Authenticating Text Messages, Chats, and Social Media Evidence: Rules 901 and 902, Metadata, and Deepfake Challenges

The exhibit is a single image, a screenshot of an iPhone conversation. A gray bubble on the left reads "Don't put the overtime in writing. Just tell them it's comp time." The contact name at the top says "Rick (Ops)." Plaintiff's counsel in a wage case against Harlan Freight Services hands it to the operations manager at his deposition and asks whether he sent it.

He looks at it for a long time. "That was my number," he says. "I don't remember sending that. I changed phones in the spring. And my kid uses my iPad, which gets my texts." Defense counsel writes something on a legal pad. Two weeks later the defense serves a document request for the plaintiff's phone, and a month after that it moves in limine to exclude the screenshot as unauthenticated, arguing that anyone can type a contact name into a phone and that "Rick (Ops)" is a label the plaintiff chose.

Nothing about that exchange is unusual. Text messages, chat logs, direct messages, and posts now sit at the center of employment cases, contract disputes, family law matters, trade secret litigation, and most criminal prosecutions. They are often the most candid evidence in the case. They are also the easiest to fake, the easiest to lose, and the easiest to misread. The rules that govern them were written for letters and telephone calls, and courts have spent twenty years deciding how much those rules ask of a screenshot.

The short answer

The threshold is low but real. Under Fed. R. Evid. 901(a), the proponent need only produce "evidence sufficient to support a finding that the item is what the proponent claims it is." The judge asks whether a reasonable juror could find authenticity; the jury decides whether it is authentic.
Authorship is the real question. Proving that a screenshot accurately shows what was on a screen is easy. Proving that a particular person typed the words, on a device or account that others could reach, is where cases are won and lost.
Circumstantial evidence does most of the work. Content only the sender would know, replies that track the conversation, a phone seized from the defendant, a nickname, a photograph, a matching phone number in a contract, and conduct after the message all count under Rule 901(b)(4).
Platform certificates prove records, not authors. The 2017 amendments in Rule 902(13) and (14) let a qualified person certify machine-generated records and hash-verified copies. A Meta or Google records certificate can show that an account sent a message at a given time; it does not show who held the keyboard.
There is a split, but it is narrowing. A few courts once demanded that proponents rule out fabrication. Most now apply the ordinary reasonable-juror standard, with the strength of the foundation going to weight.
Authentication is only the first gate. Hearsay (usually solved by the party-opponent rule), the best evidence rule, completeness under amended Rule 106, and Rule 403 still apply.
Losing messages costs more than losing the authentication fight. Auto-delete settings, ephemeral apps, and wiped phones lead to sanctions under Fed. R. Civ. P. 37(e).
Deepfakes raise the stakes of a weak foundation. As of January 2026, the federal rulemakers have published a proposed rule on machine-generated evidence for comment and are holding a deepfake-specific amendment to Rule 901 in reserve. Neither changes the current law; both reward proponents who collect forensically from the start.

For the step-by-step version of this material, see Collecting and Authenticating Messaging and Social Media Evidence: A Practical Guide. The task list is in Messaging and Social Media Evidence Checklist: A Practical Checklist, and the forms are in Digital Message Evidence Toolkit: Collection Protocols, Authentication Declarations, and Rule 902 Certifications.

What "authentic" means for a message

Authentication is a claim about identity: this exhibit is the thing I say it is. For a contract, the claim is usually simple. For a message, the proponent is making at least three claims at once, and each needs its own support.

Fidelity. The exhibit accurately reproduces what appeared on a device, in an account, or on a platform. A screenshot, a printout, a forensic report, or a platform export each says, in effect, "this is what was there."
Transmission. The message was sent from a particular phone number, account, or handle to another, at roughly the time shown. This is a claim about systems: carrier records, platform logs, device databases.
Attribution. A particular human being authored the message, or adopted it. This is a claim about people, and it is the one that phones and accounts cannot prove on their own. Accounts are shared, phones are borrowed, passwords leak, and some accounts are created by someone else entirely.

Most authentication fights are really about the third claim. Lawyers who treat a message as authenticated once someone testifies "that's a fair and accurate screenshot of my phone" have proved only the first. Judges increasingly notice. When the opponent says "I didn't write that," the question becomes what else ties the words to the person.

Keeping the three claims separate also clarifies what each kind of evidence can do. A recipient's testimony proves fidelity and some transmission. A carrier or platform record proves transmission. A forensic extraction proves fidelity and transmission with metadata the recipient cannot provide. Only content, context, admissions, device possession, and conduct prove attribution.

The doctrine: a low bar with a jury at the end

Rule 901(a) and conditional relevance

Rule 901(a) asks for "evidence sufficient to support a finding." That phrase is a cross-reference to Rule 104(b), which governs facts on which relevance depends. A message from the defendant is relevant; a message from someone else pretending to be the defendant is usually not. Whether the defendant sent it is therefore a question of conditional relevance, and under Rule 104(b) the judge does not decide it. The judge asks only whether a reasonable jury could find the condition met, and the jury makes the final call.

The Supreme Court described the method in Huddleston v. United States, 485 U.S. 681 (1988), a case about other-acts evidence: the court "simply examines all the evidence in the case and decides whether the jury could reasonably find the conditional fact" by a preponderance. The judge does not weigh credibility or choose between competing stories. That is the jury's job.

Contrast Rule 104(a), under which the judge decides preliminary questions herself, by a preponderance, and may consider inadmissible evidence in doing so. Admissibility questions such as whether a hearsay exception applies, whether a statement was made by a co-conspirator, or whether an expert is reliable are 104(a) questions, as Bourjaily v. United States, 483 U.S. 171 (1987), held for co-conspirator statements. The practical consequence is that the same message can face two different judges: a lenient one on authorship (104(b)) and a strict one on the hearsay exception or the expert who explains its metadata (104(a)).

The judge's role is still meaningful

A low bar is not no bar. The judge must find enough evidence that a rational juror could conclude, more likely than not, that the defendant wrote the message. Speculation, a name on an account, or the bare assertion of the proponent's witness may not reach that line. And because the judge can admit conditionally, subject to "connecting up" later, the order of proof matters at trial: a proponent who promises a link that never arrives risks a limiting instruction or a mistrial motion.

The opponent who loses the authentication argument has not lost the point. Every weakness in the foundation can be argued to the jury as a reason to discount the message. A message that clears Rule 901 with a thin foundation may be worth very little in closing.

The Rule 901(b) toolkit for messages

Rule 901(b) lists examples, not requirements. Four do most of the work for digital messages.

