Place of Digital Phonograms, Videograms, and Videophonograms in the System of Electronic Evidences: Theoretical and Methodological Principles of Classification

Introduction

Russian legislation allows the use of phonograms, videograms and videophonograms (further referred to as PhVVph)¹ as evidence in administrative, arbitration, criminal and civil proceedings, regardless of the form – analog or digital, and the method of their presentation – a file in the memory of a video recording device, publication on a social network, etc.

Such evidence may include PhVVph recorded:

– as part of operational investigative activities;

– by an investigator or an expert during conducting investigative actions and taking minutes of court sessions;

– by other participants in the process (an accused, a victim, a witness, a plaintiff, a defendant, etc.);

– by various general-purpose automated systems for collecting and processing audio and visual information: video surveillance, telephone recordings, etc.

However, even a cursory review of the texts of procedural laws indicates a lack of uniformity, even in naming objects containing evidentiary audiovisual information.

For example, the result of recording audio information on a tangible medium (further referred to as a phonogram) is called:

– audio recording (Russian Administrative Procedural Code, Russian Civil Code, Russian Criminal Procedural Code);

– audio materials (Russian Code of Administrative Offenses);

– audio recording materials (Russian Criminal Procedural Code);

– sound recording materials (Russian Code of Administrative Offenses);

– phonogram (OIA law² , Russian Civil Code, Russian Code of Administrative Offenses).

The result of recording visual or audiovisual information (further referred to as a videogram or a videophonogram, respectively) is referred to as:

– videogram (OIA law);

– video recording (Russian Administrative Procedural Code, Russian Criminal Procedural Code);

– video materials (Russian Code of Administrative Offences);

– the materials of the video recording (Russian Code of Administrative Offences).

Procedural laws do not distinguish between a videogram and a videophonogram, or between digital or analog PhVVphs, although these differences objectively exist and may affect the processing of audio-visual information with evidentiary value, as well as its verification and evaluation as evidence. Consider the following example. An investigator asked an expert if there were traces of editing on a “video recording” and submitted the videophonogram for examination. The expert, in accordance with the “letter” of the question, studied the video in the videophonogram, but ignored the sound, which, according to the case file, contained evidentiary information and was edited (Zubov, Timoshenko, 2014).

This is not surprising, given that regulatory legal acts – both laws and departmental instructions, guides, recommendations, etc. – lack even the basic concepts of PhVVphs such as the concepts of electronic and digital evidence. In the procedural laws and resolutions of the higher courts, these concepts are customarily equaled to information presented “in electronic form” (Russian Code of Administrative Offenses); on “electronic media” (Russian Criminal Procedural Code); or “electronic documents” (Russian Criminal Procedural Code and Russian Administrative Procedural Code). At the same time, there is also no explicit definition of the term “electronic media” in the texts of regulatory legal acts. Its meaning is revealed through context and indirect indications. As a rule, “electronic media” is understood as a device for recording, storage and use of digital data exclusively.

The Law “On information, information technologies and information protection”³ gives the following definition of an “electronic document”: “documented information presented in electronic form, that is, in a form suitable for human perception using electronic computers, as well as for transmission over information and telecommunication networks or for processing in information systems”. It is not applicable to digital PhVVphs, since digital PhVVphs, the electronic origin of which is beyond doubt, can be recorded or reproduced without using a computer. It is equally important that, while the Russian Criminal Procedural Code classifies PhVVphs as “other documents”, other procedural laws classify documents as written evidence, to which PhVVphs clearly do not belong.

A more precise definition of an “electronic document” is contained in the Law “On arbitration (arbitration proceedings) in the Russian Federation”⁴: “an electronic document transmitted through communication channels – information prepared, sent, received or stored using electronic, magnetic, optical or similar means, including electronic data exchange and e-mail”.

Thus, one can state that Russian legislation lacks a single, universal, exhaustive legal definition of “electronic evidence” (further referred to as EE) and does not reflect the generic features and classification of EE. This prevents an understanding of the specific features of using this type of evidence in court proceedings and their objective assessment in terms of admissibility and reliability. It also hinders creating practical guides for investigators and experts working with this type of evidence.

