Digital evidence: Europe calls for more accessible, verifiable tools. Where C.E.R.T.O. fits in
The analysis published by Europol and the European Commission on 16 October 2026 brings into focus the difficulties digital forensics faces within the Union’s police forces. For anyone who collects online content, it raises a practical question: how to preserve that content in a documented way, and allow others to verify it.
A web page can change while a complaint is being prepared. A conversation can lose messages and attachments. A shared document can be replaced before anyone has saved a copy. In these situations the immediate priority is to capture the content that is available and leave an intelligible record of the steps taken. This is where the European debate on digital forensic capabilities also meets the daily work of lawyers, consultants and businesses.
On 16 October 2026 Europol and the European Commission published Digital forensics: gap analysis, a review of the shortcomings and needs of the Union's investigative authorities. The Commission describes a problem of resources, skills and the ability to keep pace with technological change. Commercial solutions, often developed outside the EU, can prove unaffordable and poorly suited to the needs of Member States. The document is meant to guide European initiatives, including those supported by the Internal Security Fund. Its scope is law enforcement: extending these considerations to the work of professionals is our reading of the report's implications. [1]
The analysis identifies very concrete obstacles. Proprietary formats complicate the transfer of data between different tools; validation practices are fragmented; training and maintenance require sustained support. Cloud services, IoT devices and connected vehicles also broaden the range of sources to be examined. In the cloud, access to data depends on the providers as well, and does not necessarily yield complete system images or infrastructure logs. On artificial intelligence, the report calls for control, traceability and reproducibility, and warns against the use of opaque systems. The way forward it proposes includes modular tools, interoperability and shared expertise. [2]
These findings suggest a useful criterion when choosing software to collect online evidence as well: consider what it provides to those who will examine the evidence. An evidence package should make it possible to identify the acquired material, reconstruct the procedure and check the integrity of the files. Ease of use gains value when it makes these operations more accessible without hiding the steps.
This is where C.E.R.T.O. — Certificazione e Raccolta Tracce Online comes in. The service's website presents an application for Windows and macOS designed to acquire web pages, files, email and Italy's certified email system (PEC), WhatsApp and Telegram conversations and cloud content, alongside other collection methods. The connection with the European debate lies in this operational scope: documenting digital traces that a professional must preserve and later submit for examination. [3]
According to the published technical documentation, C.E.R.T.O. organises acquired material into BagIt evidence packages, accompanied by cryptographic hashes, an Ed25519 signature and RFC 3161 timestamps. The CASE/UCO description represents content, provenance and operations in a structured form. The checks can be repeated with standard tools, without having to use C.E.R.T.O. for every verification. For web pages, the acquisition can include a WACZ archive, images of the page, a video recording and the HTTP traffic in HAR format. [4]
For whoever receives the package, this means being able to work on the material and the technical information, not only on the report that accompanies them. It is a central point of C.E.R.T.O.'s positioning: enabling independent verification of the results by someone other than the person who performed the acquisition. The adoption of open formats provides a basis for exchange; actual compatibility with another system still has to be tested within the intended workflow.
The cloud makes the usefulness of this approach particularly clear. The page dedicated to the C.E.R.T.O. module describes authenticated access via OAuth to Google Drive, Dropbox and OneDrive, the preservation of folder structure and metadata, and the comparison between the hashes supplied by the service and those computed on the downloaded files. Information on sharing settings, revisions and items in the bin is also provided, within the limits of what the provider makes available. [5] The operational value lies in documenting what was actually obtained: an essential distinction when the source continues to exist and to change on external infrastructure.
Cryptographic verification should also be understood in terms of what it actually establishes. Checking that a file matches the recorded hash verifies its integrity; the timestamp anchors its existence to a point in time. These checks do not, on their own, establish whether a statement contained in the file is true. C.E.R.T.O.'s own documentation distinguishes the guarantees of timestamping from the assessment of the content. [4]
The European report therefore offers a relevant context in which to talk about C.E.R.T.O., without amounting to an evaluation or endorsement of it. The features described on the website concern a specific segment of digital collection; they do not demonstrate coverage of the needs for extraction from IoT devices, vehicle analysis or decryption addressed in the European analysis.
For anyone who needs to preserve a web page, a message or a document stored online, the practical question is straightforward: what can still be verified once the source has changed? C.E.R.T.O. provides the acquired material together with the documentation needed to examine it again. The ability to support a documented process and independent verification is a meaningful benchmark for assessing a forensic tool.
Sources and documentation — consulted on 22 October 2026
- European Commission, DG HOME, New analysis on digital forensic gaps and needs of EU law enforcement, 16 October 2026. Source for the date, context, affordability issues and intended use of the analysis. Read the official news item.
- Europol, Digital forensics: gap analysis, 25 pages. Relevant passages: tools and formats, pp. 5–8; standardisation and cloud, pp. 10–12; IoT, p. 18; AI, pp. 19–20; training, pp. 21–22. Download the official PDF report. Publication page.
- C.E.R.T.O., product overview and modules. Official website.
- C.E.R.T.O., How it works — forensic architecture and standards. Source for formats, signature, timestamping, verification and the distinction between integrity and the value of the content. Technical documentation.
- C.E.R.T.O., Cloud forensic acquisition — Google Drive, Dropbox, OneDrive. Module documentation.
