Messaging and Social Media Evidence Checklist: A Practical Checklist

Summary. This checklist turns the collection and authentication of text messages, chats, direct messages, and social media posts into phased, check-off tasks for the party offering them and the party challenging them. It runs from triage and preservation (including auto-delete settings and device quarantine) through custodian interviews, collection with chain of custody and hash values, review and production, discovery from opponents and nonparties within the limits of the Stored Communications Act, and locking in authenticity with requests for admission and depositions. Later phases cover summary judgment declarations, Rule 902 certifications and notice, pretrial disclosures and the 14-day objection window, motions in limine, and the trial foundation, including hearsay mapping and completeness. Red-flag boxes mark the points where cases are most often lost. A deadlines table, common failure points, and a short worked example close the checklist.

How to use this checklist

Work through the phases in order, but expect overlap: preservation and collection often happen in the same week, and discovery and authentication run in parallel. Each item names the governing authority and, where useful, a short practical note. Items marked (Opponent) are for the party challenging the messages; everything else is written for the proponent, though most items apply to both sides because each side usually has messages to offer.

One idea organizes the whole list. For every important message, the proponent needs three foundations:

1. Fidelity: the exhibit accurately reproduces what was on the device, account, or platform.
2. Transmission: a particular number, account, or handle sent it to another at about the time shown.
3. Attribution: a particular person wrote or adopted it.

The legal threshold under Fed. R. Evid. 901(a) is evidence sufficient to support a finding, which the court applies under Rule 104(b), leaving the final decision to the jury. The threshold is low, but attribution is where challenges succeed. The doctrine is explained in Authenticating Text Messages, Chats, and Social Media Evidence: Rules 901 and 902, Metadata, and Deepfake Challenges; the step-by-step narrative is in Collecting and Authenticating Messaging and Social Media Evidence: A Practical Guide; and the forms are in Digital Message Evidence Toolkit: Collection Protocols, Authentication Declarations, and Rule 902 Certifications. For web pages rather than messages, use Authenticating Website Evidence: A Practical Checklist.

Phase 1: Triage (days 1 to 3)

• List the messages that matter and rank them. Separate messages that are the claim (a threat, a disclosure, an acceptance, a defamatory post) from background and impeachment. Note: collection effort and cost should track the ranking.
• Identify the purported author of each key message and whether authorship will be disputed. Adverse authors, shared devices, and "I don't remember" answers predict a fight.
• Identify the source of each message you already have. Was it forwarded, photographed, screenshotted by the client, or pulled from a device? Note: forwarded screenshots are leads, not evidence.
• Ask how the client obtained each message. Messages taken from another person's phone or account may implicate 18 U.S.C. § 2701, 18 U.S.C. § 2511, 18 U.S.C. § 1030, or state law. Do not direct further self-help.
• Check recording law before using any call recording. Federal law allows one-party consent under § 2511(2)(d); California and other states require all-party consent for confidential communications, as in Cal. Penal Code § 632.
• Identify the forum's authentication case law. Federal courts apply Rule 901(a). Most states follow the ordinary approach of Tienda v. State, 358 S.W.3d 633 (Tex. Crim. App. 2012), and Parker v. State, 85 A.3d 682 (Del. 2014); some decisions following Griffin v. State, 419 Md. 343 (2011), ask for more. Maryland's later decision in Sublet v. State, 442 Md. 632 (2015), confirmed the reasonable-juror test.
• Decide the date the duty to preserve attached, and document why. Note: the date drives Rule 37(e) analysis for both sides.

Red flag: the client "already has everything." A folder of screenshots with no source device, no thread context, and no metadata is the beginning of collection, not the end. Ask where each image came from and whether the device still exists.