A similar situation is observed in the publications of Russian practicing lawyers and legal scholars (Voronin, 2021; Malyk, 2023; Politsian, 2022; Cheretskikh, 2023), who also cannot come to a consensus on EE. Some do not see the difference between digital and electronic evidence, others classify them as different types, but both note the imperfection of Russian legislation regarding the use of EE and, as a rule, speak of the need to view EE as a separate type.

1. Causes of legal uncertainty of electronic evidences

There are several key factors causing the legal uncertainty of EE.

First and foremost, there is the variety of EE forms and types that do not correspond to the written form of recording evidentiary information accepted in procedural practice.

The evidences, which is currently commonly referred to as electronic, include: electronic documents per se, including electronic images of written documents; correspondence in e-mail applications and messengers; files of various formats; databases, metadata; server logs, etc. Some of them can be represented: in physical form (on a tangible medium, for example, in the external memory of a sound or video recording device); in virtual form (for example, a videophonogram in the YouTube⁵ Internet service). At the same time, evidentiary information can be relatively easily, often deceptively easily, transferred from one medium to another and exist in many indistinguishable copies; its reproduction and perception in some cases are impossible without the use of software and hardware, the use of which often requires the user to have special knowledge in the field of information technologies.

All this undoubtedly complicates the identification, collection, receipt, classification and description of EE in the protocol, as well as the unification of approaches to their assessment. It also necessitates the use of various verification technologies, including those unknown for the participants in the process: electronic signatures (Russian Administrative Procedural Code, Russian Civil Code, Russian Code of Administrative Offences, Russian Criminal Procedural Code, Law on electronic signature⁶); hash functions (GOST R ISO/IEC 27037⁷, GOST R 57429⁸); a unique set of technical characteristics and metadata of PhVVphs; UUID⁹.

Secondly, there is a lack of competence of persons, who make video sound recordings; who carry out procedural recording of EE; who are involved as experts in order to confirm the accuracy of the recorded information; and the judges. Incompetence lies in a lack of understanding of the EE nature as a whole, as well as in the inability, in particular, to identify “potentially criminalistically significant information ... that does not and cannot have a direct causal relationship with the crime event, is not included in the subject of proof, but which is objectively necessary for the proper resolution of the case and contributes to solving diagnostic, classification and identification tasks” ¹⁰. For example:

– Investigators, judges, and other participants in the process who do not have special knowledge tend to overly rely on the alleged “objectivity” of the video image, believing that it shows the facts as they really are (“naive realism”), since their personal experience is insufficient to form a critical attitude towards the perception of recorded audiovisual information.

– 37 % of the interrogated investigators do not know what the hash sum of the data contained in the file is; only one investigator uses the hash sum as a way to protect the file from modification (Shikhalieva, 2025). In investigative documentation, so rarely contain the hash sum of video and audio data that it cannot be considered a statistically significant event¹¹.

– During the examination, an expert did not take into account that, according to the audio file metadata, the audio was recorded using the iOS version, which appeared several months after the events recorded on the phonogram; another expert did not notice that the audio file content changed two days after the investigator drew up the protocol and recorded the audio file on an optical disc.

– The authors of the “Instructions for record keeping in the arbitration courts of the Russian Federation (first, appellate and cassation instances)”¹² not only lack understanding how the recording quality of a phonogram is assessed, but are also unable to correctly specify the unit of measurement of the recording information speed and the  standard signal sampling rate: “The recording quality is 128 Kb/s, sampling rate 44 kHz, stereo mode”. Apparently, the Instructions do not provide means of verifying recorded phonograms¹³.

– Increasingly, videograms and videophonograms used in evidence have metadata or video- and audiodata distorted and (or) modified as a result of transmission using Internet messengers.