Method	Rule	What it proves for a message	Typical witness or source
Testimony of a witness with knowledge	901(b)(1)	Fidelity; sometimes attribution (the author admits it, or the witness saw the author type it)	The recipient, the sender, the person who made the screenshot, a forensic examiner
Comparison by an expert or the factfinder	901(b)(3)	Attribution by comparison with authenticated messages	Messages the party admits sending; stylometric expert (rare)
Distinctive characteristics	901(b)(4)	Attribution through content, context, nicknames, photos, and timing	The recipient, plus the content itself
Process or system	901(b)(9)	Fidelity and transmission: the forensic tool or platform export produces an accurate result	Forensic examiner; platform or carrier custodian

Rule 901(b)(6), for telephone conversations, does not fit text messages well (it addresses calls to a number assigned by the telephone company), but its logic, that a reply from the number you dialed is some evidence of identity, appears in many text-message cases under the general "distinctive characteristics" heading.

Distinctive characteristics carry the most weight. Content that only the purported author would know, references to events that happened the same day, nicknames, emojis or spellings the author habitually uses, photographs of the author, the reply pattern ("on my way" followed by the author arriving), and later conduct consistent with the message all qualify. Courts look at these factors in combination. One factor rarely suffices; three or four usually do.

The recipient is the essential witness. The person who received the message can testify that the number or account was the one the author used, that they had communicated with the author through it before, that the messages responded to what they wrote, and that the screenshot or export is accurate. In civil cases, the recipient is often the client.

Admissions solve everything. A party who admits sending the message in a deposition, in an answer to a request for admission under Fed. R. Civ. P. 36, or in a stipulation ends the authentication question. Rule 36(a)(1)(B) expressly reaches "the genuineness of any described documents," and an unanswered request is deemed admitted after 30 days. For how to draft and answer those requests, see Strategic Responses to Requests for Admission: A Comprehensive Guide for Legal Practitioners.

Self-authentication: what Rules 902(11), (13), and (14) do and do not do

Rule 902 lists items that "require no extrinsic evidence of authenticity in order to be admitted." Three provisions matter for digital messages.

Rule 902(11) lets a business record that meets the requirements of Rule 803(6) come in on a written certification from the custodian or another qualified person, rather than live testimony. Carriers and platforms routinely provide these certificates with subscriber records, call detail records, and account logs.

Rule 902(13), added effective December 1, 2017, covers "a record generated by an electronic process or system that produces an accurate result, as shown by a certification of a qualified person." It is the certification version of Rule 901(b)(9). A forensic examiner can certify that a forensic tool extracted a device's message database and generated a report that accurately reflects it.

Rule 902(14), added at the same time, covers "data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification." The committee note explains that the usual process is comparison of hash values: if the hash of the copy matches the hash of the original, the copy is identical. A paralegal or examiner can certify that the production set or forensic image is a bit-for-bit copy of what was collected.

Both new provisions borrow Rule 902(11)'s notice requirement. The proponent must give the adverse party reasonable written notice before trial and make the record and certification available for inspection, "so that the party has a fair opportunity to challenge them." The committee notes also make two limits explicit. The certifications establish authenticity only; they do not resolve hearsay or any other objection. And the opponent remains free to challenge the reliability of the process.

The most important limit is conceptual, and the Third Circuit stated it plainly. A platform certificate can authenticate the platform's records of what an account did. It cannot certify that a particular person was using the account. The message text itself is not the platform's business record in any meaningful sense, because no one at the platform recorded it from personal knowledge of an act or event. That is the lesson of the Browne case, discussed below, and it explains why careful prosecutors and civil litigants use certificates for the system facts and live witnesses or circumstantial evidence for the human facts.

Item	Best route	What still needs a witness
Carrier subscriber and call detail records	902(11) certificate	Who used the phone
Platform account records (registration, IP logs, message logs)	902(11) certificate	Who operated the account
Forensic extraction report from a phone	902(13) certificate, or examiner testimony under 901(b)(9)	Who typed the messages
Production copy of a Slack or Teams export	902(14) hash certificate	That the original export was complete and accurate
Screenshot made by the recipient	Recipient's testimony under 901(b)(1)	Attribution through distinctive characteristics

The key cases, told as stories

Lorraine v. Markel: the opinion that taught a generation

In 2006 a yacht named Chessie was struck by lightning, and its owners and their insurer ended up in federal court in Maryland arguing about the scope of an arbitration award. Both sides moved for summary judgment, and both attached emails to their motions. Neither side offered anything to authenticate them. Magistrate Judge Paul Grimm denied both motions without prejudice and wrote a 101-page opinion explaining why: Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (D. Md. 2007).

Lorraine frames electronic evidence as a series of five hurdles, each of which the proponent must clear: relevance under Rule 401, authenticity under Rules 901 and 902, hearsay under Rule 801 and its exceptions, the original writing rule in Rule 1002, and unfair prejudice under Rule 403. The opinion surveys how each Rule 901(b) method applies to emails, websites, text messages, chat room content, and computer-generated records. It is still the most cited starting point, and its lesson is procedural as much as doctrinal: a lawyer who assumes electronic evidence will be admitted because the other side probably will not object is gambling with the case.

Griffin v. State: the MySpace page and the fear of fabrication

Antoine Griffin was tried in Maryland for a shooting in a bar bathroom. The prosecution wanted to show that his girlfriend, Jessica Barber, had threatened a witness. It offered a printout of a MySpace profile under the name "Sistasouljah," with a photograph of a couple, a birth date, and a post that read, in part, "snitches get stitches." The investigating sergeant testified that the photo, the birth date, and the location matched Barber. Barber herself was never asked about the page.

The Court of Appeals of Maryland reversed the conviction in Griffin v. State, 419 Md. 343 (2011). It emphasized that anyone can create a social media profile in another person's name with a photograph and a birth date, and that the sergeant's testimony did not rule out that possibility. The court suggested three ways to authenticate such evidence: ask the purported creator whether she made the profile and the post; search the purported creator's computer for internet history and stored data; or obtain information directly from the social networking site linking the profile and post to the person.

Griffin was widely read as demanding more of social media than of other evidence, and some courts followed it. Four years later, in Sublet v. State, 442 Md. 632 (2015), the same court clarified that the governing test is the ordinary one: the trial judge must find proof from which a reasonable juror could find the evidence authentic. The three Griffin methods remain good advice, and they read today as examples of what a careful proponent does rather than as a checklist the proponent must complete.

Tienda v. State: the Texas answer

Ronnie Tienda Jr. was tried in Dallas for a murder arising from a running gunfight between cars. The State offered three MySpace profiles that it said were his. They carried his nickname, photographs of him displaying gang tattoos, references to the victim's death, a song played at the victim's funeral, and a post complaining about the electronic monitor he wore while on house arrest awaiting trial.

