Digital Message Evidence Toolkit: Collection Protocols, Authentication Declarations, and Rule 902 Certifications

Summary. This toolkit collects the working papers for turning text messages, chats, and social media content into admissible evidence, each introduced by its purpose, its owner, and when to use it, and each followed by drafting commentary tied to the governing rules and cases. It begins with a foundation matrix that separates fidelity, transmission, and attribution for every key message, then supplies a messaging-specific preservation letter, a custodian interview script, an internal collection protocol with a chain of custody log, a production-format rider, and a stipulated forensic examination protocol for an opponent's device. The authentication templates include a split set of requests for admission, a recipient's declaration, a forensic examiner's declaration, certifications under Rules 902(11), 902(13), and 902(14), a notice of intent to offer certified records, and an authenticity stipulation. The trial templates are a motion in limine to exclude unauthenticated messages with an opposition outline and a foundation examination script. A running example built on a contract modification agreed by text and WhatsApp ties the forms together, and a deadline tracker closes the toolkit.

Message evidence is won on paper long before trial. The proponent who has a hash value from the day of collection, a recipient's declaration that explains why the number belongs to the sender, split admissions, and certifications served with notice rarely has to argue about authentication at all. The opponent who has an examiner's report showing that a screenshot does not match the device can end a case. This toolkit is the paper.

The short answer

• Separate the three foundations. Fidelity, transmission, and attribution each need their own evidence. Template 1 forces the separation.
• Preserve and collect with a record. A preservation letter that names the apps and the auto-delete settings, an interview script, a collection protocol, and a chain of custody log with hash values (Templates 2 to 4) make every later template possible.
• Get the other side's data in usable form. A production-format rider and, where justified, a forensic protocol (Templates 5 and 6) under Fed. R. Civ. P. 34.
• Authenticate cheaply first. Split requests for admission under Fed. R. Civ. P. 36 and a stipulation (Templates 7 and 14).
• Then authenticate by declaration and certification. The recipient's and examiner's declarations and certifications under Fed. R. Evid. 902(11), (13), and (14), served with notice (Templates 8 to 13).
• Fight it out in limine, on evidence. Template 15 gives the motion and the opposition; Template 16 is the trial foundation.

How to use this toolkit

Each template states its purpose, its owner, and when to use it, then gives the template and drafting commentary. Bracketed capitals are placeholders. Use one reference system across every paper: M- for messages, D- for devices, C- for collections, and X- for exhibits, so that a declaration, a certification, and a request for admission can all refer to "M-3 on D-2, collected as C-2" and mean the same thing.

The doctrine is in Authenticating Text Messages, Chats, and Social Media Evidence: Rules 901 and 902, Metadata, and Deepfake Challenges; the sequence of steps is in Collecting and Authenticating Messaging and Social Media Evidence: A Practical Guide; and the task list is in Messaging and Social Media Evidence Checklist: A Practical Checklist.

The running example. Seastar Logistics, Inc., a freight forwarder in Savannah, sues Pruett Marine Supply, LLC, a ship chandler, in federal court for breach of a supply contract. The written contract fixed prices through December, but Seastar contends that the parties agreed by message to a modification: Seastar would accept a 6 percent price increase in exchange for guaranteed 48-hour delivery. The evidence is (M-1) an SMS from Pruett's owner, Glen Pruett, to Seastar's vice president of operations, Nadia Okafor: "Can do 48 hrs guaranteed if you take the 6%"; (M-2) Okafor's reply, "Agreed, effective Monday"; (M-3) a thumbs-up reaction from the Pruett Marine WhatsApp business account to a photo of the revised price sheet in a group chat; and (M-4) a later WhatsApp message from the same account: "We never agreed to 48. Check the contract." Pruett denies the modification and says his son, Cal, manages the WhatsApp business account from a tablet in the warehouse.

Template 1: Foundation matrix

Purpose: for each key message, identify the evidence for fidelity, transmission, and attribution, and the hearsay and completeness issues, so gaps are found while discovery is open. Owner: proponent's lead counsel. When to use: in the first week, and updated after each production and deposition.

Drafting commentary. Fed. R. Evid. 901(a) asks only for evidence sufficient to support a finding, but the matrix shows where that evidence comes from. Attribution is the column most often empty. For M-3, an organization's business account raises the agency question under Rule 801(d)(2)(D) as well as authentication: if Cal Pruett runs the account for the business, his reaction may be the company's statement even if Glen never saw it. Whether a thumbs-up manifests assent is a separate merits question; a Saskatchewan court treated it as acceptance in South West Terminal Ltd. v. Achter Land & Cattle Ltd., 2023 SKKB 116, and American courts read emojis in context. For contract formation and modification by informal messages, see How Courts Read Contracts: Ambiguity, Extrinsic Evidence, and the Canons of Construction and Electronic Signatures and Records Under ESIGN and UETA: What Actually Binds. The completeness column matters because amended Rule 106 (2023) lets the adverse party require the rest of a statement over a hearsay objection.

Template 2: Messaging preservation letter

Purpose: put the other side (or a nonparty) on notice of specific messaging sources and the settings that destroy them. Owner: counsel for either side. When to use: as soon as litigation is reasonably anticipated.