– “... a typical silent scene rounded up the ‘tour’ for cadets, young investigators and operations staff along several floors with hundreds of racks of identical equipment in the Rostelecom PJSC data center after the question “If your computer system is distributed in the cloud infrastructure of the data center, what and how will you inspect and exact here in accordance with the Criminal Procedural Code? Where will you keep the items exacted?” (Zemskova, Minakov, 2023).

The above emphasis on “potentially criminalistically significant information” is not accidental. The current level of development of digital signal processing technologies, including artificial intelligence, makes it possible to modify or fabricate PhVVphs without leaving any traces (Zubov, Zubova, 2023; Bodrov, Lebedeva, 2024). In this regard, while assessing the recorded information reliability, it is particularly important to establish the conformity of the PhVVphs content and technical characteristics with the circumstances of their creation, known and reflected in the procedural documents (Voznyuk, Denisov, 2017). For example, experts, with the participation of the author of this article, have repeatedly managed to establish the fact that the court session phonogram was replaced by another phonogram that had no traces of modification, but was recorded at another time in a different sound environment that did not correspond to the courtroom¹⁴.

The third factor is the EE vulnerability, which manifests itself, among other things, in the following:

– Distortion, destruction, blocking of access to information, as well as loss, destruction or malfunction of the information carrier because of user errors, failure of technical and software tools of information systems, exposure to natural phenomena or other events, including those not aimed at changing information (GOST R 50922-2006¹⁵).

– A large set of methods and means of EE deliberate destruction or concealment: using both standard and special software, including malicious ones; by completely overwriting the hard disk; by formatting the media; by encryption or electromagnetic force exposure (GOST R 50922-2006).

– Difficulties in implementing measures to ensure the EE protection from intentional and unintended effects, including electromagnetic and (or) other physical effects, carried out, among other things, for criminal purposes (GOST R 50922-2006). “... (D)ue to the high volatility of information in digital media and systems, the detection of digital traces of a crime during repeated or additional inspection over time will in most cases be unlikely” (Zemskova, Minakov, 2023).

Fourthly, the “paper” recording of evidentiary information adopted in procedural practice does not correspond to the PhVVphs nature; the latter contain information about video and audio events in duration that one cannot view as a whole at any given time and adequately reflect in a written document. In this regard, an expert is often assigned to establish the verbatim content of the PhVVphs and provide a so-called storyboard – hard copies of the video images with a textual description of their content. This does not allow one to fully convey “the intonation and nuances of a person’s presentation of thoughts, the expressiveness of speech and the tone of conversation, facial expressions, gestures, emotional state, attitudes of the video participants to the phrases, actions, and reactions of other participants in the events” (Vlasov, 2024).

2. Methodology for the formation of the conceptual apparatus and classification of electronic evidences

Obviously, one may determine the place of digital PhVVphs in the EE series only if there is a system of fully encompassing notions, definitions and terms related to the area under consideration and constituting the conceptual apparatus of the EE.

A serious obstacle to the formation of the EE conceptual apparatus is the existence of many inconsistent descriptions of the same concept. A clear example of this heterogeneity is the different interpretations of the concept of “electronic document” in legislation (see above) and in the current state standards:

– “electronic document: a document on a machine-readable medium, requiring computer equipment to use”¹⁶;

– “electronic document: an information object consisting of two parts:

– a prop containing identifying attributes (title, time and place of creation, information about the author, etc.) and an electronic digital signature,

– meaningful, including textual, numerical and (or) graphical information that is processed as a single whole”¹⁷;

– “electronic document: a form of presentation of a document as a set of interrelated implementations in an electronic environment and their corresponding interrelated implementations in a digital environment”¹⁸;

– “electronic document: a document whose information is presented in electronic form”¹⁹;

– “electronic document: a document in digital form, the use of which requires computer means or other specialized devices for reproducing text, sound, and images”²⁰.

