Collecting and Authenticating Messaging and Social Media Evidence: A Practical Guide

Summary. This guide takes a litigator step by step from the first moment a text, chat, or post matters to a case through its admission at summary judgment and trial, and shows the opposing side what to do at each stage. It begins with decision points about the role the messages will play, who controls the source, and whether authorship will be disputed. The steps cover mapping sources and custodians, preservation and auto-delete settings, the custodian interview, choosing a collection method from screenshots to full forensic extraction and enterprise exports, review and processing, production formats and requests to the other side, the Stored Communications Act limits on subpoenas to platforms, and locking in authenticity through requests for admission, depositions, and stipulations. Later steps address authentication on summary judgment under Rule 56(c), certifications under Rules 902(11), (13), and (14), trial foundations, completeness and hearsay mapping, and the opponent's challenges, including fabrication and deepfake claims. A timeline and cost table, a worked example built on a departing-employee dispute, common mistakes, an FAQ, and takeaways close the guide.

The general counsel of Bramblewood Outfitters, a 140-person outdoor gear company, forwards three screenshots on a Tuesday morning. They came from a sales rep who still has a friend at a competitor. The first is an iMessage from Theo Marsh, Bramblewood's regional sales director until two weeks ago, to the competitor's chief executive: "Sending you the Q3 dealer pricing tonight. Delete after." The second is a WhatsApp message Marsh sent to a group of dealer buyers, announcing he has "moved to Ridgeline" and that "terms will be better." The third is a LinkedIn direct message to Bramblewood's largest account.

The general counsel's question is the obvious one: can we use these? The honest answer is "not yet." Screenshots forwarded by a friend of a friend are a lead, not evidence. Turning them into admissible proof means finding the original messages, preserving them on devices and accounts the company controls and on the ones it does not, collecting them in a way that carries metadata and a chain of custody, getting the other side's copies, and building a foundation that will survive the motion in limine Ridgeline's counsel is certain to file. Every one of those steps has a clock, and some of them close quickly.

This guide is the sequence. The doctrine behind it, including the leading cases on social media authentication, is in Authenticating Text Messages, Chats, and Social Media Evidence: Rules 901 and 902, Metadata, and Deepfake Challenges. The task list is in Messaging and Social Media Evidence Checklist: A Practical Checklist, and the forms (collection protocol, interview script, declarations, certifications, requests for admission, and a motion in limine) are in Digital Message Evidence Toolkit: Collection Protocols, Authentication Declarations, and Rule 902 Certifications.

The short answer

• Preserve first, at the source. The day the duty to preserve attaches, turn off auto-delete and disappearing messages, stop device recycling, and send hold notices that name phones and chat apps specifically. Losses after that day are measured under Fed. R. Civ. P. 37(e).
• Collect from the source, not from screenshots. Use an export or forensic extraction that captures metadata and a hash value. Keep screenshots as exhibits and leads.
• Plan three foundations for each important message. Fidelity (the exhibit matches the source), transmission (this account or number sent it), and attribution (this person wrote it). Authorship is where challenges succeed.
• Get content from parties, not platforms. The Stored Communications Act, 18 U.S.C. § 2702, bars providers from disclosing message content in response to civil subpoenas. Subpoena platforms for non-content records; obtain content through Rule 34 or consent.
• Lock in authenticity cheaply. Requests for admission under Rule 36, deposition questions, and stipulations eliminate most trial fights.
• Use certifications with notice. Rules 902(11), (13), and (14) let records custodians and examiners certify instead of testify, with advance written notice. They establish records and copies, not who typed the words.
• Watch the 14-day window. Objections to listed exhibits must be served within 14 days after pretrial disclosures under Rule 26(a)(3)(B) or are waived, except for Rule 402 and 403 objections.
• Challenge with evidence. For the opponent, a forensic examiner's finding beats an argument that "anyone could have typed that."

Before you start: five decision points

1. What role will the messages play? A message that is the claim itself (a threat, a defamatory post, an acceptance of an offer, a disclosure of a trade secret) needs the strongest foundation and usually forensic collection. A message that is background or impeachment may need only the recipient's testimony. Rank the messages early; collection effort should follow importance.

2. Who controls the source? The answer determines the legal route.

3. Will authorship be disputed? If the author is your client or will plainly admit the message, a careful export and the recipient's testimony are enough. If the author is adverse, has a shared device or account, or has already said "I don't remember," plan for forensic collection, platform records, and a deposition designed to pin down the surrounding messages.

4. Which jurisdiction's law applies? Federal courts apply the Rule 901(a) standard: evidence sufficient to support a finding. Most states follow the same approach, as in Tienda v. State, 358 S.W.3d 633 (Tex. Crim. App. 2012), and Parker v. State, 85 A.3d 682 (Del. 2014). Some state decisions demand more evidence tying a person to an account, following Griffin v. State, 419 Md. 343 (2011), though Maryland itself later confirmed the ordinary reasonable-juror test in Sublet v. State, 442 Md. 632 (2015). Read the forum's appellate decisions before deciding how much to spend.