Phase 2: Preserve (day 1 onward)

• Issue a written hold that names messaging channels specifically: SMS and iMessage, WhatsApp, Signal, Telegram, social media direct messages, Slack, Teams, and Google Chat. Authority: Fed. R. Civ. P. 37(e) (reasonable steps).
• Instruct custodians to turn off disappearing messages and auto-delete, including the iPhone "Keep Messages" setting and per-chat timers in WhatsApp and Signal, and to confirm in writing.
• Prohibit resetting, trading in, or discarding phones; deleting apps; or leaving group chats.
• Quarantine departed employees' company devices. Pull them from the reimaging queue the same day.
• Suspend enterprise retention policies for relevant Slack, Teams, and email custodians.
• Send preservation letters to the opposing party and key nonparties that name the same channels and the auto-delete instruction.
• Send courtesy preservation requests to platforms for key accounts, understanding that the statutory demand in 18 U.S.C. § 2703(f) is available only to governmental entities.
• Capture public posts and profiles now, with a tool that records URL, time, and hash. See Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court.
• Calendar hold reminders and re-confirm settings at intervals. See Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.

Red flag: ephemeral apps used for business. Courts have imposed adverse inferences where parties moved communications to Signal or similar apps after learning of an investigation, as in FTC v. Noland, No. CV-20-00047 (D. Ariz. Aug. 30, 2021), and where a party deleted Facebook posts and Telegram messages after anticipating suit, as in Fast v. GoDaddy.com LLC, 340 F.R.D. 326 (D. Ariz. 2022). If the client uses disappearing messages, change the settings today and document it.

Phase 3: Custodian interviews (week 1)

• List every phone used in the period, with dates of replacement and whether messages were transferred.
• Identify every Apple ID or Google account on each device and everyone else who uses those accounts or devices. Note: shared Apple IDs put messages on family iPads and laptops.
• List every messaging app used with each key person, and whether disappearing messages were ever on.
• Ask whether anything was deleted, edited, or unsent, and when.
• Ask how screenshots were made, stored, and sent.
• Record the contact names the custodian assigned to key people. Note: a contact name is a label, not proof of identity.
• Ask whether anyone else had the passcode or access to the accounts, and whether any account was ever compromised or reset.
• Identify cloud and computer backups and the other participants in key threads (who hold their own copies).
• Document the interview in a privileged memo and update the source map.

Phase 4: Collect (weeks 1 to 4)

• Select the method for each source by importance: app export or account download for low-stakes messages; targeted remote collection or full forensic extraction for key messages and any disputed authorship; enterprise export for Slack, Teams, or Google Chat.
• Do not use screenshots as the collection method for any message likely to be disputed. Keep them as exhibits and leads.
• Record chain of custody for every collection: collector, date and time, device make, model, serial or IMEI, account identifiers, tool and version, extraction type.
• Record a hash value (for example, SHA-256) of each extraction or export at collection. Authority: Fed. R. Evid. 902(14) (data copied and authenticated by digital identification).
• Store originals read-only and work from copies.
• Collect the whole thread and its attachments, not only the message the client highlighted.
• Collect backups and secondary devices identified in interviews.
• Confirm authority for each collection, especially personal accounts on company devices and personal devices of employees.
• Have the examiner validate the tool and keep a record of the validation.

Red flag: a screenshot that "can't be verified." In Rossbach v. Montefiore Medical Center, 81 F.4th 124 (2d Cir. 2023), a plaintiff's image of supposed texts did not match how messages appear on the phone she described, she had withheld one phone's passcode and disposed of another, and her case was dismissed as a sanction. If your client cannot produce the device behind a key screenshot, find out why before you rely on it.

Phase 5: Review, process, and produce

• Load messages into a platform that displays conversations as threads, using a short message format where available.
• Agree with the other side on the unit of production (for example, one document per conversation per 24 hours) and the metadata fields.
• Normalize timestamps to one time zone and state the zone on every exhibit.
• Build a participant key mapping numbers, handles, and account IDs to people.
• Flag edits, unsends, reactions, and deletions shown in the data.
• Obtain a protective order and an order under Fed. R. Evid. 502(d) before producing personal or privileged message data.
• Redact as required by Fed. R. Civ. P. 5.2 before filing.
• Produce in the form requested, or state the form you will use, under Fed. R. Civ. P. 34(b)(2)(E).
• Disclose preservation gaps early, with what was done to restore or replace lost messages. Note: Rule 37(e) applies only if the information "cannot be restored or replaced through additional discovery."