The variety of definitions is largely due to the fact that individual standards and laws have a limited scope of application and are focused on solving problems in specific areas of human activity. Therefore, it is logical to begin the formation of the EE conceptual apparatus by defining the main task for which it is used. This task is to ensure a uniform understanding and interpretation of the generic and specific characteristics of EE, the relationships and processes formed or applied in the collection, verification and evaluation of evidentiary information, including using the means and methods of forensic examination.

Given that the techniques and methods used when collecting, storing, processing, transmitting and using data constitute information technology²¹, it seems logical to use definitions already contained in the state standards in the field of information technology (IT) for the EE conceptual apparatus²².

Currently, there are several dozen such standards. The following are of the greatest interest in this study:

– GOST 15971-90 Information processing systems. Terms and definitions.

– GOST 13699-91 Recording and reproduction of information. Terms and definitions.

– GOST R 52292-2004 Information technology. Electronic information exchange. Terms and definitions.

– GOST R ISO/IEC 27037-2014 (ISO/IEC 27037:2012) Information technology. Methods and means of ensuring security. Guidelines for the identification, collection, receipt and storage of evidences provided in a digital form²³.

– GOST 33707-2016 (ISO/IEC 2382:2015) Information technologies. Dictionary.

The above standards use the “modern approach to information technology specification based on distinguishing two different aspects of phenomena: social (in this case, purpose, information, document, etc.) and technological (in this case, media, format, data, etc.)” (GOST R 52292). This is quite consistent with two different but interrelated aspects of EE fixation (Belkin, 2007). The procedural side is aimed at forming a legally binding evidence framework by reflecting the factual data, discovered by the investigator, in the procedural documents. The forensic side primarily touches upon the means and methods used at various stages of the detection and consolidation of evidentiary information.

These stages include²⁴:

1. Identifying EE – search, recognition and documentation of potential EE. During the identification process, information carriers and processing devices are identified that may contain potential EE.
2. Collecting EE – placing media with EE in a controlled environment for subsequent extraction of evidentiary information.
3. Receiving EE – creating a copy of EE.
4. Storing EE – ensuring the protection of EE from changes (falsification, damage, etc.).
5. Analyzing EE – in-depth research in order to identify evidentiary information.
6. Presenting (summarizing and explaining) the discovered factual data in a procedural document.

It is important that at all these stages “not only the evidentiary information per se is captured, but also information about the ways, methods and means of obtaining it as a necessary condition for its admissibility in the case” (Belkin, 2007).

It should also be noted that currently in Russia there is still no model for working with digital evidence during investigations, common for various law enforcement agencies.

Most of the standardized IT terms characterizing the technological/forensic side of collecting EE can be applied in the conceptual framework of EE without any changes. Missing generic and specific concepts related directly to IT can be formed by concretizing and adapting existing basic IT concepts based on “analyzing and generalizing the properties and features of objects and identifying the characteristics describing concepts” (GOST R 50.1.075²⁵) (Fig. 1), including taking into account the relationship of the “information” and “data” concepts shown in Fig. 2.

Using these standards and principles, it is not difficult to formulate terms and definitions universal for all types of legal proceedings, forming the basis of the EE conceptual apparatus.

GOST R 52292 provides the following definitions of “data” and “electronic environment”:

– “data²⁷: a formalized representation of information suitable for communication, interpretation or processing <...>;

– analog data: data represented by a physical quantity that is considered a continuous variable and whose value is directly proportional to the data or a suitable data function <...>;

– discrete data (symbolic data): data represented by symbols <...>;

– electronic environment: the environment of technical devices (hardware) operating on the basis of physical laws and used in information technology for the processing, storage and transmission of data”²⁸.

From these definitions, it follows that electronic evidence should be understood as data containing evidentiary information, stored or transmitted in a form suitable for human perception using information technology and electronic equipment.

The electronic technology mentioned in the definition includes not only computing facilities, but also electronic devices used for processing, recording, converting or transmitting information or energy using electronic components and principles of electronics. For example, for a person to perceive the sound information contained in a digital phonogram or video phonogram, it is not enough to have a DAC²⁹ (computing device) and a codec (information technology); it requires electronic devices designed to amplify an electrical signal and convert it into sound waves of various frequency and power.

