file properties and technical inconsistencies can sometimes reveal issues that are not visible at first glance.

Just as important is understanding what may be missing. A message thread viewed in isolation can tell a very different story from the same conversation viewed in full.

These questions help establish how much confidence can reasonably be placed in a particular piece of evidence.

Confidence matters

Digital evidence rarely falls neatly into categories of authentic or inauthentic. More often, investigators are assessing levels of confidence.

A complete WhatsApp conversation extracted directly from a device and verified through forensic analysis will naturally carry more weight than a handful of screenshots supplied by one individual. Both may support the same conclusion, but the strength of the underlying evidence is different.

This distinction is important because investigations often involve decisions being made before every uncertainty has been resolved. Understanding the reliability of the available evidence helps organizations make those decisions on a firmer footing.

Trust in a digital world

Digital evidence remains one of the most valuable sources of information available to investigators. What has changed is the level of scrutiny required before that evidence can be relied upon.

Documents, messages and media files continue to play a central role in establishing facts and understanding events. However, appearance alone is no longer a reliable indicator of authenticity.

As digital content becomes easier to manipulate and generate, investigators need to pay closer attention to where evidence originated and how it can be verified.

In a world where convincing content can be created with increasing ease, trust is becoming a central part of the investigative process.

We've reviewed, rated, and ranked the best cloud document storage .

This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit