Screenshots as criminal evidence: do they have value in a trial?

A very common question in the digital age is whether a screenshot of some threatening messages serves as evidence. The answer is not a simple yes or no: screenshots can be valid evidence, but their value depends on how they were obtained, how they are presented, and on whether their authenticity can be established.

Today, much of conflictive interaction, such as insults, threats, harassment, or fraudulent agreements, leaves a digital trace, and the screenshot is often the first impulse to preserve those communications. The problem is that screenshots are one of the most easily manipulable forms of digital evidence: with an image editor or specific apps, anyone can alter the text, add non-existent messages, or change names and dates.

The Supreme Court has established a doctrine that can be summarised as follows: screenshots are admissible documentary evidence; their evidentiary value is neither automatic nor presumed, so whoever submits one bears the burden of establishing its authenticity if the other party challenges it; when both parties acknowledge authenticity, the screenshot has full value without further verification; and when it is challenged, it needs to be complemented by some means establishing that it has not been manipulated.

There are several ways to manipulate a screenshot: direct editing of the image, the use of apps that generate fake conversations with a realistic appearance, the creation of fake accounts in another person’s name, or the partial selection of the conversation omitting the context.

There are different methods to establish authenticity, with differing strength. The most robust is the notarial record drawn up when the notary directly views the content of the original device; its evidentiary force is very high because of the notary’s public attestation, and it also preserves the content before it can be deleted. Computer forensic expertise analyses the original device, its metadata, and the app’s database. Corroboration by other evidence reinforces credibility indirectly, although it is usually insufficient on its own. And acknowledgement by the opposing party eliminates the need for technical verification.

Anyone holding relevant screenshots should act quickly, because conversations can be deleted; keep the original device without formatting it; consult their lawyer about the appropriate authentication method; and present them at the right procedural moment. If the screenshots harm the defendant, the defence may expressly challenge their authenticity at the appropriate procedural moment, since a late challenge may be interpreted as acceptance; request computer forensic expertise to detect manipulations; provide the full content of the conversation if only fragments were presented; and point out that the messages, even if authentic, allow for another interpretation.

It is worth being clear about the difference in evidentiary value between a simple screenshot and a notarial record: the former can be challenged without much technical basis, it being enough for the other party to deny the messages; the latter enjoys the notary’s public attestation and is very hard to question. When the evidence is relevant, the cost of the notarial record is more than justified by the solidity it provides.