Real, documentary and digital evidence

On the morning of March 14, Erin Bose, the Port Ardent police service's civilian video analyst, sat in the back office of Bayview Pharmacy with Glenn Whitaker and the pharmacy's recorder, a small box under the counter connected to four cameras. Before she exported anything, she photographed the recorder's screen beside her phone, which showed the time from the national time service. The recorder said 06:52:40. Her phone said 06:48:30. The pharmacy's clock was four minutes and ten seconds fast. She wrote that in her notes, exported the footage from 01:30 to 03:30 in the recorder's own format along with its player, calculated a digital fingerprint of each file, and copied everything to a sealed drive. Then she walked across the lane to the Harbour Wash laundromat and did the same thing there. That camera's clock was exact.

Desjardins tells the class that this half hour of careful work in a back office is why the video was admitted at trial without a fight. Physical objects, documents, photographs and digital files are among the most persuasive evidence there is, because they do not forget and are not nervous on the stand. But before a court will rely on them, someone must show that they are what they are claimed to be and that they have not been changed. This lesson covers how that is done.

Kinds of evidence

Evidence comes in several forms. Testimony is what witnesses say under oath or affirmation. Real evidence is a physical thing, such as the glass shard with the fingerprint, the pry bar or the hoodie. Documentary evidence is writing or recorded information, such as Whitaker's inventory records or the dispatch log. Digital evidence is information stored or transmitted electronically, such as video files, phone records or a computer's logs. Demonstrative evidence is something made to help the court understand other evidence, such as a scale diagram of the lane, a timeline, or a map showing the route from the pharmacy to Crescent Street. Demonstrative evidence is not evidence of the facts itself; it illustrates evidence that has been proved in another way, and the party offering it must show that it is accurate.

Authentication and identification

Before any exhibit can be admitted, the party offering it must authenticate it: show, through evidence, that the item is what it is claimed to be. The threshold is low. It does not require proof that the item is genuine beyond doubt; it requires enough evidence that a reasonable trier of fact could find it genuine. Questions about genuineness then go to weight. Canadian courts apply this common law requirement to all exhibits, and section 31.1 of the Canada Evidence Act provides that a person seeking to admit an electronic document has the burden of proving its authenticity by evidence capable of supporting a finding that it is what it is purported to be.

An exhibit can be authenticated in several ways. A witness with knowledge can identify it: Whitaker could say that the till drawer photographed at the scene was his till drawer. A distinctive mark can identify it: Liu scratched her initials, the date and an exhibit number on the edge of the evidence bag holding the glass shard. A chain of custody can link it to its source. And for recordings, a witness can describe the system that produced them and show that it works reliably.

Continuity of exhibits

Continuity is the documented history of an exhibit from the moment it was collected until it is produced in court. Its purpose is to show that the item in court is the same item that was found, and that it has not been altered, contaminated or substituted. Each person who handled it should be able to say when they received it, from whom, what they did with it, how they stored it and to whom they gave it. Gaps do not automatically make an exhibit inadmissible. Courts generally treat a gap as a question of weight unless there is a real possibility that the item was tampered with or confused with another. But a gap gives the defence an opening, and for items whose value depends on their exact condition, such as a print on glass, a sample for DNA or a drug exhibit, a gap can be fatal.

The glass shard in the Bayview case had a simple history. Liu found it in the lower frame of the window at 03:40 on March 14, photographed it in place with a scale, lifted the latent print with powder and tape at 03:55, then removed the shard and packaged it in a rigid box sealed with evidence tape, initialled across the seal. She logged it as exhibit 4 and placed it in the forensic identification section's drying locker at 05:10. It went to the exhibit room at 08:30 on March 16, was signed out to Liu for photography on March 17, returned the same day, and was brought to court by the exhibit officer on October 13. Each transfer was signed. The lift card with the print, exhibit 4A, had its own record. Marchetti asked Liu about continuity for about two minutes and then moved on.

Video and photographs

Photographs and video are usually admitted in one of two ways. Under the first, a witness who saw the scene testifies that the image fairly and accurately shows what it depicts; the image then illustrates the witness's testimony. Under the second, sometimes called the silent witness approach, the image is admitted as evidence in its own right, on proof that the recording system was reliable and that the recording has not been altered, even if no person saw the events. Security video almost always comes in the second way, because nobody was watching. In R. v. Nikolovski (1996), the Supreme Court of Canada held that a video recording of a crime, once its accuracy is established, can itself be evidence of identity, and that a trier of fact can compare the person in the video with the accused and reach its own conclusion.