5. Is the collection lawful? Clients sometimes arrive with messages they took from a spouse's phone, a former partner's laptop, or a colleague's account. Unauthorized access can violate 18 U.S.C. § 2701, the Wiretap Act at 18 U.S.C. § 2511, the Computer Fraud and Abuse Act at 18 U.S.C. § 1030, and state law. Recording calls without the consent of all parties is unlawful in some states, including California under Cal. Penal Code § 632. Find out how the client got the material before you use it, and do not direct further self-help. Workplace monitoring rules are in Employee Monitoring and Workplace Privacy: A Practical Guide.

Step 1: Map the sources and the custodians

What to do. List every person whose messages matter (the custodians) and, for each, every place their messages might live. Do not stop at the phone. Messages sync and copy themselves across devices and backups, and the copy you need may be on an iPad, a laptop, a cloud backup, or the other party's phone.

Why. Preservation and collection are only as good as the map. Courts expect counsel to know where the client's data is; the court in DR Distributors, LLC v. 21 Century Smoking, Inc., 513 F. Supp. 3d 839 (N.D. Ill. 2021), sanctioned a party and criticized its lawyers for failing for years to identify and search web-based accounts. That echoes the duty described long ago in Zubulake v. UBS Warburg LLC, 229 F.R.D. 422 (S.D.N.Y. 2004): counsel must become fully familiar with the client's information systems.

Pitfalls. Forgetting group chats (other members hold copies); forgetting company channels used for personal messages, and personal channels used for business; forgetting that a departed employee's company phone may already be in a drawer awaiting reset.

Timing and cost. One to five days, mostly attorney and IT time. A data map for a handful of custodians costs little; one for a company with hundreds of custodians across several chat tools is a project.

Step 2: Preserve, including turning off auto-delete

What to do. Issue a written litigation hold the day litigation becomes reasonably anticipated. For messaging, the hold must be specific: name texts, iMessage, WhatsApp, Signal, Teams, Slack, and social media; instruct custodians to turn off disappearing messages and auto-delete settings (in iPhone settings, "Keep Messages" set to forever rather than 30 days or one year); prohibit deleting apps, resetting or trading in phones, or leaving group chats; and require custodians to confirm in writing. Suspend enterprise retention policies for Slack, Teams, and email for the relevant custodians. Pull departed employees' company devices out of the reimaging queue.

Send preservation letters to the opposing party and key nonparties, specifying the same channels and the auto-delete instruction. For platforms, recognize that civil preservation requests have no statutory force (the preservation demand in § 2703(f) belongs to governmental entities), but a short letter identifying the account costs nothing and may be honored.

Why. Rule 37(e) sanctions apply when ESI that should have been preserved is lost because a party failed to take reasonable steps. Messaging is where the most dramatic cases arise. In FTC v. Noland, No. CV-20-00047 (D. Ariz. Aug. 30, 2021), the court granted an adverse-inference sanction after the individual defendants moved to Signal and ProtonMail and their communications were lost. In Fast v. GoDaddy.com LLC, 340 F.R.D. 326 (D. Ariz. 2022), a plaintiff's deletion of Facebook posts and Telegram messages after she anticipated suing led to an adverse-inference instruction, forensic review of her devices, and fee shifting. The full preservation framework is in Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case and Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.

Pitfalls. Sending a generic hold that never mentions phones; assuming custodians know how to turn off auto-delete; failing to follow up; preserving the employee's laptop and forgetting the phone; preserving the client's data while the client keeps using Signal with disappearing messages for business.

For the other side. If you represent the party receiving a preservation letter, the duty is the same. Confirm the settings change in writing, and if the client cannot or will not preserve some category, say so promptly and negotiate. Silence followed by loss is the worst record.

Timing and cost. Same day for the hold and settings changes. Vendor costs are minimal at this stage; the cost of skipping it can be the case.

Step 3: Interview each custodian about devices and accounts

What to do. Before collecting, interview each key custodian with a structured script. Ask: which phones they have used during the relevant period, with dates of changes; whether they transferred messages to the new phone; which Apple ID or Google account is on each device, and who else uses those accounts or devices; which messaging apps they use and with whom; whether disappearing messages or auto-delete were ever on; whether they deleted anything, and when; whether they ever took screenshots, and how they stored or sent them; what contact names they assigned to the key people; whether they ever lent the phone or shared the passcode; and whether anyone else had access to their social media accounts.

Why. The interview tells you what to collect, flags preservation problems while they can still be fixed, and surfaces the facts the other side will use to attack attribution. "My kid uses my iPad" is better heard in an interview than at a deposition. Document the interview in a privileged memo.

Pitfalls. Asking only about the messages you already know; failing to ask about deletion because the answer is uncomfortable; interviewing after collection, when it is too late to collect the source the custodian forgot to mention.

Timing and cost. Thirty to sixty minutes per custodian. A script appears in the toolkit.

Step 4: Choose a collection method

What to do. Match the method to the message's importance and the likelihood of an authorship fight.

Chain of custody. For every collection, record who collected, when, from what device or account (make, model, serial or IMEI, account identifier), with what tool and version, the extraction type, and the hash value of the resulting file. Store the original extraction read-only, and work from copies. The hash recorded at collection is what makes a Rule 902(14) certification possible later.

