“That’s Fake”: How to Prove Digital Evidence Hasn’t Been Altered

You hand over a screenshot and the other side says, “That’s fake. Anyone can edit a screenshot.” It’s one of the most common objections in family court, and it can rattle you even when every pixel is real. If you’re trying to figure out how to prove digital evidence hasn’t been altered, the honest answer is that no single trick does it. You build proof in layers.

This guide shows each layer the manual way, using free tools already on your phone and computer: preserving originals, reading metadata, calculating hash values, keeping a capture log, and finding corroboration. Then it shows a faster way to handle the busywork. Rules about authenticating evidence vary by state and by judge, so treat this as how it generally works and check your local rules.

What does it take to prove digital evidence hasn’t been altered?

It means showing two things: that the file is the original or a faithful copy, and that it hasn’t changed since you captured it. Courts generally call the broader question authentication, meaning the evidence is what you say it is. The narrower question, whether a file has changed, is often called digital evidence integrity.

In many courts the first step is modest. Someone with personal knowledge, often you, testifies about what the item is and how it was captured. If the other side challenges it, the judge weighs the whole picture. Each layer below adds weight, and each one has limits.

Step 1: How do you preserve the original file?

Leave the original exactly as it is and do all your marking up on a copy. Most “altered evidence” arguments start with a cropped, highlighted or re-saved image.

• Don’t edit the original. No cropping, arrows, highlights, filters or “enhance” buttons. Duplicate the file and annotate the duplicate.
• Keep the source. A screenshot is a picture of a conversation that still lives on your phone. Keep the thread, and keep the phone. If you replace your phone, store the old one safely.
• Move files without compressing them. Messaging and social media apps often shrink photos and strip details. Use a cable, or a backup or transfer method set to keep full-size originals.
• Export whole conversations. A complete thread export is much harder to dispute than a handful of screenshots.

Step 2: How do you record a file’s metadata?

Metadata is the information stored with a file, such as when it was created and by what device. Write it down when you first save the file, before anything can change it.

• iPhone photos: open the photo and swipe up, or tap the info button, to see the date, time and often the camera details.
• Android photos: in most gallery apps, swipe up on the photo or open the menu and choose Details.
• Windows: right-click the file, choose Properties, then the Details tab.
• Mac: select the file in Finder and choose Get Info, or open an image in Preview and use Tools, then Show Inspector.

Metadata isn’t proof by itself, because it can be edited and many apps remove it. It’s one more consistent detail in your record.

Step 3: How do you calculate a hash value yourself?

A hash value is a fingerprint calculated from a file’s exact contents. SHA-256 is a common standard. Change one pixel and the fingerprint changes completely, so a matching hash later shows the file hasn’t changed since you recorded it.

Both Windows and Mac can calculate one for free:

Copy the long result into your log next to the file name and the date. Hash each file as soon as you save it. A hash recorded months later only proves the file hasn’t changed since then.

For more on how these fingerprints work, see our guide to SHA-256 hashes for family court evidence.

Step 4: What goes in a capture log?

A capture log is a running record of every piece of digital evidence: what it is, where it came from, when and how you saved it, and where the original is now. It turns “did you edit this?” into a question you can answer line by line.

Do this for every file, every time. That’s the part that wears people down. For forty files, hashing each one, noting its metadata and writing a log entry can easily eat an evening, and every new screenshot means doing it again.

Step 5: How do you corroborate evidence that’s challenged?

Show that other sources line up with yours. Corroboration is often what settles an authenticity dispute, because a fake would have to be consistent with everything else.

• The other person’s own copy. They have the same conversation on their device. Court procedures for requesting it vary, so ask about your options locally.
• Provider records. Carrier records usually show the dates, times and numbers of texts and calls, though generally not their content. They often require a subpoena.
• Replies and later events. A reply that responds to your message, or a pickup that changed the way the message said it would, fits only if the message was real.
• Witnesses. Someone who saw the message on your phone, or saw the event in a photo, can confirm it.
• A forensic examiner. In serious disputes, a professional can examine a device. It costs money, so talk it through with a lawyer first.

Texts raise their own questions, which our guide on how to prove a text message is real covers in detail.

The easy way: let Evidence Helper do the busywork

The manual method works, but hashing, logging and filing each item by hand is slow and easy to get inconsistent. Evidence Helper does the record-keeping as you upload.

1. Upload originals. Drag and drop, bulk-upload a folder, or use your phone’s camera. iPhone HEIC photos are normalized for viewing, and the originals are preserved untouched and hashed.
2. Add the context. Set the date each item happened, add a description, tag it, give it a priority, and map it to the issues in your case.
3. Search everything. AI-assisted text extraction reads screenshots for you to review and correct, so full-text search finds words inside images.
4. Export. One click produces an exhibit-numbered, case-captioned PDF with SHA-256 integrity hashes, generated deterministically with no AI, plus an Evidence Index and a Case Bundle zip.

Be clear about what this does and doesn’t do. It records that a file hasn’t changed since you uploaded it; your testimony and corroboration still show it was genuine to begin with. So upload as soon as you capture. Every account starts with a 14-day free trial of everything, with no credit card.

Try Evidence Helper free for 14 days14 days of everything free · no credit card

What makes digital evidence look altered?

Small, innocent choices can make honest evidence look suspicious. Avoid these, and if you’ve already done one, explain it plainly rather than hoping no one notices. Screenshots get challenged most often, so see our guide on how to authenticate a screenshot for court.

• Cropping out the name, phone number or date
• Highlighting or drawing on the only copy you have
• Showing a few messages with obvious gaps in between
• Screenshots of screenshots, or photos of a screen without explanation
• Deleting the conversation after taking screenshots
• Converting or re-saving files without keeping the original

If the other side is pressing hard on authenticity, a consultation with a licensed attorney where you live can help you understand what your court will expect.