The Texas Court of Criminal Appeals affirmed in Tienda v. State, 358 S.W.3d 633 (Tex. Crim. App. 2012). It acknowledged that someone else could theoretically have created the pages to frame him, but held that the "internal content" of the pages, taken together, was enough for a reasonable juror to find that Tienda created them. The possibility of fabrication was a question for the jury, and Tienda was free to argue it. The court distinguished Griffin on its facts: the Maryland page had a photo and a birth date; the Texas pages had a web of details that only the defendant, or someone with an implausible amount of inside knowledge, would have posted.

Parker v. State: Delaware picks a side

When the Delaware Supreme Court took up a Facebook post in Parker v. State, 85 A.3d 682 (Del. 2014), it framed the choice explicitly. Tiffany Parker was charged after a fight with another woman. The State offered a Facebook post from Parker's account, made the day of the fight, that referred to it. The victim testified about the post, and its content matched what had happened.

The court described the two approaches, the "Maryland approach" requiring greater assurance against fabrication and the "Texas approach" applying the ordinary sufficient-to-support-a-finding standard, and adopted the Texas approach. Social media evidence, the court held, should be subject to the same authentication requirements as any other evidence; concerns about fabrication are addressed by the trial judge's gatekeeping on a reasonable-juror standard and by the jury's weighing of the evidence. Most state and federal courts that have addressed the question since have landed in the same place.

United States v. Vayner: a profile page with nothing behind it

The Second Circuit's decision in United States v. Vayner, 769 F.3d 125 (2d Cir. 2014), shows the floor. Aliaksandr Zhyltsou was tried for producing a forged birth certificate. The government offered a printout of a profile on VK, a Russian social network, that bore a variant of his name and his photograph, listed a Skype handle, and mentioned workplaces matching a cooperating witness's account. The government's theory was that the Skype handle on the page tied the defendant to the email account from which the forged certificate had been sent.

The court vacated the conviction. The page had his name, his photograph, and details consistent with the witness's testimony, but there was no evidence that the defendant himself created the page or was responsible for its contents. The court compared it to a flyer found on the street bearing someone's Skype address: no court would attribute the flyer's statements to that person without some evidence that it came from him. The court stressed that the standard is not demanding, and that proof of authorship need not rule out every possibility of fabrication. But a profile page is not authenticated simply because it purports to belong to someone. The proponent has to supply something that connects the person to the page.

United States v. Browne: why a platform certificate is not enough

Tony Browne was convicted in the Virgin Islands of offenses involving minors, based in part on Facebook chats between his account and the victims. The government authenticated the chat logs with a certificate from a Facebook records custodian under Rule 902(11), and argued that the chats were therefore self-authenticating business records.

The Third Circuit rejected that theory in United States v. Browne, 834 F.3d 403 (3d Cir. 2016). The relevance of the chats depended on Browne having written them, and Facebook did not and could not attest to that. Considered in their entirety, the court held, the chat logs were not Facebook's business records under Rule 803(6), so they could not be authenticated by a Rule 902(11) certificate; otherwise every message whose storage a service provider could verify would be exempt from ordinary authentication. The court left open whether a certificate could cover narrower technical facts, such as the fact that communications passed between particular accounts at particular times. But the court affirmed anyway, because the government had offered ample extrinsic evidence: the victims testified about their conversations with him, Browne admitted that the account (in the name "Billy Button") was his, a phone he admitted owning held messages and photos of the minors, and details in the chats matched what the witnesses described. The holding is now the standard account of what Rules 902(11) and 902(13) can and cannot do for messages.

United States v. Hassan: certificates plus a trail

United States v. Hassan, 742 F.3d 104 (4th Cir. 2014), a terrorism conspiracy prosecution, is the other half of the picture. The government offered Facebook pages and YouTube videos. It authenticated them with certifications from Facebook and Google custodians and then tied the accounts to the defendants by tracking the accounts to the defendants' email addresses and to internet protocol addresses associated with them. The Fourth Circuit held that the district court did not abuse its discretion. The certifications established the records; the investigative trail established the connection to the defendants. That is the model for any proponent with access to platform records.

United States v. Barnes and United States v. Lewisbey: ordinary circumstantial proof

In United States v. Barnes, 803 F.3d 209 (5th Cir. 2015), a drug conspiracy case, the messages were attributed to a codefendant who was quadriplegic but able to text and use Facebook with his mouth and limited arm movement. A witness testified that she had seen him use Facebook, recognized his account, and found that the messages matched his manner of communicating; she had spoken with him on the number the texts came from, and their content indicated they were from him. The Fifth Circuit held that testimony sufficient even though she could not be certain he typed each message himself. Recognition of an account and a communication style, from a person who corresponded with the author, is the most common foundation in practice.

In United States v. Lewisbey, 843 F.3d 653 (7th Cir. 2016), a gun trafficking case that began when the defendant boasted on Facebook, the government offered text messages from two phones and Facebook photos of the defendant with guns and cash. The Seventh Circuit held the texts authenticated under Rule 901(b)(4): one phone was taken from him at arrest (and he complained in a recorded jail call that police had taken his phone), and the informant had arranged gun sales with him on the other. The government needed only evidence sufficient to support a finding that he sent and received the messages, and it had far more than that.

Commonwealth v. Purdy and State v. Eleck: email, Facebook, and the "I was hacked" defense

The Massachusetts Supreme Judicial Court applied the same reasoning to email in Commonwealth v. Purdy, 459 Mass. 442 (2011). The court said that evidence that an email originates from a person's account, without more, is not enough to show that the person wrote it. But here there was more: the emails were found on the hard drive of a computer the defendant admitted using, they bore his signature block, and their content referred to matters he was involved in. The combination supported a finding of authorship, and his claim that others had access to the computer went to weight.

The Connecticut Appellate Court applied the principle the other way in State v. Eleck, 130 Conn. App. 632 (2011). Here the defendant was the proponent. He wanted to impeach a prosecution witness with Facebook messages from her account that seemed to contradict her testimony. She testified that her account had been hacked and that she had not sent them. The defendant offered nothing beyond his own testimony that he downloaded the messages and that the account belonged to her. The court affirmed exclusion: the messages had no distinctive content that only she would know, and nothing tied her, as opposed to her account, to the words. Eleck is a reminder that the authentication rules apply equally to defendants and impeachment evidence, and that the "hacked account" testimony, while easy to give, can defeat a thin foundation.

The split today

The early debate is often presented as a split between "Maryland" and "Texas." That framing is now mostly history. Maryland itself has returned to the reasonable-juror standard, and federal courts have uniformly applied the Rule 901(a) standard, varying only in how much circumstantial evidence they find sufficient. What remains is a spectrum of results driven by facts, not doctrine.