Why. The method chosen now fixes what you can prove later. A screenshot cannot show when a message was sent, whether it was edited, or which device sent it. A forensic extraction can, and its metadata may answer an authorship challenge before it is made. The cautionary case is Rossbach v. Montefiore Medical Center, 81 F.4th 124 (2d Cir. 2023), in which forensic analysis showed that a plaintiff's image of supposed text messages did not match how messages appear on any iPhone, and the case was dismissed as a sanction.

Pitfalls. Letting the client "send over" the messages; collecting from the device but not the backup; using a tool without recording its version; collecting only the message the client highlighted, without the thread around it; collecting a departed employee's phone without checking whether personal accounts on it require consent.

For the other side. If the opponent has collected only screenshots, note it. Request the native data and the device (Step 6), and preserve the issue for a fidelity and attribution challenge.

Timing. Forensic collection can usually be scheduled within days. Enterprise exports may take longer if retention settings or plan limits require vendor involvement.

Step 5: Review and process the messages

What to do. Load the collections into a review platform that can display messages as conversations rather than as single-line records. Short message formats such as the Relativity Short Message Format (RSMF) are widely used to present chats as threads with participants and timestamps. Set rules for:

• Threading and "documents." Decide what unit of review and production applies: a conversation per day, per 24-hour window, or per thread. Agree on it with the other side where possible.
• Time zones. Normalize to one zone (usually UTC) and display local time in exhibits with the zone stated. Many authentication disputes start with a timestamp that "can't be right" because it was displayed in a different zone.
• Participants and identifiers. Map phone numbers, handles, and account IDs to people in a key. Contact names on a device are labels chosen by the device owner; never treat them as proof of identity.
• Edits, unsends, reactions, and deletions. Recent versions of iMessage, WhatsApp, and other apps support editing and unsending; reactions and emojis display differently across platforms. Record what the data shows, not just what the screen showed.
• Privilege and privacy. Messages mix personal and business content. Use a protective order for sensitive material, an order under Fed. R. Evid. 502(d) to protect against waiver from inadvertent production, and redactions required by Fed. R. Civ. P. 5.2 for filings.

Why. Review choices become production choices, and production choices become exhibits. A thread produced as hundreds of disconnected single-message records invites a completeness fight under Fed. R. Evid. 106.

Pitfalls. Reviewing screenshots instead of data; losing the attachments; producing without the participant key; mishandling time zones.

Timing and cost. Processing and hosting charges vary with volume; message data is compact by gigabyte but large by record count, so review time rather than storage tends to drive cost.

Step 6: Request, produce, and fight about the other side's messages

What to do as the requesting party. Serve Rule 34 requests that identify the custodians, channels, date ranges, and participants, and that specify the form of production. Under Rule 34(b)(1)(C) the request "may specify the form or forms in which electronically stored information is to be produced," and under Rule 34(b)(2)(E) a responding party that does not object must produce in the form specified, or in a form in which the information is ordinarily maintained or reasonably usable. For messages, ask for a threaded format with metadata fields (sender, recipients, handles, sent and received timestamps with time zone, edit and deletion flags, attachments, and source device or account), plus a participant key. Raise mobile and chat data at the Rule 26(f) conference and ask the court to address it in the scheduling order under Rule 16(b)(3). An ESI protocol with a mobile and chat section avoids most later fights; see Negotiating an ESI Protocol and Managing E-Discovery Costs.

Forensic inspection. When there is a real basis to believe that messages were deleted, altered, or withheld, ask for a forensic examination of the device under an agreed protocol: a neutral or party examiner images the device, runs agreed search terms or date filters, and produces only responsive, non-privileged results, with privilege review by the device owner first. Courts do not order forensic imaging of personal phones as a matter of course; proportionality under Rule 26(b)(1) and privacy weigh against it unless there is evidence of a production failure. Model protocols appear in Trade Secret Litigation Toolkit: Identification Statements, Two-Tier Protective Orders, and Forensic Protocols.

Privacy settings are not a privilege. Relevant private content is discoverable. New York's highest court rejected a rule requiring a threshold showing from public posts before private Facebook content could be sought in Forman v. Henkin, 30 N.Y.3d 656 (2018), while insisting on requests tailored to relevance.

What to do as the responding party. Object specifically, produce in the specified form or state the form you will use, and do not produce screenshots in place of data unless the parties agree. Disclose preservation gaps early. If a device was lost or replaced, say when and what was done to recover its contents (backup, the new device, the other participants' copies). Rule 37(e) asks whether lost ESI "cannot be restored or replaced through additional discovery"; offering the replacements can head off a sanctions motion.

When the other side will not produce. Meet and confer, then move under Rule 37(a). See Bringing or Opposing a Motion to Compel Discovery: A Practical Guide and Discovery Enforcement Toolkit: Deficiency Letters, Meet-and-Confer Records, and Rule 37 Motions.