Information technology is the techniques and methods of using computer technology in performing the functions of collecting, storing, processing, transmitting and using data (GOST 34.003-90).

It follows from the definitions of GOST R 52292 that EE can be represented in two types (Fig. 3):

– analog, in which a physical quantity takes on an infinite set of values that change continuously; and

– discrete, meaning that data exist in the form of discrete symbols, each of which can take one of a finite number of values.

That corresponds to Interpol’s position on this issue: “Electronic evidence is a derivative term for two types of evidence: analog evidence and digital evidence” (Reedy, 2022).

Accordingly, digital evidence containing evidentiary information is data stored or transmitted in the form of binary code (GOST R ISO/IEC 27037); the term refers to electronic discrete evidence. The same class of evidence includes string and logical data, for example, those displayed on the screen of a voice recorder or smartphone (smartphone IMEI; phonogram title; time and geographical coordinates of the sound recording or video location; real-time clock readings of the recording device; phonogram duration; position (on/off) of the trigger or AGC³⁰ controls).

Thus, a digital phonogram containing evidentiary information belongs to the class of electronic discrete digital evidence. It is digital audio data stored on a tangible medium, obtained as a result of:

– digital sound recording – digital recording of sound, or sound information, coming from a primary source or a device for reproducing sound information (Fig. 3);

– generation (synthesis) of sound using algorithms and methods of digital signal processing.

The importance of distinguishing two ways of creating a digital phonogram is due to the following:

– The need to distinguish between the actual sound recording and recording on a digital audio data carrier. The latter can be either one of the stages of sound recording (Fig. 3), or a self-sufficient process carried out in order to copy digital audio data or save the generated data (see below).

– The fact that sound synthesis can be performed using previously recorded audio signals or their components indicating time and frequency, as well as on the basis of a mathematical or generative³¹ model, without using the sound recording process at all stages of phonogram creation.

Digital audio data should be understood as the result of digitization and encoding of audio signals, presented in a form suitable for communication, interpretation or processing using electronic devices and information technologies. The recording of digital audio data on a media can be accompanied by the creation of files and metadata.

The need to mention “analog phonograms” is due, in particular, to the fact that there are aircraft still in operation, in which flight data and crew negotiations are recorded with analog tape recorders (on magnetic tape or wire); stored in archives, there are analog phonograms and videophonograms recorded on magnetic tape, film, discs, etc.

It also follows from the above that not all currently existing phonograms can be classified as EE. For example, to record and reproduce mechanical (by recording method) analog phonograms on discs, rollers, etc., the use of electronic equipment and information technology is not necessary.

Obviously, it is not difficult to form similar definitions of a videogram or videophonogram and the data contained in them.

Thus, a videophonogram should be called digital video and audio data stored on a tangible medium, obtained as a result of:

– digital video sound recording – synchronous digital recording of video and sound, or audiovisual information coming from the primary source or a reproduction device;

– generation (synthesis) of video images and sound using algorithms and methods of digital signal processing.

Let us focus separately on data carriers, which are material objects (including a physical field) intended for recording and storing data, which, due to their tangibility, are often classified as physical evidence in procedural documents. It is advisable to classify media: by the recording method (mechanical, magnetic, optical, electronic, etc.); by the form of recorded data representation (analog, digital, etc.); and by the type of information (video, audio, text, etc.). In this case, for example, a music CD is an optical carrier of digital audio data; an ordinary tape recorder with a magnetic phonogram is a magnetic carrier of analog audio data; a hard disk with digital phonograms is a magnetic carrier of digital audio data; a flash drive is a solid-state carrier.

A special case of a data carrier is a “recording medium”, or “a physical body used during recording to store information signals in it or on its surface”³², for example, a tape cassette or an optical disc.

The above example with the classification of a music CD shows that not all digital data carriers are electronic carriers. The latter should include only electronic devices of the appropriate purpose that operate with their own controller³³: a flash drive; a hard disk; a hardware RAID array; a network storage, etc.