Phase 6: Get the other side's and nonparties' messages

• Raise mobile and chat data at the Rule 26(f) conference and ask for it to be addressed in the scheduling order under Fed. R. Civ. P. 16(b)(3). See Negotiating an ESI Protocol and Managing E-Discovery Costs.
• Serve Rule 34 requests naming custodians, channels, participants, date ranges, and a threaded production format with metadata.
• Serve interrogatories asking for every phone number, device, and messaging account used, and everyone with access.
• Request a forensic protocol only with a factual basis (evidence of deletion, withholding, or alteration), and propose a neutral examiner, filters, and owner-first privilege review. Authority: Fed. R. Civ. P. 26(b)(1) (proportionality).
• Do not accept privacy settings as an objection to relevant content. See Forman v. Henkin, 30 N.Y.3d 656 (2018).
• Subpoena nonparty individuals, not platforms, for message content, under Fed. R. Civ. P. 45.
• Subpoena platforms and carriers for non-content records only (subscriber, account creation, login and IP logs). Authority: 18 U.S.C. § 2702(c)(6).
• Obtain content held by providers through the party's own account download or a court-ordered consent. Civil subpoenas for content are quashed, as in Crispin v. Christian Audigier, Inc., 717 F. Supp. 2d 965 (C.D. Cal. 2010).
• Move to compel if production fails, after a documented meet and confer. See Motion Practice Toolkit: Dispositive, Discovery, and In Limine Motions.

Red flag: a subpoena to a platform for "all messages." It violates the Stored Communications Act's disclosure bar, will be quashed, and an overbroad subpoena that induces disclosure can create liability, as in Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004).

Phase 7: Lock in authenticity during discovery

• Serve requests for admission on each key message, split into (a) genuineness of the exhibit, (b) ownership and use of the number or account on the date, and (c) sending. Authority: Fed. R. Civ. P. 36(a)(1)(B).
• Calendar the 30-day response deadline; unanswered requests are deemed admitted under Rule 36(a)(3).
• Consider a cost-shifting motion for unjustified denials under Rule 37(c)(2).
• At deposition, walk the author through the thread, not just the disputed message: the number, the devices, who else had access, every message before and after, nicknames and phrasing, and later conduct.
• Notice a Rule 30(b)(6) deposition on an organization's messaging systems, retention settings, and collection. Authority: Fed. R. Civ. P. 30(b)(6).
• Propose a stipulation that messages produced from a party's own devices or accounts are authentic, reserving other objections.
• (Opponent) Answer requests for admission after a reasonable inquiry, and deny or qualify specifically under Rule 36(a)(4). See Responding to Requests for Admission Checklist: A Practical Checklist.

Phase 8: Summary judgment

• Attach a foundation declaration from the recipient for each message exhibit: relationship, how the number or account is known to be the sender's, the exchange, the details tying it to the sender, and accuracy of the exhibit. Authority: Fed. R. Civ. P. 56(c)(4); 28 U.S.C. § 1746.
• Attach the examiner's declaration for forensically collected messages: method, tool, chain of custody, hash.
• Cite admissions and deposition testimony that authenticate the messages.
• Do not attach messages to an attorney declaration with no foundation. Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (D. Md. 2007), denied both sides' motions for that reason.
• (Opponent) Object under Rule 56(c)(2) specifically, identifying which foundation (fidelity, transmission, attribution) cannot be supplied at trial. Note: the question is whether the material can be presented in admissible form, as Maurer v. Independence Town, 870 F.3d 380 (5th Cir. 2017), explains. See Summary Judgment Motion Checklist: A Practical Checklist.