[DATE]

VIA EMAIL AND OVERNIGHT DELIVERY

[RECIPIENT NAME AND ADDRESS]

Re: Preservation of electronic messages; [MATTER DESCRIPTION]

Dear [NAME]:

We represent [CLIENT] in connection with [DISPUTE]. [CLIENT] anticipates
litigation concerning [SUBJECT]. We write to request that [RECIPIENT] and its
owners, officers, employees, and agents preserve all documents and
electronically stored information relating to [SUBJECT] from [START DATE] to
the present, including the following:

1. Text messages (SMS, MMS, RCS, and iMessage), WhatsApp, Signal, Telegram,
   Facebook Messenger, Instagram, LinkedIn, and any other messaging
   application, on any phone, tablet, or computer, including personal devices
   used for business, by [NAMED CUSTODIANS] and anyone who communicated with
   [CLIENT] on [SUBJECT].
2. The WhatsApp business account associated with [NUMBER] and every device on
   which it is or was installed, including [DESCRIBE, E.G., "THE WAREHOUSE
   TABLET"].
3. Workplace messaging (Slack, Microsoft Teams, Google Chat) for the same
   custodians.
4. Cloud and computer backups of the devices above (iCloud, Google, WhatsApp
   backups to iCloud or Google Drive, and local backups).
5. Phone and account records sufficient to identify each device and account
   used, and the dates of any replacement.

Specific steps. Please (a) disable disappearing-message and auto-delete
settings on the devices and applications above, including any "Keep Messages"
setting of less than "Forever"; (b) refrain from resetting, replacing,
trading in, or discarding any device, and if a device must be replaced,
preserve a forensic image first; (c) refrain from deleting applications or
leaving group conversations; and (d) suspend any retention policy that would
delete messages for the custodians above.

This request does not limit [RECIPIENT]'s independent duty to preserve
relevant information. Please confirm in writing by [DATE] that these steps
have been taken, and tell us promptly if any source cannot be preserved.

Sincerely,
[SIGNATURE BLOCK]

Drafting commentary. A preservation letter does not create the duty to preserve, but it fixes the date by which the recipient knew what to keep, and it defeats any later claim that the recipient did not know that phone settings mattered. Rule 37(e) measures loss against "reasonable steps," and courts have sanctioned parties who moved to ephemeral apps or deleted messages after the duty attached, as in FTC v. Noland, No. CV-20-00047 (D. Ariz. Aug. 30, 2021), and Fast v. GoDaddy.com LLC, 340 F.R.D. 326 (D. Ariz. 2022). Name the devices you know about (the warehouse tablet in the running example), because a general description invites a general excuse. Send your own client an internal hold with the same specificity; see Litigation Hold and Evidence Preservation Checklist: A Practical Checklist and Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case.

Template 3: Custodian interview script

Purpose: learn what to collect, flag preservation problems, and surface attribution weaknesses before the other side does. Owner: counsel (not the vendor). When to use: before collection; repeat if new sources emerge.

CUSTODIAN INTERVIEW: MESSAGING SOURCES
Privileged and confidential; attorney work product

Custodian: [NAME]          Date: [DATE]          Interviewer: [NAME]
Upjohn-type explanation given (for organizational clients): [YES/NO]

A. Devices
1. What phones have you used since [DATE]? For each: make, model, carrier,
   number, dates of use, personal or company.
2. When you changed phones, did you transfer messages? How?
3. What tablets or computers receive your messages? (iPad, Mac, Windows
   Phone Link, WhatsApp Web or Desktop)
4. Is anyone else signed in to the same Apple ID or Google account? Who else
   uses any of these devices?

B. Applications and settings
5. Which messaging apps do you use with [KEY PEOPLE]? Business accounts?
6. Have disappearing messages or auto-delete ever been on, in any app or
   chat? When were they turned off?
7. What is your iPhone "Keep Messages" setting? (Check together now.)
8. Do you back up to iCloud, Google, or a computer? Is WhatsApp backed up?

C. The key messages
9. For each key message: who sent it, from which device, and where were you?
10. What contact name do you use for [KEY PERSON]? When did you create it?
11. Have you deleted, edited, or unsent any message with [KEY PEOPLE]? When?
12. Did you take screenshots? With what device? Where are they stored, and to
    whom did you send them?

D. Access and security
13. Has anyone else known your passcode or used your phone or accounts?
14. Has any account been hacked, locked, or reset? Any security notices?

E. Others with copies
15. Who else was in the conversations? Group chats? Who else might have
    screenshots?

Follow-up actions: [LIST]

Drafting commentary. The answers in Part A and Part D are the facts an opponent will use to argue that someone else typed the message, and they are better learned now. In the running example, the interview with Pruett Marine's side (if it were your client) would surface the warehouse tablet; on Seastar's side, Okafor's interview confirms that the SMS thread with Glen Pruett includes months of delivery messages that will help attribution. Courts admit messages over "someone else had access" arguments when the rest of the record points to the author, as in United States v. Brinson, 772 F.3d 1314 (10th Cir. 2014), but an unexamined shared device can sink a thin foundation. For organizational clients, give the corporate-counsel warning at the start and document it. Workplace collection limits are covered in Employee Monitoring and Workplace Privacy: A Practical Guide.

Template 4: Collection protocol and chain of custody log

Purpose: set how messages are collected and record what happened to each item, so that a declaration or certification can later describe it accurately. Owner: counsel, with the examiner or vendor. When to use: before the first collection.

