A text message arrives on a phone.
Someone takes a screenshot.
The original message is later deleted.
Months afterward, a lawsuit is filed, a criminal investigation begins or a relationship ends up in court.
The original conversation may be gone. The phone may have been replaced. The social-media account may no longer exist.
But the screenshot remains.
That small image can suddenly become evidence.
Screenshots have become one of the most ordinary forms of modern documentation. People use them to preserve text conversations, social-media posts, online advertisements, payment confirmations, dating profiles, emails, maps and virtually anything else that appears on a screen.
But there is an important difference between possessing a screenshot and proving what it means.
A screenshot can show what appeared on a screen at a particular moment.
It does not automatically establish who put it there, whether anything was altered, what happened immediately before or afterward, or even who was actually using the account.
That is where evidence law begins.
A Screenshot Does Not Authenticate Itself
Federal Rule of Evidence 901 states the basic authentication requirement: the person offering evidence must produce enough evidence to support a finding that the item is what the person claims it is.
That rule applies far beyond screenshots.
A photograph must be connected to what it supposedly depicts.
A recording must be connected to the conversation it supposedly captured.
A document must be shown to be what its proponent says it is.
Digital evidence presents the same basic problem in a newer form.
Imagine someone offers a screenshot of a text message and says:
“This is a message the defendant sent me.”
Several different propositions are packed into that statement.
The image must accurately depict the message.
The message must have come from the account or telephone number shown.
And if authorship matters, there must be some basis for connecting the communication to the person who allegedly sent it.
Those questions can sometimes be answered easily.
Other times, they become the center of the case.
The Simplest Authentication May Be a Person Who Saw It
One of the methods specifically recognized by Rule 901 is testimony from a witness with knowledge that an item is what it is claimed to be. The rule also recognizes authentication through distinctive characteristics and surrounding circumstances.
Suppose two people exchange text messages.
One participant takes screenshots as the conversation occurs.
Later, that person testifies that the screenshots accurately show the messages received and sent during the conversation.
That testimony may provide important authentication evidence.
The situation becomes more complicated when nobody involved in the conversation is available to explain it.
Perhaps investigators found the screenshot on someone else's phone.
Perhaps it was emailed anonymously.
Perhaps it was reposted online.
Perhaps one person captured a screenshot of another person's screenshot.
Every step separating the evidence from its original source can create another question.
A Name and Photograph May Not Be Enough
Social media illustrates the problem particularly well.
Creating an account using another person's name and photograph is not difficult.
That became important in the federal case United States v. Vayner.
Prosecutors introduced a printout of a social-networking profile they attributed to the defendant. The page contained his name and photograph, along with other information.
But the Second Circuit concluded that the government had not provided a sufficient basis to establish that the profile was actually the defendant's page.
The problem was not that online evidence could never be authenticated.
The problem was the connection between the page and the person.
The court explained that electronic evidence can be authenticated in many ways and that what is sufficient depends on the circumstances.
That distinction remains important whenever a screenshot supposedly proves what someone said online.
A screenshot showing a person's photograph does not necessarily prove that person controlled the account.
A username does not necessarily prove who was sitting behind the keyboard.
Context Can Supply the Missing Connection
Now change the facts.
Suppose an account sends messages containing information known only to a small group of people.
The account is repeatedly accessed from internet connections associated with the suspected author.
The messages discuss events in which that person was involved.
Other communications from the same account can independently be connected to that person.
The authentication case becomes considerably stronger.
That is essentially why later cases involving social-media evidence can come out differently from Vayner.
In United States v. Encarnacion-Lafontaine, for example, prosecutors presented several pieces of circumstantial evidence connecting Facebook accounts to the defendant, including IP-address evidence, access patterns, messages involving people connected to him, motive and information contained in the communications.
The Second Circuit found that evidence sufficient to support authentication.
The lesson is straightforward:
Courts can look beyond what appears on the screenshot itself.