Phase 9: Pretrial certifications, disclosures, and motions

• Decide which exhibits will come in by certification: carrier and platform records under Rule 902(11); forensic extraction reports under Rule 902(13); hash-verified copies under Rule 902(14).
• Confirm each Rule 902(11) certificate tracks Rule 803(6)(A) through (C). Authority: Fed. R. Evid. 803(6).
• Serve reasonable written notice of each certification before trial and make the records and certifications available for inspection, as Rule 902(11) requires and Rules 902(13) and (14) incorporate.
• Pair every platform certificate with attribution evidence. A certificate does not prove who typed the message: United States v. Browne, 834 F.3d 403 (3d Cir. 2016). Compare United States v. Hassan, 742 F.3d 104 (4th Cir. 2014) (certificates plus evidence linking accounts to the defendants).
• Disclose the forensic examiner under Rule 26(a)(2) if the examiner will offer opinions, and prepare to meet amended Fed. R. Evid. 702 (2023). See Expert Witnesses After the 2023 Amendment to Rule 702: Daubert, Disclosure, and Cross-Examination.
• List each message exhibit specifically in Rule 26(a)(3)(A)(iii) pretrial disclosures.
• Calendar the 14-day objection deadline under Rule 26(a)(3)(B) for both sides. Objections not made, other than under Rules 402 and 403, are waived unless excused for good cause.
• (Opponent) File a motion in limine for the key exhibits, and request a hearing outside the jury's presence under Rule 104 if forensic testimony is needed. See Motions in Limine: Strategy, Timing, and Preserving Error for Appeal and Motion in Limine Checklist: A Practical Checklist.
• Prepare Rule 403 redactions for gratuitous content. See Federal Rule of Evidence 403 and Unfair Prejudice: A Practical Guide.

Red flag: the missed objection window. A party that does not serve authentication objections within 14 days after pretrial disclosures may have waived them. Put both sides' deadlines on the calendar the day disclosures are served.

Phase 10: Trial foundation

• Prepare a foundation sheet for each message exhibit: source, collection record, authentication route, attribution facts, hearsay route for each statement, completeness issues, redactions.
• Prepare the recipient's foundation: relationship; how the number or account is known; the exchange; distinctive details; later conduct; accuracy of the exhibit.
• Prepare the examiner's foundation if not certified: qualifications, chain of custody, tool and version, extraction, hash, what the data shows.
• Assemble the distinctive-characteristics evidence under Rule 901(b)(4): content only the author would know, nicknames, replies, photos, conduct afterward. Courts admit on this kind of record: United States v. Lewisbey, 843 F.3d 653 (7th Cir. 2016); United States v. Barnes, 803 F.3d 209 (5th Cir. 2015); United States v. Siddiqui, 235 F.3d 1318 (11th Cir. 2000).
• Confirm you have more than a name and photo on an account. That is the failure in United States v. Vayner, 769 F.3d 125 (2d Cir. 2014).
• Map hearsay for each statement in the thread: party statements under Rule 801(d)(2); the other participant's statements for context with a limiting instruction under Rule 105; Rule 803 exceptions; Rule 807 with notice.
• Offer the whole relevant thread. Amended Rule 106 (2023) lets the adverse party require the rest over a hearsay objection.
• Confirm the best evidence rule is satisfied: accurate printouts of ESI are originals under Rule 1001(d); duplicates are admissible under Rule 1003 absent a genuine question.
• Prepare summaries of long threads under Rule 1006, with the underlying messages made available.
• Format exhibits as the recipient saw them, with timestamps, time zone, and emojis rendered for the recipient's platform. See Trial Exhibit Preparation Checklist.

Phase 11 (Opponent): Challenging messages offered against you

• Identify which foundation is weak: fidelity, transmission, or attribution.
• Request the native screenshot file, the source device, and the full thread.
• Retain a forensic examiner before alleging fabrication.
• Subpoena carrier and platform non-content records to test transmission.
• Develop specific attribution facts: shared devices and accounts, documented compromises (security notices, password resets, unfamiliar logins), lost or replaced phones. Note: unsupported "hacked account" claims usually go to weight; supported ones can defeat a thin foundation, as in State v. Eleck, 130 Conn. App. 632 (2011).
• Preserve your own client's devices and data. Claiming fabrication while discarding the phone that would disprove it invites Rule 37(e) consequences.
• Move for sanctions if fabrication is shown, under the court's inherent authority.
• Object separately on hearsay, completeness, and Rule 403 even if authentication is lost.
• Track pending rulemaking on AI-generated and deepfake evidence. The Advisory Committee on Evidence Rules has been studying proposals on machine-generated evidence and on deepfakes; as of this update none has been adopted, and current law is Rules 901, 902, 403, and 702.

