Text messages, location records, body-camera footage, deleted files and email threads now run through criminal, civil and family cases alike, and any of them can decide the outcome. We treat digital evidence as part of every case and take it very seriously. Data recovery, phone and computer forensics, video and audio analysis and expert witness testimony are carried out by our forensic partner, EBOXLAB / Denver Data Recovery, under attorney direction.

Digital forensics is not an add-on here. It is built into how we defend clients and prove claims.
Phones, computers, cloud accounts, cameras and cars record more than anyone remembers. Automatic deletion and routine overwriting do not wait for a court date, so the first conversation about any case includes what digital evidence exists and how to preserve it.
Examinations are performed by our forensic partner, EBOXLAB / Denver Data Recovery, under the direction of your attorney: forensic imaging, hash verification, a documented chain of custody, a written report and, when the case needs it, expert witness testimony.
When the other side relies on texts, video or location records, we ask whether each item is complete, original and what it claims to be, and we put that question to the court when the answer is no.
CRE 901(a) makes authentication a condition precedent to admissibility: evidence sufficient to support a finding that the item is what its proponent claims. The showing is prima facie and, in the Court of Appeals’ words, “not high.” For emails, texts and social-media posts, Colorado courts use CRE 901(b)(1), a witness with knowledge, and 901(b)(4), distinctive characteristics.
The leading case, People v. Glover, 2015 COA 16, rejected a business-records theory for Facebook messages under CRE 902(11) and 803(6) and affirmed on 901(b) circumstantial evidence instead: an account in the defendant’s name, a phone number verified by Facebook, his nickname in the chat. The same approach applies to texts and emails, and the real question is who wrote the particular messages. A party’s own messages come in against that party under CRE 801(d)(2)(A), which is not hearsay.
| Topic | Federal court | Colorado state court |
|---|---|---|
| Self-authenticating electronic records | FRE 902(13), (14) since Dec. 1, 2017 | Not adopted; CRE 902 ends at (12). Tabled by the rules committee Nov. 1, 2019, not revisited |
| Sanctions for lost ESI | FRCP 37(e) | No Rule 37(e); common-law spoliation, Aloi v. Union Pacific (Colo. 2006) |
| ESI discovery mechanics | FRCP 34(b)(2)(E) form of production | C.R.C.P. 16(b)(15) only; no form-of-production rule in Rule 34 |
| Proportionality | FRCP 26(b)(1), Dec. 1, 2015 | C.R.C.P. 26, July 1, 2015, same six factors |
| AI-generated evidence | No Rule 707 in the current rules; the proposed rule is not on the pending track | Authentication under CRE 901 |
Colorado’s only ESI-specific rule lives in the case management order, not Rule 26. If significant electronically stored information is expected, the order must state the parties’ agreements on search terms, preservation, form of production and cost; if they disagree, it records each position and no default rule breaks the tie. Rule 16.1 simplified-procedure cases have no ESI provision at all.
Discovery must be relevant to a claim or defense and proportional to the needs of the case, six factors Colorado adopted July 1, 2015, ahead of the federal rule. Absent good cause: 30 interrogatories and 20 requests for production per adverse party, and 35 days to respond under Rule 34.
Colorado has no Rule 37(e). Sanctions for lost evidence rest on the court’s inherent power under Aloi v. Union Pacific Railroad Corp., 129 P.3d 999 (Colo. 2006): willful destruction after notice that the evidence would be relevant supports an adverse-inference instruction; bad faith is not required. Union Pacific lost by letting a routine 92-day deletion cycle run after notice of a claim.
Since Riley v. California, 573 U.S. 373 (June 25, 2014), police generally may not search the digital contents of a phone seized at arrest without a warrant; the Court refused to extend the search-incident-to-arrest doctrine to phone data. Was there a warrant, and what did it authorize?
Carpenter v. United States, 585 U.S. 296 (2018), made obtaining historical cell-site location records a search that generally needs a warrant. Colorado got there first: C.R.S. § 16-3-303.5, effective June 6, 2014, requires a warrant, subpoena or court order for device location information, with exceptions such as consent and exigent circumstances. Evidence obtained in violation is inadmissible and cannot support a probable-cause affidavit; the warrant and affidavit must be disclosed to the defense before it is admitted.
Rule 16 speaks of statements, documents and electronic surveillance; it does not name texts, emails or body-camera footage, and Colorado courts are split on how far it reaches. Proposals to name electronic communications, add a duty to confer before sanctions and move the prosecution’s initial-disclosure deadline from 21 to 35 days are pending before the Supreme Court’s criminal-rules committee; as of September 2026, none is adopted.
No family-law-specific rule covers electronic evidence: C.R.C.P. 16.2 sets its own mandatory disclosures for divorce and parental-responsibility cases and, beyond that package, sends the parties to Rules 26 through 37. Texts, photos, location history and posts come in, or stay out, under the same authentication and hearsay rules as anywhere else. If the other side has deleted messages, the route is discovery through counsel, not self-help.
Recording. Colorado is a one-party-consent state (C.R.S. §§ 18-9-303 and 18-9-304). You may record a conversation you are part of without the other person’s consent. Recording or intercepting one you are not part of, without the consent of at least one participant, is a class 2 misdemeanor.
