When a screenshot is disputed.

What exactly is being disputed?

An instruction that asks whether a screenshot is “real” can conceal several different questions. The concern may be the wording of a message, the date shown, the identity of a participant or the omission of the surrounding conversation.

For a solicitor considering independent examination, a useful first step is to identify the precise claim and the material available to test it. DFR can then discuss whether an image review, a review of a computer forensic image or existing records, or an authorised mobile device acquisition is appropriate.

Three questions that should be kept distinct.

Preserving a file unchanged from receipt is valuable, but does not by itself establish the truth of its contents. A matching hash can support a file integrity check; it cannot establish that a depicted conversation genuinely occurred.

What to identify before sending material.

For an initial DFR enquiry, describe the screenshot or message, the issue in dispute and whether the original image file, source device, an existing extraction or a computer forensic image is available. Explain who supplied each item and whether it has already been edited or converted.

Keep the supplied files in their existing form. If you need an annotated or redacted working copy, retain the unaltered supplied version separately and record the purpose of the copy. Contact DFR before changing device settings or installing software so suitable handling can be discussed.

Do not send passcodes or sensitive case files with an initial enquiry. Appropriate transfer arrangements should be agreed first.

How an examination can be scoped.

DFR may be instructed to review a disputed image, compare supplied exhibits with available source records, review a supplied computer forensic image or acquire data from a supported mobile device where authority and access are established. These are different tasks and need not all be required.

A proposed scope can specify the conversation, accounts, date range and question to be addressed. It should also identify the intended deliverable, such as a focused findings report or a broader review of relevant communications. Explore computer and digital media examination or independent mobile device acquisition.

What if the answer remains uncertain?

A single image can contain an alteration that available examination methods do not detect. Absence of a detected alteration therefore does not prove authenticity. An opinion should explain the tests performed and the limits of the available material.

Mobile examination also has limits. Acquiring data and interpreting it are distinct stages. The available device data may not resolve every question and records can require interpretation in the context of the relevant software. DFR will explain any material limitations rather than promise a definitive outcome.

An illustrative instruction.

“Please assess whether the supplied message exhibit is consistent with available source records for the specified conversation and date range and identify any material differences or limitations.”

This is an example of a focused question, not a description of a DFR case or a promised result. The appropriate wording depends on the dispute and material available.

Discuss the question before the method.

DFR accepts enquiries from legal advisers and authorised private clients. Describe the dispute, the evidence available and any deadline. The examination must follow the evidence, whether the findings support a concern, qualify it or leave it unresolved.

Explore family law forensic services or discuss an instruction.