Data obtained from digital devices can map a suspect’s movement, actions and intent and help determine sequences of events, patterns of behaviour and/or alibis. While in the beginning such data was regarded as ‘fact-based evidence’ (Casey 2019), the subsequent development of the digital forensics field has refined its understanding through standards, quality assurance processes and method testing. Building on ongoing ethnographic work on the application of DF in four police forces in England and Wales, this paper explores how the production of digital evidence is transforming in light of technological advances on one hand, and the pressures of operational speed, range and number of devices submitted for analysis as well as the volume of data examined, on the other hand. The analysis concentrates mainly on ‘dead box forensics’ practices (rather than live-networks analysis), i.e. conventional computer investigations that collect, preserve and analyse media and devices where exact copies of the hard drives of the systems examined are obtained. In this context it discusses the uptake and integration of DF expertise within existing knowledge structures and practices. The paper draws on observations of everyday activities, interviews with DF practitioners, forensic managers and police officers to map how digital evidence is practically accomplished and to scrutinize the socio-epistemic configurations that enable its production.