Platforms and carriers. Subpoena providers for what they can lawfully give a private litigant: non-content records such as subscriber information, account creation details, login and IP logs, and in some cases message logs without content. Section 2702(c)(6) permits disclosure of non-content records to non-governmental entities. Do not subpoena content. Courts quash those subpoenas, as in Crispin v. Christian Audigier, Inc., 717 F. Supp. 2d 965 (C.D. Cal. 2010), and refuse to compel providers even when the purpose is authentication, as in In re Request for Order Requiring Facebook, Inc. to Produce Documents and Things, 923 F. Supp. 2d 1204 (N.D. Cal. 2012). An overbroad subpoena that induces disclosure can create liability, as Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004), shows. The California Supreme Court allowed compelled production of content the user had made public, but not restricted content, in Facebook, Inc. v. Superior Court (Hunter), 4 Cal. 5th 1245 (2018). The workable route for content is the party's own download, produced under Rule 34, or a court-ordered consent. For nonparty subpoena mechanics, see Nonparty Discovery Toolkit: Subpoenas, Third-Party Records, and Privilege.

Timing. Rule 34 responses are due 30 days after service. Platform subpoena responses commonly take several weeks; build that into the schedule. Carrier retention of text metadata may be short, so subpoena carriers early.

Step 7: Lock in authenticity during discovery

What to do. Use the cheapest tools first.

• Requests for admission. Rule 36(a)(1)(B) permits requests to admit "the genuineness of any described documents." Attach each key message or thread as an exhibit with a Bates number, and ask separately that the party (a) admits the exhibit is a true and accurate copy, (b) admits the phone number or account belonged to and was used by the party on the date shown, and (c) admits sending the message. Splitting the requests prevents a blanket denial based on one disputed element. A matter is admitted unless answered within 30 days, and a party that fails to admit genuineness without good reason may have to pay the costs of proving it under Rule 37(c)(2). See Strategic Responses to Requests for Admission: A Comprehensive Guide for Legal Practitioners and, for the responding side, Responding to Requests for Admission Checklist: A Practical Checklist.
• Depositions. Ask the author about the number and account, the devices used, who else had access, the surrounding messages, the nicknames and phrasing, and the conduct that followed. "I don't remember sending that" is common; follow it with questions about every message before and after it. Admissions about the surrounding thread often authenticate the disputed message by context. Under Rule 30(b)(6), an organization can be required to designate a witness on its messaging systems, retention settings, and collection methods. For screen-sharing native exhibits in a remote deposition, see Taking and Defending a Remote Deposition: A Practical Guide.
• Interrogatories. Ask the opposing party to identify every phone number, device, and messaging account used during the period, and everyone with access to them.
• Stipulations. Propose a stipulation that all messages produced from a party's own devices or accounts are authentic for purposes of Rule 901, reserving objections to completeness, hearsay, and relevance. Many opponents agree, because they want the same treatment for their own exhibits.

Why. Every authenticity question resolved in discovery is one less witness at trial and one less argument at summary judgment. And an opponent who denies authenticity in discovery has committed to a position that a forensic examiner may disprove.

Pitfalls. Asking for one admission that combines several facts; serving requests too late for a motion on the responses; forgetting that a denial for lack of knowledge requires a reasonable inquiry under Rule 36(a)(4).

Step 8: Authenticate at summary judgment

What to do. Support each message exhibit with a declaration that lays the foundation the trial witness would give. The recipient declares that the number or account belonged to the sender, that they had communicated through it before, that the exhibit accurately reflects the thread, and the facts that tie the content to the sender. The examiner declares the collection method, tool, and hash. Use the unsworn declaration form in 28 U.S.C. § 1746. Rule 56(c)(4) requires that declarations be made on personal knowledge and set out facts that would be admissible in evidence.

The standard. Rule 56(c)(2) lets a party object that material "cannot be presented in a form that would be admissible in evidence." The question is whether the evidence could be authenticated at trial, not whether it is authenticated in the motion papers. The Fifth Circuit so held in Maurer v. Independence Town, 870 F.3d 380 (5th Cir. 2017), explaining the 2010 amendments to Rule 56. But do not rely on the lenient reading. Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (D. Md. 2007), denied both sides' summary judgment motions because neither authenticated its emails, and an objection that forces a scramble in a reply brief is avoidable. Under Celotex Corp. v. Catrett, 477 U.S. 317 (1986), and Anderson v. Liberty Lobby, Inc., 477 U.S. 242 (1986), the nonmovant needs evidence a reasonable jury could credit; a disputed message with a strong foundation can create a genuine dispute, and one with no foundation may not.

For the opponent. Make the Rule 56(c)(2) objection specifically, identifying which element of foundation is missing (fidelity, transmission, or attribution) and why it cannot be supplied at trial. A conclusory objection is easily overruled. For Rule 56 strategy generally, see Summary Judgment Under Rule 56: Winning and Surviving Before Trial and Summary Judgment Motion Checklist: A Practical Checklist.

Step 9: Prepare certifications and serve notice

What to do. Decide which exhibits can come in by certification rather than live testimony.

Serve "reasonable written notice of the intent to offer the record" and make the record and certification available for inspection before trial, as Rule 902(11) requires and Rules 902(13) and (14) incorporate. Serve notice with the pretrial disclosures or earlier, and say expressly which certification supports which exhibit.