Approach	What it asks	Representative authority	Practical effect
Heightened scrutiny	Evidence addressing the risk of fabrication, often through the author, the author's device, or the platform	Griffin (as originally read); Eleck; some Pennsylvania and Massachusetts decisions	Proponent should plan to show device, platform, or admission evidence
Ordinary reasonable-juror standard	Enough evidence, including circumstantial, for a reasonable juror to find authorship	Tienda; Parker; Sublet; Lewisbey; Barnes; Browne	Content and context usually suffice; fabrication goes to weight
Floor applied	No connection between person and account beyond a name and photo	Vayner	Exclusion or reversal

A few state courts, in cases such as Commonwealth v. Koch, 39 A.3d 996 (Pa. Super. Ct. 2011), and Rodriguez v. State, 128 Nev. 155, 273 P.3d 845 (2012), have stressed that a phone's ownership alone does not establish who typed a particular text, because phones are shared and borrowed. Those decisions do not reject the ordinary standard; they insist that the proponent supply something about authorship beyond ownership. Check local appellate law before trial, because the factual threshold in practice varies from court to court.

The older email and chat cases still matter

Before social media, courts worked out the same principles for email and instant messages, and those decisions remain the best illustrations of Rule 901(b)(4) in action. In United States v. Siddiqui, 235 F.3d 1318 (11th Cir. 2000), a professor was charged with fabricating award nominations. The emails asking two colleagues to "tell good words about me" came from his address, were signed "Mo" (a nickname he had told them he used), referred to details of their past work together, and were followed by phone calls in which he made the same requests. The Eleventh Circuit held them authenticated and, because he wrote them, admissible against him as party statements. In United States v. Safavian, 435 F. Supp. 2d 36 (D.D.C. 2006), the court authenticated a large set of emails by their distinctive characteristics (addresses, names, signature blocks, and subject matter) and by comparing them with emails already authenticated under Rule 901(b)(3). And in United States v. Gagliardi, 506 F.3d 140 (2d Cir. 2007), the Second Circuit held that emails and transcripts of instant-message chats were properly authenticated when the informant and the agent who took part in the conversations testified that the exhibits accurately recorded them.

The through-line is simple. A participant can authenticate the record of a conversation. Content, nicknames, and follow-up conduct can attribute it. The medium changes; the method does not.

After authentication: four more gates

The best evidence rule and screenshots

The original writing rule in Rule 1002 requires the original to prove the content of a writing, unless the rules provide otherwise. Lawyers sometimes assume this makes screenshots inadmissible. It does not, for three reasons.

First, Rule 1001(d) provides that for electronically stored information, "original" means "any printout, or other output readable by sight, if it accurately reflects the information." A printout of a text thread or a screenshot of a chat is an original if it is accurate. Second, a screenshot or a photograph of a screen is at worst a "duplicate" under Rule 1001(e), and Rule 1003 admits a duplicate to the same extent as the original "unless a genuine question is raised about the original's authenticity or the circumstances make it unfair to admit the duplicate." Third, if the original is lost or destroyed without bad faith, Rule 1004 allows other evidence of its content, including testimony.

Where the rule does bite is the "genuine question" exception and the bad-faith limit. If the opponent produces evidence that the screenshot was altered, or that the proponent discarded the phone, the duplicate may be excluded, and a party who destroyed the original in bad faith cannot use Rule 1004. The Ninth Circuit's decision in Seiler v. Lucasfilm, Ltd., 808 F.2d 1316 (9th Cir. 1987), which barred reconstructions of drawings whose originals the plaintiff had lost or destroyed in bad faith, is the classic illustration. And under Rule 1008, the jury decides disputed questions such as whether the asserted original ever existed or whether the exhibit accurately reflects it.

Long message histories raise a related point. A party that wants to show a jury 4,000 messages can offer a summary under Rule 1006, provided the underlying messages are admissible and were made available to the other side. A chart of message frequency by date, or a filtered thread of messages between two custodians, is a common and effective use.

Hearsay, in layers

A message is a statement. Whether it is hearsay depends on who offers it and for what purpose, and many messages contain more than one layer.

The opponent's own messages are not hearsay when offered against that party under Rule 801(d)(2)(A). Note the circularity: the party-statement route works only if the message is attributed to the party, which is the authentication question again. Courts treat the two inquiries together.
Adoptive admissions under Rule 801(d)(2)(B) can reach the other side of a thread. If someone texts the defendant "you shorted the shipment on purpose" and the defendant replies "keep that between us," the reply may adopt the accusation. A silence or a thumbs-up is harder; whether an emoji manifests adoption depends on context.
Employees and agents speak for the organization under Rule 801(d)(2)(D) when the message concerns a matter within the scope of the relationship and was made while it existed. Slack and Teams messages by managers about their work are the usual example.
The other half of the conversation is often admissible for a non-hearsay purpose: to give context to the party's statements, to show notice, or to show the effect on the listener. A limiting instruction under Rule 105 may be appropriate.
Platform and carrier records (subscriber data, logs, timestamps) come in as business records under Rule 803(6). The content typed by users does not become a business record because a platform stored it, as Browne explains.
Present sense impressions and excited utterances under Rule 803(1) and (2) fit many real-time messages ("he just walked in with a gun"), and courts have applied them to texts sent during or immediately after events.
The residual exception in Rule 807, amended in 2019, remains available for trustworthy messages that fit nowhere else, with advance notice.

Every message should be mapped twice: once for authentication, once for each hearsay layer it contains. A thread is a collection of statements by different people, and each one needs its own route in.

Completeness after the 2023 amendment to Rule 106

Message threads are easy to excerpt and easy to distort. A party that offers three messages from a 60-message exchange invites a completeness objection. Rule 106, as amended effective December 1, 2023, now provides that if a party introduces all or part of a statement, an adverse party may require the introduction, at that time, of any other part, or any other statement, that in fairness ought to be considered at the same time, and that the adverse party may do so over a hearsay objection.

Two changes matter. The rule now covers unrecorded oral statements as well as writings, which was a split before the amendment. More important for message evidence, the remainder comes in over a hearsay objection. Before 2023, some circuits held that Rule 106 did not make otherwise inadmissible hearsay admissible, so a defendant whose inculpatory text was offered could not always introduce his own exculpatory follow-up. That argument is now foreclosed when fairness requires the remainder. The Supreme Court's decision in Beech Aircraft Corp. v. Rainey, 488 U.S. 153 (1988), which applied the common-law completeness principle to a letter, is the background.

The practical rule for proponents: offer the whole thread, or the whole relevant portion of it, unless there is a reason not to. Selective excerpts cost credibility with the judge and usually end up in evidence anyway.

