DIGITAL EVIDENCE
Are screenshots evidence? How to preserve digital evidence
Chats, emails and posts are the main evidence of scams, threats and fraud. Learn why screenshots are easy to challenge and how forensic preservation keeps the evidence standing.
IN 30 SECONDS
- A screenshot alone proves neither date, source nor integrity.
- Hashing, metadata and chain of custody make evidence far stronger.
- Notarial records and forensic preservation can be used together.
- Don't delete or edit anything: preserve before any confrontation.
WhatsApp chats, emails, posts and web pages are increasingly the main evidence of scams, threats, defamation and fraud. But how that evidence is kept makes all the difference once the case reaches court.
The problem with screenshots
A screenshot may be accepted, but it is easy to challenge: on its own it proves neither the date, nor the source, nor that the content was not altered. All the other side has to do is question its authenticity for the evidence to lose weight.
What forensic preservation adds
- Integrity
Each file gets a hash, a kind of mathematical fingerprint that changes if any detail is altered. - Source
A record of the URL, phone number, email, date and time each item was collected. - Context
Complete chats and metadata, instead of crops that lose their meaning. - Chain of custody
A record of who collected it, when, how and where the evidence was stored. - Technical report
A clear document that explains the method and can be used by lawyers and experts.
| Your own screenshots | Forensic preservation |
|---|---|
| No way to prove nothing was altered | A hash recorded for every file |
| No proven date, time or source | Date, time, URL and source recorded |
| Crops that lose the context | Complete chats, with metadata |
| No one knows where the evidence has been | Documented chain of custody |
What about a notarial record?
In Brazil, an “ata notarial” is drawn up at a notary office and carries public faith: the notary describes what they saw. Forensic preservation complements it with technical collection, hashing, metadata and a report. In many cases both are used together.
What to do now
- Delete nothing
Even offensive or embarrassing messages are part of the evidence. - Don’t alter the files
Avoid editing, cropping or re-sending the original images. - Keep the device
If possible, preserve the phone or computer where the chats are. - Write down the context
Who the people are, when things happened and what has been done so far. - Get technical preservation
The sooner collection happens, the lower the risk of the evidence disappearing.
Evidence that disappears doesn’t come back
Posts get deleted, profiles vanish and disappearing messages expire. Preservation should come before any confrontation or formal notice.
Quick checklist
- Nothing deleted or edited
- Device preserved
- Context written down (people, dates, facts)
- Technical collection with hashing and chain of custody
- Lawyer and specialist aligned
HOW CiBER DETETiVE CAN HELP
Digital Evidence Preservation
Forensic collection of chats, emails, websites and devices, with hashing, chain of custody and a technical report.
For information only. This does not replace a professional review of your specific case. Legal references reflect the rules in force on the publication date (Brazilian law).