Why. Certifications save the cost and scheduling burden of live custodians and examiners. But they authenticate only. A platform certificate proves the platform's records; it does not prove who typed the words. The Third Circuit held in United States v. Browne, 834 F.3d 403 (3d Cir. 2016), that Facebook chat logs, considered as a whole, were not Facebook's business records and could not be authenticated by a Rule 902(11) certificate; the government's case survived because it had independent evidence of authorship. The Fourth Circuit in United States v. Hassan, 742 F.3d 104 (4th Cir. 2014), upheld admission where certificates from Facebook and Google were paired with evidence tracing the accounts to the defendants' mailing and email addresses through IP addresses. Pair every certificate with an attribution witness or admission.

Pitfalls. Late notice; certificates that do not track the language of Rule 803(6)(A) through (C); certifications by someone who did not perform or supervise the process; a 902(14) certification with no hash recorded at collection.

Expert disclosure. If the examiner will offer opinions beyond the mechanics of the process (that a message was deleted, altered, or sent from a particular device), disclose the examiner under Rule 26(a)(2) and be ready to meet Fed. R. Evid. 702, which since the 2023 amendment requires the proponent to show the court that each requirement is more likely than not satisfied. See Expert Witnesses After the 2023 Amendment to Rule 702: Daubert, Disclosure, and Cross-Examination.

Step 10: Build the trial foundation, exhibit by exhibit

What to do. For each message exhibit, prepare a one-page foundation sheet: the exhibit number, the source and collection record, the authentication route, the attribution facts, the hearsay route for each statement in the thread, any completeness issue, and any Rule 403 redactions.

The recipient's foundation, in order.

1. Identify the witness's relationship to the sender and how long they have communicated.
2. Identify the number or account and how the witness knows it belongs to the sender (the sender gave it to them, it appears in the sender's signature block, they have called it and the sender answered).
3. Describe the exchange: what the witness wrote, what came back, and the details in the reply that only the sender would know.
4. Describe what happened afterward that matches the message.
5. Identify the exhibit as a fair and accurate copy of the thread as it appeared on the witness's device, and explain how it was collected.

The examiner's foundation. Qualifications; the device or account and its identifiers; chain of custody; the tool, version, and extraction type; validation of the tool; the hash; what the data shows about sender, time, and device; and, if disputed, why the screenshot or export matches (or does not match) the underlying data.

Distinctive characteristics carry the attribution. Courts admit messages on circumstantial evidence such as admitted ownership of the screen name and the defendant's appearance at a meeting arranged through it, as in United States v. Tank, 200 F.3d 627 (9th Cir. 2000); an email address, signature, and content, as in United States v. Fluker, 698 F.3d 988 (7th Cir. 2012); recognition of the account and the sender's manner of communicating, as in United States v. Barnes, 803 F.3d 209 (5th Cir. 2015); and seizure of the phone from the defendant, as in United States v. Lewisbey, 843 F.3d 653 (7th Cir. 2016). Evidence that others had access to an account does not defeat authentication if the rest of the record points to the defendant, as the Tenth Circuit held in United States v. Brinson, 772 F.3d 1314 (10th Cir. 2014). A participant's testimony authenticates a transcript of an online conversation, as in United States v. Lanzon, 639 F.3d 1293 (11th Cir. 2011). What fails is a page with a name and photo and nothing more, as in United States v. Vayner, 769 F.3d 125 (2d Cir. 2014), or a photograph from an online profile with no evidence of who posted it or whether it was accurate, as in People v. Price, 29 N.Y.3d 472 (2017).

Map the hearsay. For each statement in the thread, record the route: party statement under Rule 801(d)(2); the other participant's statements for context or effect on the listener (with a limiting instruction under Rule 105); present sense impression or excited utterance under Rule 803(1) and (2); business records for platform data under Rule 803(6); and the residual exception under Rule 807 with notice.

Plan for completeness. Rule 106, as amended in 2023, lets the adverse party require the introduction of any other part of the statement that in fairness ought to be considered at the same time, over a hearsay objection. Offer the whole relevant thread, and be ready to argue why parts the other side wants are not needed for fairness.

Screenshots and the best evidence rule. Under Fed. R. Evid. 1001(d), an accurate printout or display of electronically stored information is an original, and under Rule 1003 a duplicate is admissible unless a genuine question is raised about authenticity or admitting it would be unfair. Long threads can be summarized under Rule 1006 if the underlying messages were made available.

Exhibits the jury can read. Display messages in a format that matches how the recipient saw them (sender on one side, timestamps visible, emojis rendered as on the recipient's platform), and provide a printed exhibit with the metadata in a companion table. Trial exhibit mechanics are in Trial Exhibits and Demonstratives: Getting Evidence in Front of the Jury and Keeping It There and Trial Exhibit Preparation Checklist.

Pretrial objections. List every message exhibit in the Rule 26(a)(3)(A)(iii) disclosures. Calendar the 14-day objection deadline under Rule 26(a)(3)(B) for your own objections and track the opponent's; authentication objections not made are waived absent good cause.