MESSAGING COLLECTION PROTOCOL: [MATTER]

1. Scope. Custodians: [LIST]. Devices: [D-REFS]. Accounts: [LIST]. Date
   range: [RANGE]. Applications: [LIST].
2. Method by source.
   (a) Key devices [D-1, D-2]: full file system extraction where supported;
       otherwise advanced logical extraction. Tool: [TOOL AND VERSION].
   (b) Secondary devices: logical extraction or targeted collection.
   (c) Cloud accounts: collection with custodian credentials and written
       consent, or account self-download supervised by [EXAMINER].
   (d) Enterprise messaging: administrator export [PLAN/TOOL], including
       direct messages and edit/deletion history where available.
   (e) Public posts: forensic web capture with URL, time, and hash.
3. Integrity. Compute SHA-256 hash of each extraction and export at
   collection. Store originals on write-protected media. Work from verified
   copies.
4. Documentation. Complete the chain of custody log for every transfer.
   Photograph each device (front, back, settings screen showing model and
   software version) before extraction.
5. Validation. Record the tool's validation status and any known limitations
   for the device and software version.
6. Privacy and privilege. Collection is limited to [SCOPE]; personal content
   outside scope is not reviewed except as needed to apply filters.
7. Reporting. Examiner provides an extraction summary per device: identifiers,
   tool, extraction type, hash, date range, and any errors.

Drafting commentary. The protocol and log are the factual basis for Templates 9, 10, and 11. Rule 902(14) depends on a "process of digital identification," which in practice means a hash recorded at collection and recomputed for the copy. Rule 901(b)(9) and Rule 902(13) depend on a process that "produces an accurate result," which the validation entry supports. Photographs of the settings screen record the software version, which can matter later: in Rossbach v. Montefiore Medical Center, 81 F.4th 124 (2d Cir. 2023), the mismatch between an image and how messages display on the claimed phone exposed a forgery. Trade-secret-style device protocols appear in Trade Secret Litigation Toolkit: Identification Statements, Two-Tier Protective Orders, and Forensic Protocols.

Template 5: Production-format rider for messages

Purpose: require the other side to produce messages as threads with metadata rather than as screenshots or single-line records. Owner: requesting party. When to use: with the first Rule 34 requests, and in the ESI protocol.

INSTRUCTIONS FOR PRODUCTION OF SHORT MESSAGES AND CHAT DATA

1. "Short message data" means SMS, MMS, RCS, iMessage, WhatsApp, Signal,
   Telegram, social media direct messages, and workplace chat (Slack, Teams,
   Google Chat), including attachments, reactions, edits, and deletion
   records.
2. Form. Produce short message data in [RSMF / AGREED FORMAT], one document
   per conversation per [24-HOUR PERIOD / CALENDAR DAY], with each message
   displayed in sequence with sender and timestamp.
3. Metadata. Provide, for each message: conversation ID; participants (name,
   number or handle, account ID); sender; sent, delivered, and read
   timestamps in UTC with original time zone; application; source device or
   account; edit and unsend flags; reactions; attachment names and hashes;
   and BegBates/EndBates.
4. Context. Produce the full conversation for each responsive day, not only
   responsive messages, subject to privilege.
5. Participant key. Provide a key mapping every number, handle, and account ID
   to a person, with the source of the identification.
6. Screenshots. Screenshots are not an acceptable substitute for short message
   data, except by agreement for sources that cannot be collected; for any
   screenshot produced, also produce the native image file with metadata.
7. Lost sources. Identify any device or account that has been lost, replaced,
   or reset since [DATE], with the date and the steps taken to recover its
   data.

Drafting commentary. Rule 34(b)(1)(C) lets the requesting party specify the form of production, and Rule 34(b)(2)(D) and (E) require the responding party to object to the form or produce as requested or in a reasonably usable form. Paragraph 4 anticipates Rule 106 and avoids fights about context. Paragraph 7 tracks the Rule 37(e) question whether lost information "cannot be restored or replaced through additional discovery." Negotiate these terms in the ESI protocol where possible; see Negotiating an ESI Protocol and Managing E-Discovery Costs. If the other side refuses, the meet-and-confer and motion papers are in Discovery Enforcement Toolkit: Deficiency Letters, Meet-and-Confer Records, and Rule 37 Motions.

Do not send a version of this rider to Meta, Apple, or a carrier. The Stored Communications Act, 18 U.S.C. § 2702, bars providers from disclosing content in response to a civil subpoena, and courts quash such subpoenas, as in Crispin v. Christian Audigier, Inc., 717 F. Supp. 2d 965 (C.D. Cal. 2010). Use Template 12 for providers.

Template 6: Stipulated forensic examination protocol

Purpose: allow a limited, privacy-protective examination of an opponent's device when there is a real basis to believe messages were deleted, altered, or withheld. Owner: both sides, submitted for entry as an order. When to use: after a factual showing (for example, a matching message on one participant's device but not in the other's production).

[PROPOSED] STIPULATED ORDER GOVERNING FORENSIC EXAMINATION OF [DEVICE]

1. Examiner. [NEUTRAL EXAMINER] ("Examiner") will image [DEVICE: MAKE,
   MODEL, NUMBER] ("Device") and the [WHATSAPP/ICLOUD] backup associated with
   [ACCOUNT]. The Examiner is bound by the Protective Order and will sign
   Exhibit A.
2. Imaging. The Examiner will create a forensic image at [LOCATION] on
   [DATE], record its SHA-256 hash, and retain the image under the Protective
   Order. [OWNER] will provide the passcode to the Examiner only.
3. Filters. The Examiner will extract only messages and attachments that
   (a) fall between [DATE] and [DATE], and (b) involve [NUMBERS/HANDLES] or
   contain [TERMS]. The Examiner will also report, without content, the
   Device's message-retention settings, the dates of any reset, application
   installation and deletion dates for [APPS], and whether any responsive
   message records are marked deleted, edited, or unsent.
4. Owner review. The Examiner will provide the filtered results first to
   [OWNER]'s counsel, who will have [10] days to log privileged or
   non-responsive personal material. All other results will be produced to
   [REQUESTING PARTY] with the Examiner's report.
5. Costs. [REQUESTING PARTY] will advance the Examiner's fees, subject to
   reallocation by the Court.
6. No waiver. Production under this Order does not waive privilege; Fed. R.
   Evid. 502(d) applies.
7. Retention. The image will be retained until [FINAL DISPOSITION] and then
   destroyed, with a certificate of destruction.