Rule 403

Messages are vivid, profane, and easy to take out of context. Rule 403 allows exclusion when the probative value of the evidence is substantially outweighed by unfair prejudice, confusion, or waste of time. Courts rarely exclude a party's own relevant messages under Rule 403, but they do exclude or redact gratuitous content (unrelated slurs, sexual content, references to other bad acts) and cumulative screenshots. See Federal Rule of Evidence 403 and Unfair Prejudice: A Practical Guide.

Metadata, forensics, and the expert witness

A screenshot carries almost no metadata about the message it depicts. It shows what a screen displayed, as rendered by an app, with a contact name chosen by the phone's owner. The underlying data is far richer.

Where the data lives. On an iPhone, messages live in a database on the device (commonly referred to as sms.db) with records of the sender's handle, the time sent and delivered and read, the service (iMessage or SMS), attachments, and edits or unsends in recent iOS versions. Android devices and apps such as WhatsApp, Signal, and Telegram keep their own databases, some encrypted on the device. iCloud and Google backups may hold copies, and "Messages in iCloud" may sync conversations across a user's devices, which is how a teenager's iPad can display a parent's texts. Workplace tools such as Slack and Microsoft Teams store messages on the vendor's servers and export them, with metadata, through administrative tools whose availability depends on the customer's plan.

How it is collected. Forensic examiners use tools such as Cellebrite, Magnet AXIOM, and similar products to perform logical, file-system, or full extractions, depending on the device and its security. The output is a report and a set of extracted files, verified by hash values. A competent examiner documents the tool and version, the extraction type, the hash of the extraction, and the chain of custody. For cloud accounts, collection may run through the account itself with the user's credentials and consent, or through the vendor's export tools.

What metadata proves. Metadata can show that a message was sent from a particular handle at a particular time, whether it was edited, whether a contact name was changed, whether a screenshot was created on the device on a given date, and whether files were deleted or the device was reset. It can corroborate attribution indirectly: the phone's location data placing it at the owner's home at 11:42 p.m., the same minute a message went out, or the device's unlock record showing the owner's passcode or biometric was used shortly before.

The expert gate. A forensic examiner who explains these facts is offering opinion testimony based on specialized knowledge, so Rule 702 applies. The 2023 amendment to Rule 702 made explicit that the proponent must show the court that it is more likely than not that the testimony meets each requirement, including that the opinion "reflects a reliable application of the principles and methods to the facts of the case." That is a Rule 104(a) question for the judge, applying Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993). Routine extraction testimony rarely fails Rule 702. Interpretive opinions (that a database artifact shows deletion, that a screenshot was altered, that a message was composed on a different device) are where challenges succeed or fail. Disclosure under Fed. R. Civ. P. 26(a)(2) applies to retained examiners, and the opposing expert will ask for the extraction itself. For the amended standard in depth, see Expert Witnesses After the 2023 Amendment to Rule 702: Daubert, Disclosure, and Cross-Examination.

Not every case needs an expert. A recipient's testimony plus content is enough in most civil cases where authorship is not seriously disputed. The expert becomes necessary when the opponent denies authorship with something more than a shrug, when alteration is alleged, when deletion or spoliation is at issue, or when the proponent wants to authenticate by certification under Rule 902(13) or (14).

Getting the messages: parties, devices, and the Stored Communications Act

Authentication presupposes that you have the messages. Where they come from shapes how easily they are authenticated.

From your own client. The simplest source is the client's phone, account, or workplace system. Collect forensically where the stakes justify it; at minimum, export the full thread with metadata rather than relying on screenshots. A client who forwards screenshots by email has created a fidelity question and destroyed the metadata that would have answered it.

From the opposing party. Messages on the other side's phone or accounts are within its "possession, custody, or control" under Fed. R. Civ. P. 34, including content stored with a provider that the party can download. Privacy settings do not shield relevant content from discovery. New York's highest court made that point about private Facebook material in Forman v. Henkin, 30 N.Y.3d 656 (2018), rejecting a rule that would have required a threshold showing from the public portion of the account before private content could be sought. Requests should be targeted by date range, participant, and subject, and the producing party should produce in a format that preserves metadata. ESI protocols increasingly address mobile and chat data specifically; see Negotiating an ESI Protocol and Managing E-Discovery Costs. When a party refuses, the remedy is a motion under Rule 37; see Motions to Compel and Discovery Sanctions Under Rule 37: From Meet-and-Confer to Default Judgment.

From the platform. This is where many lawyers' plans fail. The Stored Communications Act, 18 U.S.C. § 2702(a), bars providers of electronic communication services and remote computing services to the public from knowingly divulging the contents of communications, and the statute contains no exception for civil subpoenas. Providers may disclose non-content records (subscriber information, logs) to non-government entities under § 2702(c)(6), and contents with the lawful consent of the originator or an addressee or intended recipient under § 2702(b)(3). Courts have consistently quashed civil subpoenas seeking message content from providers. In Crispin v. Christian Audigier, Inc., 717 F. Supp. 2d 965 (C.D. Cal. 2010), the court quashed subpoenas to Facebook and MySpace for an artist's private messages, and remanded the question of wall posts and comments for consideration of the user's privacy settings. In In re Request for Order Requiring Facebook, Inc. to Produce Documents and Things, 923 F. Supp. 2d 1204 (N.D. Cal. 2012), the court refused to compel Facebook to produce account content, even for authentication purposes, without the user's consent. And the Ninth Circuit's decision in Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004) shows the risk of overreaching: a "patently unlawful" subpoena that caused a provider to disclose emails exposed the issuing party to liability under the Act.

Criminal defendants face the same wall. In Facebook, Inc. v. Superior Court (Hunter), 4 Cal. 5th 1245 (2018), defendants charged with murder subpoenaed Facebook, Instagram, and Twitter for a victim's and a witness's communications. The California Supreme Court held that communications the user configured to be public fall within the lawful-consent exception, so providers may be compelled to produce them, while restricted communications remain protected, and it remanded for the trial court to sort out which were which. The government, by contrast, can compel content with a warrant under 18 U.S.C. § 2703. For the government-access side, see Cross-Border Government Demands for Data: The Stored Communications Act, the CLOUD Act, and MLATs.

The workaround in civil cases is consent. A court can order a party to consent to the provider's disclosure, or more often to download and produce its own account data using the platform's tools. Subpoena the platform for non-content records (registration, IP logs, account creation date), which can support authentication of the content the party produces. Records from nonparties follow Fed. R. Civ. P. 45; see Nonparty Discovery Toolkit: Subpoenas, Third-Party Records, and Privilege.