Step 11: Challenge the other side's messages (or defend against a challenge)

What to do as the challenger. Work out which of the three foundations is actually weak, then attack that one.

• Fidelity. Request the native file of the screenshot (with its own metadata), the device it came from, and the full thread. Compare the screenshot with the underlying data, and with how the app displays messages on the claimed device and software version. In Rossbach, details as small as icon placement, font, and emoji design showed that an image could not have come from the phone the plaintiff described.
• Transmission. Subpoena carrier records for the number on the date (records showing texting activity, even without content, can corroborate or contradict), and platform non-content records for the account.
• Attribution. Develop the facts that make another author plausible: shared devices and Apple IDs, known account compromises, a phone that was lost or replaced, a message whose content the purported author could not have known. Evidence of account hacking should be specific (a security notice from the platform, a password reset, a login from an unfamiliar IP address). In State v. Eleck, 130 Conn. App. 632 (2011), the account holder's testimony that her account had been hacked, combined with the absence of distinctive content, defeated authentication of messages offered by the defense.

Choose the procedural vehicle. Serve Rule 26(a)(3)(B) objections, then move in limine for the key exhibits, asking for a hearing outside the jury's presence under Fed. R. Evid. 104 if forensic testimony is needed. Remember the standard: under Rule 104(b), the court asks only whether a reasonable jury could find the message authentic, as Huddleston v. United States, 485 U.S. 681 (1988), describes conditional relevance. A motion that argues weight will lose; a motion that shows the foundation cannot be laid, or that the exhibit is fabricated, can win. Motion mechanics and models are in Drafting and Opposing Motions in Limine: A Practical Guide, Motion in Limine Checklist: A Practical Checklist, and Motion in Limine Toolkit: Standard Motion Banks, Opposition Frameworks, and Trial Objection Plans.

If fabrication is real. Move for sanctions. Fabricating evidence is fraud on the court, punishable under the court's inherent power, and can lead to dismissal, as in Rossbach. Build the record with an examiner's report, the native files, and testimony about the device history. The opposing lawyer's own exposure turns on a separate standard (the Second Circuit vacated the sanction against counsel in Rossbach because the wrong standard was applied), so focus the motion on the party unless the evidence of counsel's knowledge is strong.

What to do as the proponent under attack. Respond with evidence, not adjectives. Offer the native data, the examiner's hash and extraction records, the carrier and platform records, the surrounding messages the opponent admitted, and the conduct that followed. Distinguish Vayner by showing what connects the person to the account beyond a name. Argue that remaining doubts go to weight, citing United States v. Lewisbey, 843 F.3d 653 (7th Cir. 2016), and the state equivalents such as State v. Hannah, 448 N.J. Super. 78 (App. Div. 2016), which declined to create a special test for social media and observed that a tweet can be forged, but so can a letter.

Deepfake and AI-fabrication claims. Generative tools make synthetic images, audio, and text easier to produce, and they also make it easier to claim that genuine evidence is fake. Courts handle both under the existing rules: the Rule 901(a) threshold, Rule 403, Rule 702 for experts on whether content was generated or altered, and sanctions for fabrication. A proposed Rule 707, which would apply Rule 702's reliability requirements to machine-generated evidence offered without an expert, was published for public comment in August 2025, and comments closed February 16, 2026. At its May 7, 2026 meeting, the federal Advisory Committee on Evidence Rules did not recommend the rule for approval: it revised the text, agreed the revision would need a new comment period, and decided to have technology experts vet it at the committee's fall 2026 meeting before deciding whether to republish. The committee also concluded that a deepfake amendment to Rule 901 is not warranted for now, noting a Federal Judicial Center survey in which only fifteen judges reported dealing with deepfake issues, and is keeping a working draft of Rule 901(c) (which would shift burdens once an opponent makes a threshold showing of AI fabrication) in reserve. Neither proposal is law, so provenance evidence (forensic collection, hashes, platform records, and witnesses) is the best answer to a deepfake claim, and the best basis for one.

Timeline and cost overview

Costs vary widely by vendor, region, and urgency; treat any quote as specific to the devices and data involved. The largest avoidable cost is a sanctions motion over lost messages.

Worked example: Bramblewood Outfitters v. Marsh and Ridgeline Gear

Before starting. Bramblewood's counsel ranks the messages. The iMessage to Ridgeline's chief executive ("Sending you the Q3 dealer pricing tonight. Delete after.") is the core of a trade secret claim under the Defend Trade Secrets Act and a breach of Marsh's confidentiality agreement. The WhatsApp message to the dealer group and the LinkedIn message to the largest account support a non-solicitation claim. The authors are adverse, so authorship will be disputed. The screenshots came from a third party, so their provenance is unknown. The case will be in federal court.

Step 1: Map. Marsh had a company iPhone, returned on his last day and sitting in IT's drawer, and a personal Android phone. He used Bramblewood's Slack, WhatsApp on both phones, and LinkedIn. Ridgeline's chief executive, Dana Kwan, has her own phone. The dealer group has eleven members, three of whom still buy from Bramblewood.

