A court order is needed for obtaining which type of electronic evidence?

• A. Subscriber information from electronic device
• B. Content from electronic device
• C. Transactional Records of electronic evidence
• D. Live monitoring

Answer: (C)

Understanding how electronic evidence is categorized helps explain why a court order fits transactional records. In the law, data falls into content and non-content categories. Content data is the actual substance of communications—the messages, files, or other stored content on a device—and obtaining it typically requires a warrant based on probable cause. Non-content data, such as subscriber information, metadata, or transactional records (logs showing who communicated with whom, when, and how), does not reveal the content of the message. This kind of information is usually obtainable with a court order under the Stored Communications Act (often via a 2703(d) order) after a showing that the information is relevant to an investigation.

Transactional records are, by nature, non-content data. They provide the structure of communications (timing, routing, participants) without disclosing the actual content. That’s why a court order is the appropriate instrument for obtaining them. The other options involve content or real-time interception, which require different legal processes (warrants for content; wiretap orders for live monitoring).