Apparently, it is not easy for a nonprofessional to determine whether a data carrier belongs to a certain class. Therefore, in procedural documents drawn up by a nonprofessional, it is quite acceptable to indicate, along with other identifying information, only the type of media (a hard or optical disk; a flash drive; a tape recorder) and the characteristics of its contents (an audio or video file, a magnetic or digital phonogram and so on). The classification and explication of data carriers acquires the greatest importance at the stage of assessing the admissibility and reliability of evidence, including using the means and methods of forensic examination.

It is also important to keep in mind the following significant feature of digital PhVVphs. They can be presented in a virtual form, for example, a videophonogram published on the YouTube³⁴ Internet service, or files with PhVVphs in a cloud storage. Therefore, at the stage of such PhVVphs’ identification, their carrier cannot always be determined, and to use PhVVphs as evidence, it will be necessary to copy or export the data to an alienated medium.

Hence, the technical side of the standard procedure for exporting data from virtual to alienated media includes a number of sequential operations that can take place automatically, including without the user’s knowledge and control. These may include:

– extracting data from the source environment (database, information system, etc.);

– converting data into a format which allows them to be imported and used in another system or environment;

– actual storage of data on alienated media for their further use or processing.

In other words, the PhVVphs obtained as a result of export are not always copies of those recorded on virtual media.

In this regard, it is advisable to identify a primary carrier to which audio and video signals coming directly from the original source were recorded. In other words, this is the first tangible object on which specific data were recorded. The secondary carrier is that on which the data were stored as a result of copying or exporting data from the primary or another secondary media. The primary carrier can be either embedded (inalienable) or removable (alienable); the secondary one is alienable, as a rule.

Both primary and secondary carriers can also be virtual at the same time, which the user can access via the Internet or in a similar way.

We also consider important to mention the definition of a “digital evidence copy” as a created copy of a digital evidence and a means of verifying it, which is given in GOST R ISO/IEC 27037. It follows that a copy of a digital phonogram containing evidentiary information can only be considered a phonogram obtained as a result of file-based or bitwise copying, the conformity of which can be verified either using the verification function or in another acceptable way. In the English-language specialized literature, this is also called a “forensic copy”.

Naturally, all these definitions are not “carved in stone” and can be replaced with synonymous ones that do not distort the essence of the described properties, processes and phenomena. For example, the verification of the immutability of files by establishing the identity of two sets of data contained in them is called “verification” in GOST R ISO/IEC 27037 and “authentication” in GOST R 57429, which does not change the meaning and content of the procedure.

3. International experience

Currently, the “branch of criminology that applies legal issues to information and communication technologies and digital devices”³⁵, commonly referred to as Digital forensics, is recognized as an independent scientific discipline by many international and national organizations. These include the United Nations Office on Drugs and Crime, Interpol, the European Network of Forensic Science Institutes (ENFSI), the European Union Agency for Cybersecurity (ENISA), the American Academy of Forensic Sciences (AAFS), the Organization of Scientific Industry Committees (OSAC)³⁶, the UK Forensic Science Regulator, the International Organization for Standardization (ISO), and the International Electrotechnical Commission (IEC). The fundamental sciences and basic scientific directions for various subdisciplines of digital forensics currently include: biology, physics, mathematics, linguistics, as well as computer science, computer engineering, image science, acoustics, anthropology, statistics, and data science (Reedy, 2020; Rybaczewska & Sparks, 2022).

Publicly available publications of the above organizations provide a rather comprehensive picture of the current state of digital forensics, its methods and procedures related to working with digital evidence. It should be noted that the features of working with the PhVVphs are not specified in the listed documents.

In 2020, a manual “Cybercrime”³⁷ consisting of 14 modules was published, as a result of the joint work of the United Nations Office on Drugs and Crime and leading experts from more than 25 countries around the world. Module 4 of this manual, “Introduction to digital forensics”, provides an overview of the current state of digital forensics, in particular, the digital forensics standards, the process of examining digital evidence and general practical methods of expert research, as well as best practices in the field of digital forensics.