Drafting commentary. Courts do not order imaging of personal phones routinely. Proportionality under Rule 26(b)(1) and privacy weigh against it unless the requesting party shows a production failure or a specific reason to doubt the opponent's collection. The protocol's protections (a neutral, filters, owner-first review, and a Rule 502(d) order) are what make it acceptable. Paragraph 3's non-content report (settings, resets, app history) often answers the spoliation question without exposing personal content. In the running example, Seastar would seek this protocol for the warehouse tablet only after Pruett's interrogatory answer named the tablet as the device running the WhatsApp business account. For motion practice if the other side refuses, see Bringing or Opposing a Motion to Compel Discovery: A Practical Guide.

Template 7: Requests for admission to authenticate messages

Purpose: resolve authenticity without witnesses, by splitting each element so a single denial cannot defeat all of them. Owner: proponent. When to use: during fact discovery, early enough to move on deficient responses.

PLAINTIFF'S [FIRST] REQUESTS FOR ADMISSION TO DEFENDANT [NAME]

Pursuant to Fed. R. Civ. P. 36, Plaintiff requests that Defendant admit the
following within 30 days of service.

Exhibit X-1 is a true and correct copy of a text message thread between
telephone numbers [NUMBER A] and [NUMBER B] for [DATE RANGE], produced as
[BATES].

REQUEST NO. 1: Admit that Exhibit X-1 is a true and accurate copy of
messages sent and received between [NUMBER A] and [NUMBER B] on the dates
shown.
REQUEST NO. 2: Admit that during [DATE RANGE] telephone number [NUMBER A] was
assigned to a mobile phone used by Glen Pruett.
REQUEST NO. 3: Admit that during [DATE RANGE] no person other than Glen
Pruett sent text messages from [NUMBER A] to Nadia Okafor.
REQUEST NO. 4: Admit that Glen Pruett sent the message in Exhibit X-1 dated
[DATE] at [TIME] reading "Can do 48 hrs guaranteed if you take the 6%."
REQUEST NO. 5: Admit that the WhatsApp account associated with [BUSINESS
NUMBER] was used during [DATE RANGE] to communicate on behalf of Pruett
Marine Supply, LLC.
REQUEST NO. 6: Admit that the reaction shown in Exhibit X-2 at [TIME] on
[DATE] was sent from the WhatsApp account associated with [BUSINESS NUMBER].
REQUEST NO. 7: Admit that the person who sent the reaction in Exhibit X-2
was authorized to communicate with customers on behalf of Pruett Marine
Supply, LLC.
REQUEST NO. 8: Admit that Exhibit X-3 is a true and accurate copy of the
WhatsApp group conversation [NAME] for [DATE RANGE].

Drafting commentary. Rule 36(a)(1)(B) reaches "the genuineness of any described documents," and Rule 36(a)(2) requires that a copy be attached or furnished. A matter is admitted unless answered within 30 days (Rule 36(a)(3)), and a party asserting lack of knowledge must state that it made a reasonable inquiry (Rule 36(a)(4)). If a denial is later proved wrong, Rule 37(c)(2) allows the requesting party to recover the reasonable expenses of proof. Requests 5 to 7 address the business account and the agency theory under Rule 801(d)(2)(D), which matters if Pruett blames his son. For drafting and response strategy, see Strategic Responses to Requests for Admission: A Comprehensive Guide for Legal Practitioners and Responding to Requests for Admission Checklist: A Practical Checklist.

Template 8: Recipient's authentication declaration

Purpose: lay the foundation a recipient would give at trial, for use at summary judgment, on a motion in limine, or at a pretrial hearing. Owner: proponent's counsel, with the declarant. When to use: with any motion that relies on message exhibits.

DECLARATION OF NADIA OKAFOR

I, Nadia Okafor, declare:

1. I am Vice President of Operations of Seastar Logistics, Inc. I have
   personal knowledge of the facts in this declaration and could testify to
   them.
2. Relationship. Since [YEAR] I have been Seastar's principal contact with
   Pruett Marine Supply, LLC, and its owner, Glen Pruett. Between [DATE] and
   [DATE] I exchanged [APPROXIMATE NUMBER] text messages with Mr. Pruett about
   orders and deliveries.
3. The number. Mr. Pruett gave me the number [NUMBER] in person on [DATE] as
   his mobile number. The same number appears on Pruett Marine invoices and
   in his email signature (Exhibits [ ]). I have called that number many times
   and Mr. Pruett answered.
4. The exchange. On [DATE] at about [TIME] I texted Mr. Pruett asking whether
   Pruett Marine could guarantee 48-hour delivery. At [TIME] I received the
   reply shown in Exhibit X-1: "Can do 48 hrs guaranteed if you take the 6%."
   Only Mr. Pruett and I had discussed a 6 percent increase; he had proposed
   it in a phone call on [DATE]. I replied, "Agreed, effective Monday."
5. Afterward. On [DATE], Mr. Pruett called me to confirm the new delivery
   schedule. Beginning [DATE], Pruett Marine invoices reflected the 6 percent
   increase (Exhibit [ ]).
6. The WhatsApp group. I am a member of the WhatsApp group "[NAME]," which
   includes the Pruett Marine business account [NUMBER]. On [DATE] I posted a
   photograph of the revised price sheet. The Pruett Marine account reacted
   with a thumbs-up at [TIME] (Exhibit X-2).
7. The exhibits. Exhibits X-1 and X-2 are true and accurate copies of the
   messages as they appeared on my iPhone, and were collected from my phone by
   [EXAMINER] on [DATE]. I have not altered or deleted any message in these
   conversations.

