Comparison
Screenshots vs. a Forensic Collection
Both show a text message. Only one can be authenticated, and only one survives a completeness objection.
| What matters | A screenshot | A forensic collection |
|---|---|---|
| Timestamps | Only what the screen displayed, often a date header and nothing more | Exact send and receive times on every message |
| Who sent it | The contact name saved on that phone | The phone number behind the name, with device identifiers |
| Completeness | Whatever fit on the screen | The whole thread, with gaps reported where messages were deleted |
| Attachments | Flattened into the picture, or cropped out | Photos, videos and voicemail collected as separate files |
| Alteration | Trivial to crop, reorder or edit before sending | A SHA-256 hash recorded at collection and verifiable later |
| What opposing counsel argues | That it is incomplete, altered, or from an unknown number | That they disagree with what the messages say |
| Court format | An image pasted into an exhibit | A PDF in message-bubble format, plus Excel or RSMF for production |
| Effort | Minutes per conversation, hours for a long thread | About an hour for the whole phone |
What a screenshot actually proves
A screenshot proves that, at the moment it was taken, a screen displayed those words. It does not prove who sent them, when they were sent, or what came before and after. Everything a court needs in order to admit the message sits in data the screenshot does not capture.
That is not a technicality. It is the difference between an exhibit that goes in and one that becomes an argument.
The two objections a screenshot invites
Authentication. Federal Rule of Evidence 901(a) requires "evidence sufficient to support a finding that the item is what the proponent claims it is." California's Evidence Code § 1401 requires authentication before a writing is received in evidence. A screenshot shows a contact name, and a contact name is whatever the phone's owner typed into it. Courts have repeatedly held that associating a number with a person takes more than the label on the screen.
Completeness. FRE 106 lets the other side require that the rest of a writing be introduced at the same time, if fairness demands it. A thread cropped to the three messages that help you is exactly what that rule exists for. Once opposing counsel establishes that you chose which parts to show, the exhibit stops being evidence and starts being a credibility problem.
What changes with a collection
A forensic collection reads the messages out of the phone's own database rather than off its screen. The send and receive times come from the record, not the display. The sender is a phone number, not a nickname. The thread arrives whole, and where messages were deleted the collection reports the gap instead of quietly closing it.
The copy is hashed at the moment it is made, so the version you produce in six months can be shown to be the version that came off the phone. Every collection carries an audit log and chain-of-custody documentation. Where a matter needs more, Hearsay provides a signed affidavit describing the process, or expert testimony.
Under FRE 902(13) and 902(14), a record certified by a qualified person as having been produced by a process of digital identification can be self-authenticating, with advance notice to the other side. A hash-verified extraction plus a certification is the structure those rules contemplate.
When a screenshot is still fine
Screenshots are fine when nobody is going to contest the message. An undisputed scheduling text, something the other side has already admitted, a demonstrative that summarizes rather than proves. If the message matters enough that the other side has a reason to attack it, it matters enough to collect properly.
How a collection actually works
The client connects their own phone to their own computer and runs the Hearsay extractor. The phone never leaves them and nobody mails a device anywhere. iPhone from iOS 8 and Android from Android 10 are supported, on Windows 7 or later and macOS 10.14 or later. A typical collection takes about an hour to an hour and a half, and the client chooses which conversations are shared before anything transfers.
You get back a PDF per conversation in message-bubble format, searchable, with full timestamps and sender identifiers, plus Excel and RSMF for production and a metadata report.
Frequently asked questions
Are screenshots of text messages admissible in court?
Sometimes. Nothing bars a screenshot as a category, and an uncontested one is often admitted. The problem is that a screenshot gives you very little to authenticate with, so it is vulnerable when the other side objects. Courts have excluded message evidence where the only foundation was that the number appeared to belong to someone.
Does a screenshot count as an original?
California's Evidence Code §§ 1552 and 1553 give a presumption that a printed representation of computer data is an accurate representation of that data. That presumption helps, but it addresses the accuracy of the printout, not whether the person you say wrote the message actually wrote it.
Can a forensic collection recover deleted messages?
It reports gap artifacts where messages were deleted and can capture messages still in the phone's Recently Deleted state. Messages that have been overwritten generally require a full-device examination, and even then recovery is not guaranteed.
Does the client have to hand over their whole phone?
No. The collection runs on their own computer, they keep the device, and only the conversations they select are shared.