An analysis of trends, problems, and achievements of Interpol and law enforcement agencies in different countries in the field of collecting, analyzing, and using digital evidence in crime investigations is provided in the Interpol review of digital evidence for 2016–2019 and 2019–2022 (Reedy, 2020; 2022; Tripathi & Meshram, 2022; Insa, 2007).

In 2019, Interpol published Global Guidelines for Digital Forensics Laboratories³⁸. The document is a guide to the creation, management and operation of digital forensics laboratories in accordance with common standards that ensure the admissibility of electronic evidence in courts, including international ones.

The 2014 ENISA guide for first responders to computer incidents³⁹ focuses on how to handle digital evidence, starting with arrival at the crime scene and ending with the assessment and presentation of digital evidence.

The Best Practice Manual of the European Network of Forensic Science Institutes (ENFSI), devoted to conducting digital forensic research (version 1, 2015)⁴⁰, reflects the standard procedure of forensic examination of digital evidence, standards and universal methods of expert research, as well as best practices in the field of digital forensics, including staff training. Taken together, these should ensure the reliability and comparability of the results of forensic examinations.

The NIST IR 8387 (September 2022) report (Guttman et al., 2022; Turner, 2005; Romaniuk, 2024), prepared in partnership with the US National Institute of Justice (NIJ) and aimed at professionals in evidence management, provides practical recommendations for preserving digital evidence and describes their unique features.

The key problems faced by law enforcement specialists include data encryption, cloud services, distributed storage, the Internet of Things, artificial intelligence, a shortage of qualified specialists, and differences in national legislations. The main recommendations include the harmonization of legal norms, investments in training specialists and equipping laboratories, and the development of compatible technologies for examining digital evidence.

It is emphasized that “every case involving digital evidence poses new challenges that digital evidence specialists must be able to solve. A future digital evidence specialist must have the knowledge and skills to solve forensic issues in a specific case” (Reedy, 2020; An, 2017; Awwad, 2025; Hosmer, 2006; Maurer, 2004).

It should be mentioned that, in addition to GOST R ISO/IEC 27037 adapted to Russian conditions, ISO/IEC published additional international standards that have no Russian analogues. They cover reliability of digital forensic examination tools and methods – ISO/IEC 27041:2015 “Information technology. Security techniques. Guidance on assuring suitability and adequacy of incident investigative method”, as well as the stages of research and interpretation of the digital forensic examination process – ISO/IEC 27042:2015 “Information technology. Security techniques. Guidelines for the analysis and interpretation of digital evidence”.

Thus, the world has accumulated a wealth of experience in developing regulations – instructions, manuals, as well as standards and training materials on the creation and operation of digital forensics laboratories and working with digital evidence in the investigation of crimes. At the same time, the concept of “electronic evidence” is practically not used in modern regulatory documents and standards, since the features of studying analog evidence have long been known and studied and, together with digital evidence, they constitute an array of “electronic” evidence.

Conclusions

Digital phonograms, videograms, and videophonograms occupy a significant place in the EE system, representing highly vulnerable sources of audiovisual information that require a specialized approach to their recording, verification, and evaluation in court proceedings.

The lack of clear definitions and classifications of EE and PhVVphs in regulatory legal acts leads to legal uncertainty, errors in procedural practice and a decreased effectiveness of using such evidence in general.

The proposed methodology for the formation of the conceptual apparatus of the EE in general and PhVVphs in particular, based on existing state standards in the field of information technology, makes it possible to create universal terms and definitions adapted for all types of legal proceedings.

Further research in this area should be aimed at developing utmost clear and detailed recommendations, guidelines and instructions for experts and investigators on the identification, collection, receipt, preservation and analysis of EE, including using foreign experience.

In the future, it is necessary to improve the procedural rules, including the introduction of mandatory requirements for the competence of specialists and their mandatory involvement in the earliest stages of investigation.