I declare under penalty of perjury that the foregoing is true and correct.
Executed on [DATE] at [CITY, STATE].

[SIGNATURE]

Drafting commentary. Each paragraph supplies one piece of the foundation. Paragraph 3 is transmission; paragraphs 4 and 5 are attribution under Rule 901(b)(4) (content only the author would know, followed by consistent conduct); paragraph 7 is fidelity under Rule 901(b)(1). Courts accept this pattern: in United States v. Siddiqui, 235 F.3d 1318 (11th Cir. 2000), emails were authenticated by the address, a nickname, context, and follow-up phone calls making the same requests; in United States v. Barnes, 803 F.3d 209 (5th Cir. 2015), by a witness who knew the sender's account and manner of communicating and had spoken with him at the number. Avoid conclusions ("Mr. Pruett sent this"); state the facts that support the conclusion. The closing follows 28 U.S.C. § 1746, and Rule 56(c)(4) requires personal knowledge and admissible facts. Paragraph 6 is weaker on attribution, because it shows only that the account reacted; it needs Template 7's admissions or discovery on who operated the account.

Template 9: Forensic examiner's declaration

Purpose: describe the collection and what the data shows, for use on motions and, if the examiner offers opinions, alongside the expert report. Owner: examiner, with counsel. When to use: summary judgment, motions in limine, spoliation motions.

DECLARATION OF [EXAMINER NAME]

1. Qualifications. I am a digital forensic examiner with [FIRM]. [YEARS,
   CERTIFICATIONS, TRAINING, TESTIMONY HISTORY.] My CV is Exhibit A.
2. Assignment. Counsel for [PARTY] asked me to collect and analyze messages
   on [DEVICES/ACCOUNTS].
3. Chain of custody. On [DATE] I received [DEVICE: MAKE, MODEL, IMEI/SERIAL]
   from [PERSON]. I photographed it and recorded its software version [ ].
   The chain of custody log is Exhibit B.
4. Collection. Using [TOOL AND VERSION], I performed a [FULL FILE SYSTEM /
   ADVANCED LOGICAL] extraction. The extraction's SHA-256 hash is [HASH]. I
   verified the hash of the working copy, which matches. The tool is [VALIDATED
   / TESTED] for this device and software version as described in Exhibit C.
5. Findings. The extraction contains a message record in the device's message
   database with the following attributes: sender handle [NUMBER]; recipient
   [NUMBER]; service [SMS/iMESSAGE]; sent [UTC TIME]; delivered [UTC TIME];
   text "[TEXT]." The record has no edit or deletion flag. Exhibit X-1
   accurately reflects the content and timing of this record, displayed in
   [TIME ZONE].
6. [IF APPLICABLE] Comparison. I compared the screenshot produced as [BATES]
   with the record in paragraph 5 and with how [APP/VERSION] displays
   messages on [DEVICE]. [STATE FINDINGS AND BASIS.]
7. [IF APPLICABLE] Device history. The device's records show [RESETS,
   APPLICATION INSTALL/DELETE DATES, RETENTION SETTINGS].

I declare under penalty of perjury that the foregoing is true and correct.
Executed on [DATE] at [CITY, STATE].
[SIGNATURE]

Drafting commentary. Paragraphs 3 to 5 are process testimony under Rule 901(b)(9). Paragraphs 6 and 7 are opinions based on specialized knowledge, so Rule 702 applies, and since the 2023 amendment the proponent must show the court that each requirement is more likely than not met. Disclose the examiner under Rule 26(a)(2) if those paragraphs will be used. A comparison like paragraph 6 decided Rossbach v. Montefiore Medical Center, 81 F.4th 124 (2d Cir. 2023), where an expert showed that an image of supposed texts did not match how messages display on any iPhone. For expert practice, see Expert Witnesses After the 2023 Amendment to Rule 702: Daubert, Disclosure, and Cross-Examination.

Template 10: Rule 902(13) certification of records generated by an electronic process

Purpose: authenticate a forensic extraction report without live testimony. Owner: the examiner who performed or supervised the extraction. When to use: pretrial, served with notice (Template 13).

CERTIFICATION PURSUANT TO FEDERAL RULE OF EVIDENCE 902(13)

I, [NAME], certify:

1. I am a [TITLE] at [FIRM] and am qualified by [TRAINING AND EXPERIENCE] to
   make this certification. I performed [or supervised] the process described
   below.
2. On [DATE], I used [TOOL AND VERSION] to extract data from [DEVICE AND
   IDENTIFIERS] and to generate the report produced as [BATES RANGE]
   ("Report").
3. [TOOL] is a commercially available forensic application widely used to
   extract and report data from mobile devices. I used it in accordance with
   its documented procedures. Before use, I [VALIDATED/TESTED] it for this
   device and software version as follows: [DESCRIBE].
4. The process produces an accurate result: the Report accurately reflects the
   message records stored on the device at the time of extraction, including
   sender and recipient identifiers, timestamps, and message content. I
   verified the accuracy of the Report by [E.G., SPOT-CHECKING ENTRIES AGAINST
   THE DEVICE DISPLAY / COMPARING HASHES].
5. The extraction's SHA-256 hash is [HASH].