Step 2: Preserve. The company iPhone is pulled from the reimaging queue the same day. Bramblewood suspends its 90-day Slack retention for Marsh's account and his former team. Preservation letters go to Marsh and Ridgeline, naming iMessage, WhatsApp, Signal, LinkedIn, and personal phones, and asking them to turn off disappearing messages and auto-delete. Letters also go to the three friendly dealers.

Step 3: Interview. The sales rep who forwarded the screenshots explains that his friend at Ridgeline photographed Kwan's laptop screen during a meeting. That is a lead, not a foundation, and it raises questions about how the friend obtained the images. Counsel decides not to rely on the friend's photographs and to pursue the originals through discovery.

Step 4: Collect. An examiner performs a full file system extraction of the company iPhone, records the hash, and documents chain of custody. The extraction shows that Marsh's Apple ID was signed in to iMessage on the company phone until his last week and that the phone's message database still holds a thread with Kwan's number, including messages from the weeks before he resigned. The dealers agree to have their WhatsApp group exported by the examiner using a targeted collection. The LinkedIn message is in the largest account's inbox; its buyer downloads her LinkedIn data and gives counsel the file.

Step 5: Review. The examiner's data shows the "Q3 dealer pricing" message was not on the company phone: it was sent on a date after Marsh had signed his Apple ID out of that device. The rest of the thread, from earlier weeks, shows Marsh and Kwan discussing his "start date" and "bringing the dealer list." Counsel normalizes the timestamps to UTC and builds a participant key.

Step 6: Request. Bramblewood serves Rule 34 requests on Marsh for messages with Kwan, the dealers, and Bramblewood customers for the relevant period, in a threaded format with metadata, and asks for a forensic protocol for Marsh's personal phone. Marsh objects to the protocol. After a meet and confer and a motion supported by the company phone extraction (which shows the pre-resignation thread and suggests the later messages moved to his personal phone), the court orders a limited protocol with a neutral examiner and date and participant filters. Bramblewood subpoenas Marsh's carrier for records of texting activity with Kwan's number on the night of the "Q3" message, and subpoenas Ridgeline for Kwan's messages under Rule 34 (Ridgeline controls her company phone). It does not subpoena Apple, WhatsApp, or LinkedIn for content.

Step 7: Lock in. Bramblewood serves split requests for admission on each key message: genuineness of the exhibit, ownership and use of the number or account, and sending. Marsh admits the WhatsApp and LinkedIn messages (both are on other people's devices and his name and photo are on them) and denies sending the "Q3" message. At his deposition he admits the earlier thread with Kwan, admits "Q3 dealer pricing" is the name of a spreadsheet he maintained, and says he does not remember the message. The neutral examiner's results from his personal phone show the iMessage, sent from his number to Kwan's, with a spreadsheet attachment whose filename matches. Kwan's company phone, produced by Ridgeline, has the same message.

Step 8: Summary judgment. Bramblewood moves for partial summary judgment on the non-solicitation claim, supported by the dealers' and buyer's declarations and the admissions. Marsh's opposition does not contest those messages. On the trade secret claim, Bramblewood's examiner declares the matching messages on three devices, with hashes; Marsh's Rule 56(c)(2) objection to the "Q3" message is overruled, because the record contains far more than enough to authenticate it at trial.

Step 9: Certify. Bramblewood prepares a Rule 902(11) certificate from the carrier for the texting records, Rule 902(13) certifications for the three extractions, and a Rule 902(14) certification for the hash-verified production copies, and serves notice with its pretrial disclosures.

Steps 10 and 11: Trial. Marsh's Rule 26(a)(3)(B) objections challenge only the "Q3" message, and his motion in limine argues that his teenage son sometimes used his phone. Bramblewood's opposition points to the matching messages on Kwan's phone, the spreadsheet attachment, the earlier thread about "bringing the dealer list," and the absence of any evidence that the son knew of the spreadsheet or Kwan. The court denies the motion: the question of who typed the message is for the jury. Ridgeline invokes Rule 106 to add Kwan's reply, "Don't send me anything you shouldn't," and Bramblewood, having anticipated it, has already included the reply in the exhibit, along with Kwan's next message the following morning thanking Marsh for "the numbers."

What went right. Bramblewood preserved the company phone on day one, never relied on the third-party photographs, collected forensically, used Rule 34 against the parties instead of subpoenas to platforms, split its admission requests, and anticipated completeness. What the defense could have done better: if Marsh's account of his son's access had any substance, the time to develop it was in discovery, with evidence of the son's use of the phone at the relevant time.

Common mistakes

1. Relying on forwarded screenshots. They are leads. Get the originals.
2. Letting company devices be wiped. Device recycling after an employee departs is the most common avoidable loss.
3. Generic holds. A hold that never mentions texts, chat apps, or auto-delete is a hold on paper only.
4. Subpoenaing platforms for content. The Stored Communications Act forbids disclosure; the subpoena will be quashed and may create liability.
5. One combined request for admission. Split genuineness, ownership, and sending.
6. No hash at collection. Without one, a Rule 902(14) certification is not available.
7. Late or missing certification notice. Rules 902(11), (13), and (14) require it before trial.
8. Treating contact names as identity. A contact name is a label the device owner typed.
9. Excerpting threads. Amended Rule 106 lets the other side complete them over a hearsay objection.
10. Arguing weight in a motion to exclude. Show that the foundation cannot be laid, or that the exhibit is fake; otherwise the jury decides.