Self-help limits. A spouse, employer, or business partner who logs into someone else's account or reads their phone without authorization may violate the Stored Communications Act's access prohibition in 18 U.S.C. § 2701, the Wiretap Act in 18 U.S.C. § 2511 if communications are intercepted in transit, state computer crime laws, and in some cases the Computer Fraud and Abuse Act at 18 U.S.C. § 1030, whose "exceeds authorized access" clause the Supreme Court narrowed in Van Buren v. United States, 593 U.S. 374 (2021). Recording calls is a separate problem: federal law permits one-party consent recording under § 2511(2)(d), but states such as California require the consent of all parties to a confidential communication under Cal. Penal Code § 632. Illegally obtained evidence may be excluded, can expose the client to civil and criminal liability, and makes for a hard cross-examination. Workplace rules on monitoring are covered in Employee Monitoring and Workplace Privacy: A Practical Guide.

Ephemeral messages, auto-delete, and spoliation

The fastest way to lose a messaging dispute is to lose the messages. Rule 37(e), rewritten in 2015, governs electronically stored information that "should have been preserved in the anticipation or conduct of litigation" and is lost because a party failed to take reasonable steps to preserve it and cannot be restored or replaced. If the loss prejudices the other side, the court may order measures no greater than necessary to cure the prejudice. Only on a finding of "intent to deprive" may the court presume the information was unfavorable, give an adverse-inference instruction, or dismiss or enter default.

Messaging cases have supplied many of the leading Rule 37(e) decisions.

In DR Distributors, LLC v. 21 Century Smoking, Inc., 513 F. Supp. 3d 839 (N.D. Ill. 2021), a trademark case, the court imposed sanctions after the defendants and their counsel failed for years to preserve, search, and produce web-based email and other ESI, with key material surfacing only on the eve of trial. The opinion is notable for its attention to counsel's own duties: lawyers must understand where their client's data lives.
In WeRide Corp. v. Kun Huang, No. 5:18-cv-07233 (N.D. Cal. Apr. 24, 2020), a trade secret case, the court entered terminating sanctions against defendants who, among other things, wiped devices and continued to use an enterprise messaging app configured to delete messages after litigation began.
In FTC v. Noland, No. CV-20-00047 (D. Ariz. Aug. 30, 2021), the individual defendants moved their leadership communications to the encrypted apps Signal and ProtonMail after learning of the FTC's investigation, and the court found intent to deprive and authorized an adverse inference.
In Fast v. GoDaddy.com LLC, 340 F.R.D. 326 (D. Ariz. 2022), the plaintiff in an employment case deleted Facebook posts, "unsent" a Facebook message summarizing her evidence, and deleted Telegram messages with a coworker after she anticipated suing. The court ordered an adverse-inference instruction under Rule 37(e)(2), allowed the defense to tell the jury about undisclosed redactions, authorized a forensic review of her devices, and shifted fees.
In Paisley Park Enterprises, Inc. v. Boxill, 330 F.R.D. 226 (D. Minn. 2019), defendants who failed to disable their phones' auto-delete settings and later wiped the phones were sanctioned under Rule 37(e)(1); the court stressed that disabling auto-delete is a basic, inexpensive preservation step.

The enforcement agencies have made the same point outside litigation. The Department of Justice's 2023 revisions to its guidance on evaluating corporate compliance programs ask whether companies govern the use of personal devices and ephemeral messaging apps, and the SEC has brought a long series of "off-channel communications" cases against broker-dealers and advisers for failing to preserve business texts and WhatsApp messages, and the SEC's fiscal 2024 enforcement results counted more than $2 billion in penalties against more than 100 firms since late 2021. Companies that allow Signal or disappearing messages for business communications without a preservation solution are building a spoliation record before any lawsuit exists.

For the full preservation framework, see Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case, and for the sanctions motion itself, Bringing or Opposing a Motion to Compel Discovery: A Practical Guide.

Fabricated messages and deepfakes

Fabrication is old; detection is better than people think

Forging a text conversation requires no skill. Websites and apps generate realistic fake iMessage and WhatsApp screenshots; a phone's contact name can be edited to make any number appear as anyone; and a screenshot of a conversation can be edited in any image program. What forgers usually cannot do is fabricate the underlying data consistently across devices, accounts, carriers, and backups.

Rossbach v. Montefiore Medical Center, 81 F.4th 124 (2d Cir. 2023), is the cautionary tale. The plaintiff's sexual harassment claims rested principally on a document depicting sexually suggestive text messages she said she received from a supervisor. She testified that she received them on an iPhone 5 whose cracked screen prevented a screenshot, so she photographed the messages with a newer iPhone. A forensic expert testified that the document did not depict text messages as they would appear on an iPhone 5, or any iPhone, because of differences in icons, contact information, font, and emoji design. The district court (Judge Cote) found by clear and convincing evidence that the document was a forgery, that the plaintiff had lied about its origin, and that she spoliated evidence by withholding the correct passcode to the older phone and disposing of the newer one. It dismissed the case. The Second Circuit affirmed the dismissal and the sanctions against the plaintiff, while vacating the sanction against her counsel because the district court had applied the wrong legal standard to them.

The lesson cuts both ways. Proponents with genuine messages should collect them in a way that makes the underlying data available. Opponents facing a suspicious screenshot should demand the device, the account export, or a forensic image, and should retain an examiner early. The authenticity of a screenshot is often decided by details a lay witness would never notice.

Generative AI and the "liar's dividend"

Generative tools now produce plausible synthetic images, audio, and video, and can produce text in a particular person's style. Two problems follow. One is fabrication: fake evidence offered as real. The other is the reverse, sometimes called the liar's dividend: real evidence dismissed as fake, because everyone knows fakes exist. Courts have begun to encounter both. In September 2025, a California trial judge in Alameda County dismissed a civil case with prejudice (Mendones v. Cushman & Wakefield, No. 23CV028772 (Cal. Super. Ct. Alameda Cnty. Sept. 9, 2025)) after finding that the self-represented plaintiffs had submitted deepfake videos and altered images as summary judgment exhibits; the decision has been widely discussed as among the first terminating sanctions for deepfake evidence.

The existing rules handle both problems reasonably well. Rule 901(a) already requires evidence sufficient to support a finding of authenticity, and a court can find that standard unmet when the opponent presents credible evidence of fabrication. Rule 403 allows exclusion of evidence whose prejudicial effect outweighs its probative value when its provenance is doubtful. Rule 702 governs the experts who explain whether something was generated or altered. And sanctions, criminal perjury, and fraud-on-the-court doctrine deter fabrication.

The federal rulemaking, as of January 2026

The Advisory Committee on Evidence Rules has spent several years on two related questions, and their status matters.