I certify under penalty of perjury under the laws of the United States that
the foregoing is true and correct. Executed on [DATE] at [CITY, STATE].
[SIGNATURE]

Drafting commentary. Rule 902(13), effective December 1, 2017, covers "a record generated by an electronic process or system that produces an accurate result, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12)." Paragraphs 3 and 4 supply the "accurate result" showing; paragraph 1 supplies qualification. The certification authenticates the report only. It does not resolve hearsay, and it does not prove who typed a message. Under United States v. Browne, 834 F.3d 403 (3d Cir. 2016), self-authenticating certificates do not establish authorship of user content; pair the certification with Template 8 or admissions. The opponent can still challenge the process, so keep the examiner available.

Template 11: Rule 902(14) certification of data copied by digital identification

Purpose: authenticate a copy (a production set, an export, or a working image) as identical to what was collected. Owner: examiner or e-discovery specialist. When to use: pretrial, served with notice.

CERTIFICATION PURSUANT TO FEDERAL RULE OF EVIDENCE 902(14)

I, [NAME], certify:

1. I am a [TITLE] at [FIRM], qualified by [TRAINING AND EXPERIENCE] to make
   this certification.
2. On [DATE], [I/EXAMINER] collected [SOURCE: DEVICE, ACCOUNT, OR EXPORT] and
   computed its SHA-256 hash value: [HASH 1].
3. On [DATE], I computed the SHA-256 hash value of the copy produced as
   [BATES RANGE / FILE NAME]: [HASH 2].
4. The hash values are identical. A SHA-256 hash is a digital fingerprint;
   identical values indicate that the copy is identical to the original
   collected data.
5. [IF PRODUCTION FILES WERE PROCESSED] The production files were generated
   from the verified copy by [PROCESS], and each native file's hash is listed
   in the load file produced as [ ].

I certify under penalty of perjury under the laws of the United States that
the foregoing is true and correct. Executed on [DATE] at [CITY, STATE].
[SIGNATURE]

Drafting commentary. Rule 902(14) covers "data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification," and the committee note identifies hash comparison as the common process. It requires a hash at collection (Template 4); without one, use live testimony. Note what it proves: the copy matches the collection. It does not prove that the collection captured the original accurately (that is Template 10 or the examiner's testimony) or that a person wrote the content.

Template 12: Rule 902(11) certificate request and form for carriers and platforms

Purpose: obtain non-content records from a carrier or platform in a form that authenticates itself. Owner: proponent. When to use: with a Rule 45 subpoena for non-content records.

ATTACHMENT TO SUBPOENA: REQUEST FOR CERTIFICATION

Please produce the records requested in Schedule A together with a
certification in substantially the following form, signed by a custodian or
other qualified person.

CERTIFICATION OF RECORDS OF REGULARLY CONDUCTED ACTIVITY
(Fed. R. Evid. 803(6), 902(11))

I, [NAME], am employed by [COMPANY] as [TITLE] and am familiar with the
manner in which its records are created and maintained. The records produced
herewith, consisting of [DESCRIPTION, E.G., SUBSCRIBER INFORMATION AND
MESSAGE DETAIL RECORDS FOR NUMBER (   ) FOR (DATES)], Bates [ ], are true
copies of records that were:
(A) made at or near the time of the occurrence of the matters set forth by,
    or from information transmitted by, a person with knowledge of those
    matters;
(B) kept in the course of [COMPANY]'s regularly conducted activity; and
(C) made as a regular practice of that activity.

I declare under penalty of perjury that the foregoing is true and correct.
Executed on [DATE] at [CITY, STATE].
[SIGNATURE]

SCHEDULE A (NON-CONTENT RECORDS ONLY)
1. Subscriber name, address, and account start date for [NUMBER/ACCOUNT].
2. Records showing the date, time, originating and terminating numbers of
   text messages to and from [NUMBER] between [DATES]. CONTENT IS NOT
   REQUESTED.
3. [PLATFORM] Account registration information, account creation date and
   IP address, and login IP logs for [DATES].

Drafting commentary. The certificate tracks Rule 803(6)(A) through (C), which Rule 902(11) incorporates. Ask only for non-content records: 18 U.S.C. § 2702(c)(6) allows providers to disclose them to non-governmental entities, while content is barred, and an overbroad subpoena that causes disclosure can create liability, as in Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004). Records like these supply transmission and can support attribution when tied to a person, as in United States v. Hassan, 742 F.3d 104 (4th Cir. 2014), where certified Facebook and Google records were linked to the defendants through IP addresses. Rule 45 mechanics, including service and objections, are covered in Nonparty Discovery Toolkit: Subpoenas, Third-Party Records, and Privilege and Fed. R. Civ. P. 45. Carriers often retain message detail records for limited periods; serve early.

Template 13: Notice of intent to offer certified records

Purpose: satisfy the notice requirement of Rules 902(11), (13), and (14). Owner: proponent. When to use: with pretrial disclosures or earlier, and in any event in time for a fair opportunity to challenge.

NOTICE OF INTENT TO OFFER RECORDS UNDER FED. R. EVID. 902(11), 902(13),
AND 902(14)

Plaintiff gives notice that it intends to offer the following records at
trial [and in connection with its motion for summary judgment] without
extrinsic evidence of authenticity, on the basis of the certifications
identified below. The records and certifications have been produced at the
Bates numbers shown and are available for inspection at [LOCATION] on
reasonable request.

| Exhibit | Description | Certification | Bates |
|---|---|---|---|
| X-1 | SMS thread, Okafor phone (C-1) | 902(13) cert. of [EXAMINER]; 902(14) cert. of [SPECIALIST] | [ ] |
| X-2 | WhatsApp group export (C-2) | 902(13); 902(14) | [ ] |
| X-5 | [CARRIER] message detail records for [NUMBER] | 902(11) cert. of [CUSTODIAN] | [ ] |

Plaintiff will also offer testimony and other evidence of authorship of the
messages in these records.