To lay the foundation for security video, the prosecution usually calls the person who manages the system, to describe how it records and stores footage, whether it was working properly, and how the clock was set, and the person who extracted the footage, to describe how it was copied and confirm that the copy matches the original. Bose testified about the digital fingerprints she calculated. A digital fingerprint, or hash value, is a long number calculated from the contents of a file; any change to the file, even one pixel, produces a completely different value. By calculating it at the time of extraction and again before trial, Bose could show that the file played in court was identical, bit for bit, to the one she copied from the recorder.

# Correct each recorded time to true time using the clock offset measured at extraction
from datetime import datetime, timedelta
offsets = {"laundromat camera": 0, "pharmacy camera": 250}   # seconds fast (pharmacy: 4 min 10 s)
records = [
    ("laundromat camera", "02:07:40", "cyclist enters lane"),
    ("pharmacy camera",   "02:14:40", "man enters through window"),
    ("pharmacy camera",   "02:16:50", "man leaves through window"),
    ("laundromat camera", "02:13:05", "cyclist leaves lane"),
]
def parse(x):
    return datetime(2026, 3, 14, *map(int, x.split(":")))
def show(d):
    return f"{d.hour:02d}:{d.minute:02d}:{d.second:02d}"
fixed = []
for source, shown, what in records:
    true = parse(shown) - timedelta(seconds=offsets[source])
    fixed.append((true, source, shown, what))
for true, source, shown, what in sorted(fixed):
    print(f"{show(true)} true   ({source} shows {shown})  {what}")
inside = (fixed[2][0] - fixed[1][0]).seconds
print("time inside the pharmacy:", inside, "seconds")

02:07:40 true   (laundromat camera shows 02:07:40)  cyclist enters lane
02:10:30 true   (pharmacy camera shows 02:14:40)  man enters through window
02:12:40 true   (pharmacy camera shows 02:16:50)  man leaves through window
02:13:05 true   (laundromat camera shows 02:13:05)  cyclist leaves lane
time inside the pharmacy: 130 seconds

Corrected to true time, the recordings fit together and with the other records. The cyclist entered the lane at 02:07:40. The glass-break alarm went off at 02:09:40. Mrs. Shaw's call began at 02:09:50, and she said 'he's going in' at about 02:10:37, seven seconds after the pharmacy camera showed a man climbing through the window. He was inside for 130 seconds and the cyclist left the lane at 02:13:05. Without the offset measurement, the pharmacy video would have appeared to show the man entering four minutes after Mrs. Shaw said he did, which the defence could have used to suggest the recordings did not match, or even that they showed different events.

Identification from video

The pharmacy camera did not show the burglar's face; he wore a face covering. It did show his build, his grey hoodie and, when he turned toward the till, a white wave-shaped logo on the back. That logo mattered. Bose compared it with the hoodie Brennan was wearing in Okeke's in-car video and prepared a side-by-side still, which was admitted as demonstrative evidence. Kwan did not ask Bose to give an opinion that the hoodies were the same, because she was not qualified as an expert in garment comparison; he let the judge look for herself, as Nikolovski permits. Witnesses who know a person well, such as a family member or a parole officer, can sometimes give opinion evidence that a person in a video is someone they recognize, but courts are cautious with this, especially when the witness is a police officer, because of the risk that the identification relies on their knowledge of the accused's record.

Documents and business records

Documents are often hearsay, because they contain out-of-court statements offered for their truth. Whitaker's inventory list, showing that six boxes of nicotine gum were missing, was hearsay as to what had been in stock. Section 30 of the Canada Evidence Act allows a record made in the usual and ordinary course of business to be admitted as evidence of matters it records, if oral evidence of those matters would be admissible, and the common law has a similar exception. Section 31.2 adds a best evidence rule for electronic documents, satisfied by proof of the integrity of the electronic system that recorded or stored them. Whitaker testified that the pharmacy's point-of-sale system recorded every sale and that he ran an inventory count every Friday night at closing; the count on Friday, March 13, and the count on the morning of March 14 differed by exactly six boxes of the brand on the video.

Police reports are a special case. They are records made in the course of police work, but they are prepared with litigation in mind, and courts are generally unwilling to admit them for their truth through a business records exception against the accused. The officer must testify, using the report only to refresh memory if necessary. The Criminal Code and Canada Evidence Act provide other routes for certain official documents, such as certificates of analysis and certified copies of public records.

Digital evidence

Digital evidence raises the same questions as other exhibits, with some added concerns. It is easy to alter, often invisibly; it can exist in many copies; and its meaning can depend on metadata, such as file creation times, that is itself evidence. Good practice is to preserve the original where possible, work only on verified copies, record hash values at each step, use tools whose reliability is established, and document every action. Screenshots and phone videos of a screen are a last resort, because they lose metadata and are harder to authenticate. Bose's decision to export the recorder's native files, rather than recording the playback screen with a phone, was what made her evidence so solid. Phone extractions, social media records and cell location records are handled in the investigation course; their admission in court depends on the same foundations of authenticity and integrity.