Accounts and devices. Logging into a spouse’s email, iCloud or phone without permission is unauthorized access under C.R.S. § 18-5.5-102: a class 2 misdemeanor at minimum, with felony exposure if it is done to defraud or to commit theft, and there is no marital exception. Evidence gathered this way can put you, not your spouse, on the wrong side of a charge.
Metadata is the record inside the record: the EXIF block in a photo, the edit history in a document, the routing headers on an email. It can be rewritten, so its weight depends on how the evidence was acquired and verified.
| Source | What it can show | Standard |
|---|---|---|
| Photos, mobile devices | Timestamps, geolocation and device data embedded in the file | NIST SP 800-101 Rev. 1 |
| Documents | Creation and modification timestamps, edit history | NIST SP 800-86 |
| Routing headers, recorded at the sender’s system, intermediate servers and the recipient’s system | NIST SP 800-86 | |
| Any file | A hash value computed at acquisition shows whether a later copy is unchanged | NIST SP 800-86 |
| Handling | Documented chain of custody for every item transported and stored | DOJ/NIJ, Electronic Crime Scene Investigation, 2nd ed. |
Colorado has legislated on synthetic media: HB24-1147, effective July 1, 2024, requires a disclosure on deepfakes in communications about candidates for office. It is an election law, not a rule of evidence. The current Federal Rules of Evidence contain no Rule 707, and the proposed machine-generated-evidence rule is not on the pending track. The rules have not caught up, so in a Colorado courtroom authentication still runs through CRE 901 and the proponent must show a recording is what it claims to be. Challenge and verification, not assumption, is the working method.
Five situations we see in criminal, civil and family matters, and the Colorado rules that decide them
The situation. A video exhibit skips, freezes or will not play, or the version shown in court looks different from what the client remembers.
What the examination looks at. Compare the exhibit with the original export from the evidence system: container metadata, encoder traces, frame counts, embedded timestamps and hash values. Re-encoding, splicing and enhancement leave marks that a side-by-side comparison can show.
Why it matters in court. Under CRE 901 the party offering a recording must show it is what it claims to be. When the copy and the original do not match, that showing can be challenged, and the original files can be requested in discovery.
The situation. An employee leaves, and spreadsheets, invoices or client files disappear from a company computer shortly before the departure.
What the examination looks at. A write-blocked forensic image preserves the drive as found. File-system records, installed programs and USB and cloud-upload traces can show what was deleted, when and with what tool, and deleted files can often be recovered at least in part.
Why it matters in court. Colorado has no federal-style Rule 37(e). Under Aloi v. Union Pacific (Colo. 2006), willful destruction of evidence after notice that it is relevant can support an adverse-inference instruction; bad faith is not required. A documented timeline is what makes that argument.
The situation. One parent says threatening messages were sent; the other parent’s phone has since been reset or the conversation deleted.
What the examination looks at. With proper legal authority, an examiner can acquire the phone and its backups and look for deleted records and deletion timestamps. What is recoverable depends on the device, encryption, backups and how much time has passed, which is why acting early matters.
Why it matters in court. The route is discovery or a court-ordered examination through counsel. Logging into the other parent’s phone or iCloud yourself is unauthorized access under C.R.S. § 18-5.5-102. Recovered messages are authenticated under CRE 901, as in People v. Glover.
The situation. The prosecution relies on cell-phone location records to place the client near a scene.
What the examination looks at. Establish what the records actually are, how they were produced and what they can and cannot show about where a phone was, and compare them with other data from the device itself.
Why it matters in court. Carpenter v. United States (2018) generally requires a warrant for historical cell-site records, and C.R.S. § 16-3-303.5 has required a warrant, subpoena or court order for device location information in Colorado since 2014. Evidence obtained in violation is inadmissible.
The situation. Messages, emails or a recording are attributed to the client, who says someone else wrote them, or that the media was altered or generated with AI.
What the examination looks at. Account-access records, device artifacts and file metadata can help show which device and account a message came from, and whether a photo, audio or video file carries signs of editing or synthesis.
Why it matters in court. In People v. Glover the real question was who wrote the particular messages. Colorado has no special evidence rule for deepfakes, so the challenge runs through CRE 901 authentication.
Illustrative scenarios based on common case types. They are not accounts of specific past cases and do not predict the result of any case.
Forensic work for our clients is carried out by EBOXLAB / Denver Data Recovery, a Colorado digital forensics and data recovery lab, working with our attorneys from the first look at the evidence to testimony in court. The lab handles the technical examination; your attorney decides what is examined, how the findings are used and what the rules of evidence require.
Forensic examination of phones, computers, cloud accounts and video for Colorado legal proceedings: acquisition, metadata and artifact analysis, written reports and expert witness testimony.
Digital forensics servicesRecovery from failed drives, deleted files, RAID arrays and mobile devices, handled with the care evidence needs.
Data recovery servicesShort answers, with the rule or case each one rests on
This page is general information about Colorado law, not legal advice, and reading it does not create an attorney-client relationship. The legal statements here were checked on September 26, 2026.
Automatic deletion does not wait for a court date. Call before the evidence is gone.