Proposed Rule 707 (machine-generated evidence). In 2025 the Judicial Conference's Standing Committee approved publication of a proposed new Rule 707 for public comment. As published, it would provide that when machine-generated evidence is offered without an expert witness and would be subject to Rule 702 if a witness testified to it, the court may admit it only if it satisfies the requirements of Rule 702(a) through (d), with an exception for the output of basic scientific instruments. The concern is that a party could offer the output of an AI system or other complex software (an analysis of message patterns, an AI-generated reconstruction) without any human expert subject to Rule 702 scrutiny. The public comment period runs to February 16, 2026. If the committees approve it after comment, the ordinary Rules Enabling Act process would make December 1, 2027 the earliest plausible effective date. Proposed Rule 707 is not about authentication; it concerns the reliability of machine outputs. But it will matter in message cases where a party offers an AI tool's analysis of who wrote a message or whether it was altered.

A deepfake amendment to Rule 901. The committee has also studied proposals to add a provision, often discussed as Rule 901(c), that would shift burdens when a party makes a sufficient showing that an item may have been fabricated by AI: the opponent would have to come forward with evidence supporting a finding of fabrication, and the proponent would then need to show authenticity by a higher standard than the ordinary prima facie one. The committee chose in 2025 not to publish a deepfake rule for comment. Its December 2025 report describes a draft Rule 901(c) as tentatively approved but held in abeyance, because the committee was not yet convinced that deepfakes are frequently offered in federal court or that existing authenticity rules cannot handle them; it asked the Federal Judicial Center to survey judges and will decide later whether to publish. Practitioners should check the committee's current agenda before relying on either proposal.

Neither proposal changes current law. Both point the same direction: provenance matters more each year, and the party who can show where a message came from, through device data, platform records, hash values, and witnesses, will rarely lose the authentication fight.

Emojis, reactions, and what a message means

Authentication proves who sent a message. It does not prove what it meant. Emojis, reactions, GIFs, and shorthand are now routine evidence of intent, agreement, and threat, and their meaning is a fact question for the jury, informed by context and sometimes by testimony about how the parties communicated.

Courts outside the United States have drawn particular attention. In South West Terminal Ltd. v. Achter Land & Cattle Ltd., 2023 SKKB 116, a Saskatchewan court held that a farmer who replied with a thumbs-up emoji to a photo of a signed grain contract had accepted the contract, and awarded damages for his failure to deliver; the Saskatchewan Court of Appeal affirmed 2-1 in Achter Land & Cattle Ltd. v. South West Terminal Ltd., 2024 SKCA 115, and the Supreme Court of Canada denied leave to appeal in July 2025. American courts have treated emojis similarly, as evidence to be interpreted in context rather than as legally meaningless decoration. Two practical points follow. Emojis render differently on different platforms and software versions, so the version shown to the jury should match what the recipient saw (as Rossbach illustrates, emoji design can also expose a forgery). And the parties' history of using a particular emoji or phrase is admissible evidence of what it meant between them. For how courts read informal communications in contract formation, see How Courts Read Contracts: Ambiguity, Extrinsic Evidence, and the Canons of Construction and Electronic Signatures and Records Under ESIGN and UETA: What Actually Binds.

Practical implications for each side

For the proponent

Build three foundations, not one. For each key message, plan how you will prove fidelity (the exhibit matches the source), transmission (the account or number sent it), and attribution (the person wrote it). Write the plan down before discovery closes.
Collect from the source. Export or image the device or account rather than relying on screenshots, and keep hash values. A screenshot is a fine trial exhibit; it is a poor collection method.
Use the cheapest certain route first. A request for admission under Rule 36 or a stipulation costs almost nothing. A deposition question ("Is this your number? Did you send this?") locks in the answer. Certificates under Rules 902(11), (13), and (14) dispose of the system facts with written notice.
Pair certificates with people. A platform certificate handles transmission; a recipient, an admission, or content handles attribution.
Serve pretrial disclosures carefully. Under Rule 26(a)(3)(B), objections to the admissibility of listed exhibits must be served within 14 days after the disclosures or are waived (except for objections under Rules 402 and 403) unless the court excuses the failure for good cause. List every message exhibit specifically, and watch for the authentication objections that come back.
Offer whole threads. Amended Rule 106 will bring in the rest of the conversation anyway, and the jury will wonder why you hid it.
At summary judgment, show that you can authenticate at trial. Since the 2010 amendments, Rule 56(c)(2) asks whether the material "cannot be presented in a form that would be admissible in evidence." Courts such as the Fifth Circuit in Maurer v. Independence Town, 870 F.3d 380 (5th Cir. 2017), have held that summary judgment evidence need not be authenticated in the motion papers if it is capable of being authenticated at trial. Still, an exhibit attached to an attorney declaration with no foundation invites the Lorraine problem. Attach the recipient's declaration. For Rule 56 practice generally, see Summary Judgment Under Rule 56: Winning and Surviving Before Trial.

For the opponent

Decide early whether authorship is genuinely disputed. A frivolous authentication objection costs credibility and may be met with a Rule 37(c)(2) fee request if you denied a request for admission without basis. A real dispute deserves real evidence.
Ask for the source. Demand native production of the thread, the device or a forensic image under an agreed protocol, the account export, and the screenshot's own file with its metadata.
Retain an examiner before you allege fabrication. "Anyone could have typed that" is an argument for the jury, not a ground for exclusion. A forensic finding that the screenshot does not match the device's data is a ground for exclusion and sanctions.
Object in time. Serve Rule 26(a)(3)(B) objections within 14 days, and consider a motion in limine for the key exhibits. See Drafting and Opposing Motions in Limine: A Practical Guide and the motion bank in Motion in Limine Toolkit: Standard Motion Banks, Opposition Frameworks, and Trial Objection Plans.
Separate authentication from hearsay and completeness. Even an authenticated message may be inadmissible hearsay as to the other side's statements, or misleading without the rest of the thread.
Preserve your own data. An opponent who cries fabrication while having discarded the phone that would prove it is in a weak position, and may face Rule 37(e) consequences.

For judges

Courts manage these disputes best when they require the parties to identify authentication disputes before trial, rule on them through motions in limine or a pretrial hearing, and decide only the Rule 104(b) question (could a reasonable juror find authenticity?) while leaving weight to the jury. When an opponent offers credible evidence of fabrication, a preliminary evidentiary hearing outside the jury's presence allows the court to hear the forensic testimony before deciding whether the threshold is met.

An extended worked example

Return to Harlan Freight. The plaintiff, a dispatcher named Joanna Reyes, sued for unpaid overtime under the Fair Labor Standards Act and for retaliation after she complained. Her central exhibit is the screenshot of a text from "Rick (Ops)": "Don't put the overtime in writing. Just tell them it's comp time." The operations manager, Rick Albers, says he does not remember sending it, changed phones that spring, and shares an Apple ID with his family.