[SIGNATURE BLOCK]

Drafting commentary. Rule 902(11) requires that "before the trial or hearing, the proponent must give an adverse party reasonable written notice of the intent to offer the record, and must make the record and certification available for inspection, so that the party has a fair opportunity to challenge them." Rules 902(13) and (14) incorporate the same requirement. The last sentence of the notice is deliberate: it tells the court and the opponent that the proponent is not relying on certificates for authorship, which is the argument Browne rejected. Serve this notice before the Rule 26(a)(3)(B) objection window runs, so objections to the certified exhibits are raised on schedule.

Template 14: Authenticity stipulation

Purpose: remove authenticity disputes for categories of messages, preserving other objections. Owner: both sides. When to use: after productions are substantially complete and before pretrial disclosures.

STIPULATION REGARDING AUTHENTICITY OF ELECTRONIC MESSAGES

The parties stipulate:
1. Each message produced by a party from that party's own devices, accounts,
   or systems is authentic for purposes of Fed. R. Evid. 901, and is a true
   and accurate copy of the message as stored on the source, unless a party
   identifies a specific message by Bates number and the basis for
   challenging it by [DATE].
2. For messages produced by a party from its own sources, the producing
   party does not contest that the message was sent from the device or
   account shown. [OPTIONAL: and does not contest that it was authored by
   the account holder, except for messages identified under paragraph 1.]
3. This stipulation does not waive objections to relevance, hearsay,
   completeness, Rule 403, or any objection other than authenticity.
4. The parties will meet and confer about any message identified under
   paragraph 1 and present unresolved disputes [BY MOTION IN LIMINE / AT THE
   PRETRIAL CONFERENCE].

Drafting commentary. Most parties will stipulate to the authenticity of their own productions, because they want the same for their exhibits. The optional authorship clause in paragraph 2 is the one to negotiate: Pruett would accept paragraph 2 for SMS messages from Glen's phone but resist it for the WhatsApp business account. Carving out specifically identified messages (paragraph 1) confines the fight to what is actually disputed. A stipulation also narrows Rule 26(a)(3)(B) objections to the carved-out messages.

Template 15: Motion in limine to exclude unauthenticated messages, with opposition outline

Purpose: exclude message exhibits for which the proponent cannot lay a sufficient foundation, or which are fabricated; or, for the proponent, defeat the motion. Owner: opponent (motion); proponent (opposition). When to use: per the pretrial order, after serving Rule 26(a)(3)(B) objections.

DEFENDANT'S MOTION IN LIMINE NO. [ ] TO EXCLUDE EXHIBITS X-2 AND X-3
(UNAUTHENTICATED WHATSAPP MESSAGES)

I. Relief requested. Defendant moves to exclude Exhibits X-2 and X-3, or
   alternatively for a hearing outside the presence of the jury under Fed. R.
   Evid. 104, because Plaintiff cannot produce evidence sufficient to support
   a finding that Glen Pruett or Pruett Marine authored them.

II. Background. [Facts: the business account; the warehouse tablet; who had
    access; what discovery showed.]

III. Standard. Fed. R. Evid. 901(a); Rule 104(b). The proponent must offer
     evidence from which a reasonable juror could find that the item is what
     the proponent claims. A name or number on an account is not enough
     without evidence connecting the person to the content. [Cite Vayner;
     Eleck; forum authority.]

IV. Argument.
    A. Plaintiff's evidence shows at most that the business account sent a
       reaction; it does not show who operated the account. [Facts.]
    B. Platform or forensic certifications do not establish authorship.
       [Browne.]
    C. [If applicable] The exhibit is inconsistent with the source data.
       [Examiner declaration; Rossbach.]
    D. Alternatively, Rule 403 and Rule 106. [Unfair prejudice; misleading
       excerpt; require completion with M-4.]

V. Conclusion. [Relief; proposed order.]

OPPOSITION OUTLINE

1. Standard: low threshold; jury decides weight (Rule 104(b); Huddleston;
   Lewisbey; forum authority).
2. Fidelity: forensic extraction; 902(13)/(14) certifications; notice served.
3. Transmission: WhatsApp business account tied to Pruett Marine's listed
   number; carrier and platform records.
4. Attribution: content and context (price sheet; prior orders); Pruett
   Marine's admissions (RFA 5 to 7); agency (Rule 801(d)(2)(D)); conduct
   after (invoices).
5. Distinguish Vayner and Eleck: more than a name on an account.
6. Defendant's alternative author is unsupported or contradicted by the
   tablet's data.
7. Completeness: Plaintiff offers M-3 with M-4; Rule 106 satisfied.
8. Alternatively, admit conditionally under Rule 104(b) subject to
   connection at trial.

Drafting commentary. The motion succeeds only if it shows that the foundation cannot be laid, not that it could be stronger. Under Rule 104(b) and Huddleston v. United States, 485 U.S. 681 (1988), the court asks whether the jury could reasonably find the conditional fact. The opponent's best authorities are United States v. Vayner, 769 F.3d 125 (2d Cir. 2014) (profile page with a name and photo, nothing connecting the defendant to it) and State v. Eleck, 130 Conn. App. 632 (2011) (messages from an account the holder said was hacked, with no distinctive content). The proponent's are United States v. Lewisbey, 843 F.3d 653 (7th Cir. 2016), Tienda v. State, 358 S.W.3d 633 (Tex. Crim. App. 2012), and Parker v. State, 85 A.3d 682 (Del. 2014). Raise Rule 403 and Rule 106 only as alternatives. For limine practice, see Drafting and Opposing Motions in Limine: A Practical Guide, Motion in Limine Toolkit: Standard Motion Banks, Opposition Frameworks, and Trial Objection Plans, and Motion in Limine Checklist: A Practical Checklist.