The surrounding evidence can matter just as much.
Screenshots Can Preserve Things That Disappear
One reason screenshots have become important is that digital information can be temporary.
A social-media post can be deleted.
A message can be unsent.
A website can change.
An online advertisement can disappear.
An account can be deactivated.
A profile photograph can be replaced.
A price can change.
A comment can be edited.
A screenshot can freeze what someone saw before the original changes.
That can make the screenshot extremely valuable.
Suppose a company publishes a statement on its website and removes it the following morning.
Someone who captured the page may possess one of the few remaining records of what the site displayed.
But the disappearance of the original can also make authentication more difficult.
The court may have to rely on testimony, surrounding records, archived copies or other evidence to determine whether the screenshot accurately represents the former page.
A Screenshot Is Not Necessarily the Whole Conversation
There is another problem.
Screenshots have edges.
Imagine a long text conversation.
One person sends twenty messages.
The other sends twenty more.
Someone captures only three.
Those three messages might be genuine.
They might also create a completely different impression when separated from everything surrounding them.
The screenshot itself has not necessarily been altered.
The context has been removed.
This distinction is especially important when a message appears to contain an admission, threat, agreement or accusation.
What was said immediately before it?
What came afterward?
Was the message responding to another statement?
Was sarcasm involved?
Did the parties subsequently clarify what they meant?
A screenshot can accurately capture part of a conversation while still presenting an incomplete account of the conversation as a whole.
Cropping Is Not the Same as Fabrication
People often crop screenshots for perfectly ordinary reasons.
A screenshot may contain a notification unrelated to the conversation.
It may expose someone's telephone number.
It may show private information from another application.
It may include large amounts of empty space.
Cropping those portions does not necessarily make the remaining image false.
But cropping can matter when the removed material changes the meaning or makes it harder to determine where the image came from.
A cropped screenshot might omit the account name.
It might remove the date.
It might eliminate the messages immediately preceding the important statement.
It might conceal signs that the screenshot came from a repost rather than the original account.
For that reason, an uncropped original screenshot can sometimes be substantially more useful than a tightly edited version.
Editing Technology Makes the Question Harder
A screenshot is ultimately an image file.
Image files can be edited.
Text can be changed.
Names can be replaced.
Dates can be modified.
Messages can be moved.
Elements from different images can be combined.
And increasingly sophisticated image-generation and editing tools make fabricated digital material easier to create.
That does not mean courts should assume every screenshot is fake.
Traditional evidence has always been capable of manipulation.
Paper documents can be forged.
Photographs can be altered.
Signatures can be copied.
Recordings can be edited.
Evidence law does not ordinarily begin with the assumption that every item is fraudulent.
Instead, authentication asks whether there is sufficient evidence supporting the claim that the item is what its proponent says it is.
The increasing ease of digital manipulation simply makes the surrounding evidence more important.
The Original Device Can Tell a Larger Story
A screenshot by itself may contain relatively little information.
The device from which it came can contain much more.
The original phone may still contain the conversation.
Other messages may establish context.
Account information may identify the participants.
Timestamps may help establish chronology.
Other records may corroborate the communication.
In litigation and criminal investigations, this can create a substantial difference between someone who possesses only a screenshot and someone who possesses the underlying digital records.
The screenshot is the visible artifact.
The underlying data may provide the foundation for explaining it.
Records From the Platform Can Matter Too
Sometimes the strongest evidence does not come from the screenshot at all.
It comes from the company operating the service.
In United States v. Farrad, litigation over Facebook photographs included records supplied by Facebook and a certification from an authorized records custodian concerning records maintained by Facebook's automated systems. The case illustrates how platform records can provide evidence beyond a simple image captured from a screen.
Those records may answer questions a screenshot cannot.
Was the material actually associated with the account?
When was it transmitted or uploaded?
What other account records exist?
The availability of such information depends heavily on the service, the circumstances and applicable legal procedures.