Step one: the three foundations. Reyes's counsel maps them. Fidelity: Reyes can testify the screenshot accurately shows her phone, and a forensic collection of her phone can confirm that the message exists in her device's database with a timestamp and the sending handle. Transmission: the handle is Albers's mobile number, which appears in Harlan's employee directory and on his business card; Harlan's phone stipend records show it was his work number. Attribution: the message was part of a thread in which Albers, the same evening, texted about the next day's dispatch schedule, using the nickname he used for Reyes ("JoJo"); it responds to a question Reyes asked about logging her hours; and two days later Harlan's payroll records show comp time recorded instead of overtime for Reyes's team.

Step two: discovery. Counsel serves a request for admission that Albers sent the message, and a request for production of his phone's message data for the relevant month under an agreed forensic protocol. Albers denies the admission, citing lack of memory. Counsel deposes him and walks through the thread: he admits the dispatch messages before and after the disputed one, admits "JoJo" is his nickname for Reyes, and admits his family members do not know Reyes or anything about her hours. His new phone does not contain the old messages, because he did not transfer them, but Harlan's mobile device management system retained a backup of his work phone.

Step three: the forensic layer. Harlan's backup, produced under Rule 34, contains the same message with the same timestamp, sent from Albers's work phone. Reyes's examiner prepares a short report and a Rule 902(13) certification for the extraction of Reyes's phone and a Rule 902(14) certification for the hash-verified copy of Harlan's backup. Counsel gives written notice of the certifications in the pretrial disclosures.

Step four: the objections. Harlan objects under Rule 26(a)(3)(B) on authentication grounds and moves in limine. Counsel's opposition sets out the 901(b)(4) evidence, the matching backup, and the admissions about surrounding messages. It argues that whether Albers or a family member typed one message in the middle of a thread of his own work messages is a weight question under Lewisbey and Barnes, and that nothing in the record resembles Vayner's empty profile. The court denies the motion, finding sufficient evidence for a reasonable juror to find that Albers sent the message.

Step five: the other gates. The message is a statement of a party's agent on a matter within the scope of his employment under Rule 801(d)(2)(D), so hearsay is not a problem. Harlan invokes Rule 106 to introduce Albers's later message in the thread, "Ask HR if you're not sure," and the court admits it, over Reyes's hearsay objection, because fairness requires it. Reyes's counsel had planned for that and offers the full thread herself.

What the defense could have done better. If the defense had a real basis to believe a family member sent the message, the time to develop it was in discovery: Apple ID device logs, the iPad's own database, the family member's testimony. "I don't remember" is not evidence of fabrication. And if Harlan had not retained the work phone backup, Albers's failure to preserve his old phone after Reyes's complaint could have supported a Rule 37(e)(1) curative measure.

Common mistakes

Treating "fair and accurate" as the whole foundation. The recipient's testimony proves fidelity. It rarely proves authorship by itself when authorship is disputed.
Collecting by screenshot. Screenshots strip metadata and invite Rossbach-style challenges. Export or image the source and keep the screenshots as exhibits.
Relying on a platform certificate for authorship. Browne forecloses that argument. Use certificates for system facts and witnesses for people.
Forgetting the notice requirement. Rules 902(11), (13), and (14) require reasonable written notice and an opportunity to inspect before trial.
Subpoenaing the platform for content. The Stored Communications Act prohibits providers from disclosing content in response to a civil subpoena. Get it from the party, with consent or through Rule 34.
Letting auto-delete run. Disabling disappearing messages and auto-delete settings is the cheapest preservation step and the one most often missed.
Missing the 14-day objection window. Authentication objections not served under Rule 26(a)(3)(B) are waived absent good cause.
Excerpting threads. Amended Rule 106 lets the other side complete the conversation over a hearsay objection.
Alleging fabrication without forensics. An accusation without evidence wastes the court's patience and can end in fee-shifting.
Ignoring how the message looked to the recipient. Emoji rendering, contact names, and app versions affect both meaning and authenticity.

Frequently asked questions

Is a screenshot of a text message admissible? Usually, if a witness with knowledge (typically the recipient or the person who took the screenshot) testifies that it accurately shows what was on the device, and there is enough evidence to attribute the message to its purported author. The best evidence rule does not bar screenshots, because Rule 1001(d) treats an accurate printout or display of electronic information as an original and Rule 1003 admits duplicates.

Does the proponent have to call the person who sent the message? No. Authorship can be shown circumstantially, through content, context, the phone number or account, nicknames, replies, and later conduct. The sender's admission is the strongest evidence, but it is not required.

Can a platform's records custodian authenticate a Facebook or Instagram message? A custodian's certificate under Rule 902(11) can authenticate the platform's records of account activity. It cannot establish that a particular person wrote the message. Most courts follow Browne on this point and require additional evidence of authorship.

What do Rules 902(13) and 902(14) add? They let a qualified person certify, rather than testify live, that an electronic process produced an accurate result (902(13)) or that a copy is identical to the original by hash comparison (902(14)). They save trial time and witness costs, but they authenticate only, require advance notice, and do not resolve hearsay or authorship.

What happens if the other side says the account was hacked? The claim goes to weight unless it is backed by evidence that undermines the foundation. Courts admit messages over unsupported hacking claims when the circumstantial evidence of authorship is strong, and exclude them, as in Eleck, when the proponent has nothing beyond the account name.

Can I subpoena WhatsApp, Meta, or Google for someone's messages? Not the content, in a civil case. The Stored Communications Act prohibits providers from disclosing message content to private litigants without the user's consent. You can usually obtain non-content records such as subscriber information and logs. Seek the content from the party through Rule 34.

Does using Signal or disappearing messages violate the rules? Using the app is not itself sanctionable. Using it, or leaving disappearing messages on, after the duty to preserve attaches can lead to Rule 37(e) sanctions, and courts have found intent to deprive when parties switched to ephemeral apps after learning of an investigation or lawsuit.

Do the deepfake proposals change how I authenticate messages today? No. As of January 2026, proposed Rule 707 is out for public comment and the Rule 901 deepfake amendment has not been published. Current law is Rules 901 and 902 as they stand. The proposals reinforce the value of forensic collection and provenance evidence.

Takeaways

Separate fidelity, transmission, and attribution, and prove each.
The Rule 901(a) standard is low, but a name on an account is not enough.
Platform certificates prove records; people and content prove authorship.
Collect from the source with hash values, and use Rules 902(13) and (14) with notice.
Map every message for hearsay layers and completeness before offering it.
Turn off auto-delete the day the duty to preserve attaches.
Get content from parties, not providers.
Allege fabrication only with forensic support, and expect the proponent to do the same.

This document is general information, not legal advice for any particular situation; the law changes, the rulemaking described here was pending as of January 2026, and the facts matter.