Key deadlines and timing

Common failure points

1. The company phone was wiped. Quarantine departed employees' devices on day one.
2. The hold never mentioned texts or chat apps. Name every channel and the auto-delete setting.
3. Screenshots as the collection. No metadata, no hash, no answer to a fidelity challenge.
4. A content subpoena to the platform. Quashed under the Stored Communications Act; get it from the party.
5. A single combined request for admission. One denial defeats all three facts.
6. Certificate without attribution evidence. Browne forecloses it.
7. No notice of certifications. The certificate cannot be used if the other side had no fair chance to challenge it.
8. Missed 14-day objection window. Authentication objections may be waived.
9. Excerpted threads. Rule 106 brings in the rest at the worst moment.
10. A fabrication claim with no examiner. Weight arguments do not exclude evidence.

Short worked example

Kestrel Home Health, a home-care agency, is sued by a former scheduler, Lena Ibarra, for retaliation. Her key exhibit is a screenshot of a WhatsApp message from the agency's owner: "If she files with the state, she's done here." The owner says he does not recall it and that his office manager sometimes answers WhatsApp for him on the office tablet.

Ibarra's counsel works the checklist. Phase 2: a preservation letter asks Kestrel to preserve the owner's phone, the office tablet, and WhatsApp backups, and to turn off disappearing messages. Phase 4: an examiner extracts Ibarra's phone, which holds the thread with the owner's number and a hash-verified record of the message. Phase 6: a Rule 34 request and a limited forensic protocol reach the owner's phone and the office tablet. Phase 7: split requests for admission get the owner to admit the number and the WhatsApp account are his; he denies sending the message. The tablet's extraction shows WhatsApp was not installed on it during the relevant month. The owner's phone holds the message, sent two minutes after a message from Ibarra telling him she planned to contact the state licensing agency.

Phase 9: Ibarra serves notice of Rule 902(13) and (14) certifications for both extractions. Kestrel objects on authentication within the 14-day window and moves in limine, arguing that the office manager could have sent the message. The court denies the motion: the message came from the owner's phone and account, responded directly to Ibarra's message, and the tablet theory is contradicted by the data. Kestrel invokes Rule 106 to add the owner's next message, "Talk to me first," which Ibarra had already included in the exhibit.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Related Articles

• Authenticating Text Messages, Chats, and Social Media Evidence: Rules 901 and 902, Metadata, and Deepfake Challenges: the doctrine and the leading cases behind each item.
• Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case: the preservation duty and sanctions.
• Motions in Limine: Strategy, Timing, and Preserving Error for Appeal: pretrial rulings on authentication.
• Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court: public posts and web captures.

Related Guides

• Collecting and Authenticating Messaging and Social Media Evidence: A Practical Guide: the narrative version of this checklist.
• Drafting and Opposing Motions in Limine: A Practical Guide: moving to exclude or defending message exhibits.
• Federal Rule of Evidence 403 and Unfair Prejudice: A Practical Guide: redacting inflammatory content.

Related Checklists

• Authenticating Website Evidence: A Practical Checklist: the companion checklist for web pages.
• Litigation Hold and Evidence Preservation Checklist: A Practical Checklist: hold notices and follow-up.
• Responding to Requests for Admission Checklist: A Practical Checklist: the responding side of Phase 7.
• Motion in Limine Checklist: A Practical Checklist: pretrial motion tasks.
• Trial Exhibit Preparation Checklist: building and marking the exhibits.

Related Toolkits

• Digital Message Evidence Toolkit: Collection Protocols, Authentication Declarations, and Rule 902 Certifications: the forms for each phase.
• Motion Practice Toolkit: Dispositive, Discovery, and In Limine Motions: motion templates.
• Trade Secret Litigation Toolkit: Identification Statements, Two-Tier Protective Orders, and Forensic Protocols: forensic device protocols.