Chat and messaging

Conversations are now the most frequently filed evidence in civil proceedings and in many criminal ones. They are also, almost always, filed in the worst possible form: a photograph of a screen.

Why a screenshot is fragile

A screenshot is an image. It contains pixels that, read by a human being, look like a conversation, and nothing else. It does not contain the internal identifiers the messaging application assigns to each message, nor the timestamps the program keeps separately from the text displayed, nor anything at all tying the image to an account.

Producing a fake one requires no particular skill: applications designed precisely to generate convincing false conversations have existed for years, and failing that an image editor is enough. The point is not that screenshots are usually fake — in the great majority of cases they are genuine — but that they contain nothing that allows the two cases to be told apart.

Procedurally, under Italian law mechanical and digital reproductions constitute full proof of the facts they represent unless the party against whom they are produced disavows their conformity (art. 2712 of the Civil Code). That is exactly what happens: the other side disavows, and the party who filed the screenshot must then establish its genuineness by other means. If nothing else was preserved, there are no other means.

What can be done, from either side

If you have to produce a conversation

The conversation must be acquired from the device, not photographed from the screen. Depending on the handset and operating system this means an extraction that recovers the messaging application's archive or, where that is not possible, an assisted acquisition documenting the operation, the device identifiers, the linked account and the system clock, closed with an integrity check on the result.

The result differs from a screenshot in one decisive respect: it is anchored to an identified device. Anyone challenging it has to challenge that device, not an image with no parentage.

If you have to challenge one

The first step is to ask for the original. In most cases a request to produce the device or the archive the image was taken from settles the matter by itself: either the original exists and can be verified, or it no longer does and what remains is a photograph without corroboration.

Something can still be examined on the image itself: dimensions and proportions against what that handset model would produce, traces of recompression and overlay, internal consistency of the times displayed, and whether the interface shown matches the versions of the application that actually existed on that date. None of these is conclusive on its own; together they may indicate an inconsistency — or, equally useful to the party producing the evidence, full consistency.

A point that causes confusion: encryption

WhatsApp and Signal encrypt messages between devices, and this is often cited as a guarantee of authenticity. It is not. Encryption protects the message in transit, preventing anyone in between from reading or altering it; it says nothing about the copy that arrived on the handset, which from that moment is data like any other, modifiable by whoever has access to the device. It protects the channel; it does not sign the content.

The converse follows: no request to the service provider can return the text of the messages, because the provider does not hold it. What may exist there is account information and traffic data, which is a different thing and follows different rules.

Telegram, SMS, and the rest

Telegram holds ordinary conversations on its own servers, though not secret chats: what is theoretically obtainable therefore changes, as does the fact that a copy may be recoverable from another device linked to the same account. SMS live on the handset and with the carrier, whose traffic-data retention periods are set by statute and are far shorter than most people assume. Each system has its own physics, and the questions to put to it differ accordingly.

Further reading: do WhatsApp screenshots stand up in court? →
Further reading: recovering deleted messages — what is actually possible →