Frequently asked questions

Do I need a forensic examiner for every case with text messages? No. If authorship will not be disputed, a careful export, the recipient's testimony, and a request for admission are usually enough. Use an examiner when authorship, alteration, deletion, or spoliation is in play, or when you want Rule 902(13) or (14) certifications.

Can the client just take screenshots? As exhibits, yes. As the collection method, no. Screenshots lose metadata and invite fidelity challenges. Collect the source and use screenshots for display.

How do I get messages from WhatsApp or Signal? From the devices of the participants. WhatsApp may have device or cloud backups; Signal usually exists only on the devices. Neither provider will produce content in response to a civil subpoena.

What if the other side says the phone was lost? Ask when, what happened to it, whether there was a backup, and whether the messages exist on other participants' devices. Rule 37(e) asks whether lost ESI can be restored or replaced, and sanctions turn on reasonable steps, prejudice, and, for the severe measures, intent to deprive.

Can I authenticate a social media post with a printout from the platform? A printout plus testimony from the person who captured it establishes fidelity. Attribution requires more: the account holder's admission, distinctive content, platform records linking the account to the person, or conduct tying the person to the post.

Will a platform's business records certificate authenticate a message for me? It will authenticate the platform's records. Under Browne, it will not establish who wrote the message. Pair it with attribution evidence.

What if the message is in a language other than English, or full of slang and emojis? Use a qualified translator for foreign-language messages, and consider testimony from the recipient about what slang or emojis meant between the parties. Display emojis as the recipient saw them.

What is the status of the proposed AI and deepfake evidence rules? Neither is in effect. Proposed Rule 707 on machine-generated evidence was published for comment in August 2025, but in May 2026 the Advisory Committee held back a revised version for further study at its fall 2026 meeting rather than recommending approval. The deepfake amendment to Rule 901 has never been published; the committee is keeping a working draft of Rule 901(c) in reserve. Check the committee's latest agenda before citing either.

Takeaways

• Preserve at the source on day one, with auto-delete turned off and devices quarantined.
• Collect from devices, accounts, and enterprise systems with metadata and hashes; use screenshots for display.
• Plan fidelity, transmission, and attribution for every key message.
• Get content from the parties; get only non-content records from providers.
• Resolve authenticity in discovery with split requests for admission, depositions, and stipulations.
• Use Rule 902 certifications with notice, paired with attribution evidence.
• Calendar the 14-day objection window and offer whole threads.
• Challenge with forensic evidence, not speculation.

This document is general information, not legal advice for any particular situation; the law changes, the evidence rulemaking described here should be checked for current status, and the facts matter.

Related Documents

Related Articles

• Authenticating Text Messages, Chats, and Social Media Evidence: Rules 901 and 902, Metadata, and Deepfake Challenges: the doctrine and leading cases behind every step in this guide.
• Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case: the preservation duty and sanctions framework.
• Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court: capturing public posts and web pages.
• Motions to Compel and Discovery Sanctions Under Rule 37: From Meet-and-Confer to Default Judgment: when the other side will not produce its messages.
• Remote Video Depositions: Logistics, Remote Exhibits, Objections, and the Off-Camera Coaching Problem: including the in-deposition messaging problem.
• Social Media Account and Handle Disputes: Impersonation, Username Squatting, and Who Owns a Company Account: who controls a company account, and impersonation.

Related Guides

• Drafting and Opposing Motions in Limine: A Practical Guide: the vehicle for most authentication fights.
• Bringing or Opposing a Motion to Compel Discovery: A Practical Guide: compelling device and account production.
• Taking and Defending a Remote Deposition: A Practical Guide: using native message exhibits with remote witnesses.
• Managing Discovery in a Trade Secret Case: A Practical Guide: device discovery in departing-employee cases.
• Employee Monitoring and Workplace Privacy: A Practical Guide: what an employer may lawfully collect.

Related Checklists

• Messaging and Social Media Evidence Checklist: A Practical Checklist: every step of this guide as check-off tasks.
• Litigation Hold and Evidence Preservation Checklist: A Practical Checklist: hold notices and follow-up.
• Authenticating Website Evidence: A Practical Checklist: the web-page counterpart.
• Summary Judgment Motion Checklist: A Practical Checklist: building the Rule 56 record.
• Motion in Limine Checklist: A Practical Checklist: pretrial evidentiary motions.

Related Toolkits

• Digital Message Evidence Toolkit: Collection Protocols, Authentication Declarations, and Rule 902 Certifications: the forms used in this guide.
• Discovery Enforcement Toolkit: Deficiency Letters, Meet-and-Confer Records, and Rule 37 Motions: letters and motions to get the other side's data.
• Trade Secret Litigation Toolkit: Identification Statements, Two-Tier Protective Orders, and Forensic Protocols: forensic device protocols.
• Nonparty Discovery Toolkit: Subpoenas, Third-Party Records, and Privilege: subpoenas to carriers, platforms, and nonparty custodians.