By corroborating it against the source system, not by looking at the image. A screenshot is a photograph of a screen state anyone can fabricate in a browser's developer tools in seconds — authentication means matching it to the underlying account, database, or server records.
Why a screenshot proves almost nothing by itself
A screenshot is an image of what a screen displayed — or of what someone arranged a screen to display. Text messages can be fabricated with a fake-conversation app; a web page can be edited live in the browser's developer tools and captured in seconds; a social-media post can be composed, screenshotted, and deleted. None of these forgeries is detectable from the image alone, because the image is genuine — it accurately depicts a screen that was genuinely showing fabricated content.
Courts know this. Under Rule 901, the proponent must produce evidence sufficient to support a finding that the item is what they claim, and for a contested screenshot that showing rarely comes from the picture itself.
What actually authenticates it
The reliable path is corroboration against the source system:
- The account itself. A forensic collection from the platform — the message database on the device, the post retrieved through the platform's records, the email pulled from the server — either matches the screenshot or it does not.
- The counterparty's copy. A conversation exists on at least two devices. If the other participant's device shows the same thread, the screenshot is corroborated; if it shows a different thread, something important just happened.
- Metadata and logs. Metadata on the screenshot file shows when and on what device the capture was made — useful, though it authenticates the capture, not the content. Server logs, delivery records, and platform data reach the content.
- Testimony with knowledge. A witness who participated in the conversation can authenticate under Rule 901(b)(1) — subject to cross-examination about memory and motive, which is why the technical corroboration matters even when a witness is available.
When the screenshot is the only evidence
Sometimes the source is gone — the account deleted, the platform unresponsive, the device wiped. Then the analysis inverts: an examiner looks for internal inconsistencies in the proffered image (font rendering, interface elements that do not match the app version and date claimed, impossible timestamps) and at the circumstances of capture. That analysis can support or undermine the exhibit, but it is opinion territory, and the examiner offering it should expect admissibility scrutiny of their method.
What to do now
If a screenshot matters to your case, treat it as a lead rather than an exhibit: preserve the device or account it came from before the source disappears, and collect forensically. If the other side's screenshot looks wrong, demand the underlying data — the gap between an image and its source system is where fabrications die.
From our work
Need this looked at properly?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.