If the motion claims AI fabrication, support it with an examiner. As of this update, proposed Rule 707 (applying Rule 702's reliability standards to machine-generated evidence offered without an expert) was published for public comment in August 2025, and the Advisory Committee on Evidence Rules has held back a deepfake-specific amendment to Rule 901. Neither is in effect; the motion rests on current Rules 901, 403, and 702.

Template 16: Trial foundation examination script (recipient)

Purpose: lay the foundation for a message exhibit through the recipient in the order the court expects. Owner: proponent's trial counsel. When to use: at trial, or at a Rule 104 hearing.

DIRECT EXAMINATION: FOUNDATION FOR EXHIBIT X-1 (NADIA OKAFOR)

Relationship
Q. How do you know Glen Pruett?
Q. How long have you communicated with him, and how?

The number
Q. What number do you use to text Mr. Pruett? How did you get it?
Q. Have you called that number? Who answered?

The exchange
Q. On [DATE], did you text Mr. Pruett? What about?
Q. Did you receive a reply? From what number?
Q. [Show X-1 to witness only.] Do you recognize Exhibit X-1?
Q. What is it?
Q. Before this message, who had discussed a 6 percent increase?

What happened next
Q. After this exchange, did you speak with Mr. Pruett? What did he say?
Q. What did the next Pruett Marine invoice show?

Accuracy
Q. Does Exhibit X-1 accurately show the messages as they appeared on your
   phone?
Q. Has anything been added, removed, or changed?
Q. How was it collected from your phone?

Offer
"Plaintiff offers Exhibit X-1." [If objection: proffer Rule 901(b)(1),
(b)(4); 902(13) and (14) certifications noticed on (DATE); party statement
under 801(d)(2)(A); full thread offered under Rule 106.]

Drafting commentary. The script follows the order of the foundation: transmission (the number), attribution (content and conduct), then fidelity (accuracy), then the offer. Keep the exhibit from the jury until it is admitted. If the court has ruled in limine, confirm the ruling on the record before the offer, and renew objections as the pretrial order requires; see Motions in Limine: Strategy, Timing, and Preserving Error for Appeal. Display the thread as the witness saw it, with time zone stated; for exhibit mechanics, see Trial Exhibits and Demonstratives: Getting Evidence in Front of the Jury and Keeping It There. A long thread may be summarized under Rule 1006. Accurate printouts of messages are originals under Rule 1001(d), so a best evidence objection to X-1 should fail. Where a deposition will be used instead of live testimony, see Remote Deposition Toolkit: Stipulated Protocols, Exhibit Plans, and Technology Scripts for sharing native message exhibits with a remote witness.

Template 17: Deadline tracker

How the running example ends. Pruett's interrogatory answer says Cal Pruett operated the WhatsApp business account from the warehouse tablet and was authorized to respond to customers. Seastar uses that answer to support Requests 5 to 7, which Pruett admits. The SMS exchange (M-1 and M-2) comes in on Okafor's declaration and the certifications; Pruett stipulates to its authenticity once the carrier records show messaging between the two numbers at the exact times. The fight narrows to whether a thumbs-up from an authorized employee on a business account, followed by invoices at the new price, shows assent. That is a merits question for the jury, not an authentication question, which is where a well-built foundation should leave it.

Practical takeaways

• Build the foundation matrix first and update it after every production and deposition.
• Name apps, devices, and auto-delete settings in every preservation letter and hold.
• Record hash values at collection; without them, Rule 902(14) is unavailable.
• Split requests for admission so one denial cannot defeat every element.
• Use certifications for systems and declarations or admissions for people.
• Serve notice of certifications before the objection window runs.
• Move in limine on evidence, not on weight.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Related Articles

• Authenticating Text Messages, Chats, and Social Media Evidence: Rules 901 and 902, Metadata, and Deepfake Challenges: the doctrine behind each template.
• Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case: the duty behind Templates 2 and 4.
• Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court: capture declarations for public posts.
• Motions in Limine: Strategy, Timing, and Preserving Error for Appeal: the context for Template 15.

Related Guides

• Collecting and Authenticating Messaging and Social Media Evidence: A Practical Guide: when each template is used, step by step.
• Drafting and Opposing Motions in Limine: A Practical Guide: drafting the motion and opposition in Template 15.
• Bringing or Opposing a Motion to Compel Discovery: A Practical Guide: enforcing Templates 5 and 6.
• Employee Monitoring and Workplace Privacy: A Practical Guide: lawful collection from employees.

Related Checklists

• Messaging and Social Media Evidence Checklist: A Practical Checklist: the tasks these templates support.
• Authenticating Website Evidence: A Practical Checklist: web-page counterpart.
• Responding to Requests for Admission Checklist: A Practical Checklist: the other side of Template 7.
• Motion in Limine Checklist: A Practical Checklist: pretrial motion tasks.

Related Toolkits

• Motion in Limine Toolkit: Standard Motion Banks, Opposition Frameworks, and Trial Objection Plans: companion motion bank.
• Discovery Enforcement Toolkit: Deficiency Letters, Meet-and-Confer Records, and Rule 37 Motions: deficiency letters and motions.
• Trade Secret Litigation Toolkit: Identification Statements, Two-Tier Protective Orders, and Forensic Protocols: forensic protocols for departing-employee cases.
• Nonparty Discovery Toolkit: Subpoenas, Third-Party Records, and Privilege: subpoena forms behind Template 12.
• Remote Deposition Toolkit: Stipulated Protocols, Exhibit Plans, and Technology Scripts: native exhibits with remote witnesses.