But it demonstrates an important point:
The screenshot and the underlying electronic record are not necessarily the same evidence.
A Screenshot Can Be Authentic and Still Not Prove Who Wrote the Message
Consider a screenshot that unquestionably came from a particular social-media account.
That resolves one issue.
It may not resolve authorship.
More than one person might have access to an account.
A phone might be shared.
Someone might know another person's password.
An account might have been compromised.
An employee might post through a company's account.
A screenshot can therefore prove that particular words appeared through an account without conclusively proving who physically typed them.
Courts can consider other evidence to make that connection.
The language of the message may matter.
Information known to the writer may matter.
The timing may matter.
Witness testimony may matter.
Device records may matter.
Subsequent conduct may matter.
Evidence frequently becomes persuasive because multiple facts point in the same direction.
Authenticity Is Only the First Question
Even an authentic screenshot is not automatically admissible.
The Federal Rules of Evidence expressly recognize that satisfying authentication requirements does not eliminate other potential evidentiary problems, such as hearsay.
A screenshot may be authentic but irrelevant.
It may contain statements subject to hearsay rules.
Its usefulness may be substantially outweighed by other concerns under applicable evidence rules.
It may require additional context.
There may be disputes over whether it fairly represents the underlying conversation.
Authentication simply answers one foundational question:
Is there enough evidence for a factfinder to conclude that this item is what the person offering it claims it is?
It does not automatically answer every question about what the evidence proves.
Screenshots Can Also Protect the Person Who Took Them
Screenshots are often discussed as evidence used against someone.
They can just as easily protect someone.
A tenant can preserve a landlord's message.
An employee can preserve workplace communications.
A consumer can capture the terms of an offer before they change.
A business can document a customer's communication.
A victim can preserve threatening messages before they disappear.
Someone accused of misconduct can preserve an exchange showing what was actually said.
A screenshot is simply a method of preserving information.
Which side it helps depends on what the information shows.
Taking the Screenshot Is Only the Beginning
Imagine two people present competing screenshots of the same supposed conversation.
In one image, a message appears.
In the other, it does not.
Now the court has a real evidentiary problem.
It may need to look beyond both screenshots.
Is the conversation still on either phone?
Are there backups?
Does another participant have a copy?
Do platform records exist?
Were the screenshots taken at different times?
Can a witness explain how each image was created?
Does one image contain signs of editing?
Are there surrounding messages?
What once appeared to be a simple picture of a screen has become an investigation into the history of the information.
The Best Evidence Often Has a History
Digital evidence becomes stronger when its history can be explained.
Someone can identify where it came from.
The original file has been preserved.
The underlying conversation still exists.
The date and circumstances of capture are known.
Other records corroborate what it shows.
The people involved can explain the communication.
That does not mean evidence lacking those features is automatically unusable.
Rule 901 does not prescribe one universal method of authentication. It provides multiple examples and leaves room for authentication appropriate to the circumstances.
That flexibility is necessary because digital evidence takes countless forms.
The Screenshot Changed Evidence Because Everyone Became a Documentarian
There was once a practical limit on how easily ordinary people could preserve communications.
Telephone conversations disappeared unless they were recorded.
Something displayed on a computer might vanish when the page changed.
A sign could be removed.
A message could be deleted.
The screenshot changed that.
Almost anyone carrying a phone can now preserve exactly what appears on a screen in seconds.
That has turned millions of ordinary people into potential collectors of evidence.
The technology is simple.
The legal questions are not.
A screenshot can preserve a threat, an agreement, an admission, an advertisement, a photograph, a transaction or an entire conversation.
But when that screenshot reaches a courtroom, the important question is rarely just what appears in the picture.
The court may also need to know where it came from, who created the underlying content, whether the image accurately preserves it and what evidence connects it to the people involved.
Because in court, “I have a screenshot” and “I can prove what this screenshot represents” are two very different things.