Two million seized files: must the defence be able to see everything? Belgium's Court of Cassation answers

A network storage server (NAS) seized in a criminal case holds almost two million media files. Investigators analyse around 300,000 of them, roughly 15%. The defendant, challenging the appeal court's judgment, argues before the Belgian Court of Cassation that he was never able to check all the data, nor the integrity of the selection used against him. In a judgment of 27 October 2026 (P.26.0703.N), the Court dismisses his appeal. Its reasoning sets a clear framework for every case where digital evidence is measured in terabytes.

The complaint: "I was only shown a selection"

The defendant relied on Article 6 of the European Convention on Human Rights: the right to a fair trial, the right to adequate time and facilities to prepare a defence, and equality of arms. In his view, the defence had only been given access to a selection made by the investigators. It could therefore not check the authenticity, integrity, chain of custody or completeness of that selection. He also pointed to discrepancies in the copies of the files taken from the NAS.

The argument is not theoretical. In a large digital case, what the investigation did not look at may contain exculpatory material: a timestamp that contradicts the chronology, a file that points to another user, a shared folder that nobody opened.

What the Court held

The Court relies on the European Court of Human Rights judgment Sigurður Einarsson and Others v. Iceland of 4 June 2019. A court may base its decision on a selection of data obtained through an automated search, and investigators are presumed to have acted fairly unless the contrary is shown.

Access to all the unexamined raw data is not required when three conditions are met:

the defence knows the search criteria the investigators used;
it can run its own selection on the basis of precise and plausible criteria;
it can consult the data the investigators actually examined.

The trial court has the final say on whether the defence was able to exercise its rights effectively. Here, the Antwerp Court of Appeal had noted several points that the Court of Cassation found sufficient. The volume was exceptional. The selection followed an objective criterion, chronological order, with no search terms chosen by the investigators. The defence had access to the recovered images, including those not analysed, with enough time, including after the further investigation ordered on appeal. The discrepancies in the copies had been explained by the federal judicial police's Regional Computer Crime Unit (RCCU), without casting doubt on the reliability of the material.

One last point carries real weight: the defence had not proposed any concrete selection criteria, even though, according to the appeal court, it was best placed to do so.

What this changes in practice

The judgment does not say that the defence must make do with what it is shown. It says the opposite, but it puts the burden of taking the initiative on the defence. Challenging a selection in general terms is no longer enough. The defence has to show, concretely, what a different search could bring to light.

This is technical work as much as legal work. In practice, it comes down to a few precise questions:

The criteria: which filters, keywords, date range and tool were used for the selection, and can they be reproduced?
Integrity: do the copies handed to the defence match the hash values computed at acquisition? Are any discrepancies documented and explained?
Chain of custody: who handled the media, when, with which tools, and is every step recorded?
Blind spots: which categories of data were not examined (deleted files, metadata, other user accounts, NAS logs), and why might they be relevant?

These questions should be raised early, ideally during the judicial investigation, and framed as reasoned requests for further investigative steps. A vague request is likely to be refused; a request backed by precise and plausible criteria is exactly what the judgment invites.

The same reading applies to prosecutors and investigators. An objective, documented and reproducible selection criterion, hash values at every step and a written explanation for each technical discrepancy are exactly what allowed the proceedings to hold here.

Key takeaway

Faced with data volumes beyond any human reading, the Court of Cassation endorses analysis by selection, provided the defence can understand it, verify it and add to it. The right of access remains intact, but it becomes a right to be exercised actively, with precise technical criteria. For a lawyer, the support of a digital forensics technical adviser turns an objection of principle into concrete requests that a court will find hard to dismiss.

Source: Belgian Court of Cassation, 27 October 2026, P.26.0703.N, text of the judgment (in Dutch).