Best evidence rule and digital evidence: when a copy counts as the original

Updated on September 12, 2026

Federal Rule of Evidence 1002 is short: to prove the content of a writing, recording or photograph, you need the original. Lawyers call it the best evidence rule, or the original document rule, and for a signed contract it works as intended. The trouble starts when the content never existed on paper. A Slack thread or a WhatsApp conversation has no original sitting in a drawer: what you bring to court is a screenshot, an export or a download, and your opponent will ask whether that output faithfully reflects the source.

So when does a copy count, and what do you have to show? Not “the original”. For born-digital content the rule is satisfied when you can demonstrate the integrity of the copy from the moment it was acquired: a hash value proving it has not changed, a certified timestamp proving when it came into existence, a chain of custody proving who handled it.

The best evidence rule refers to Federal Rules of Evidence 1001 through 1004, which require the original writing, recording or photograph when a party seeks to prove its content, unless the rules or a federal statute provide otherwise (FRE 1002). The rule applies only when the content of the item is at issue: a witness who saw a payment can describe it without producing the receipt, but a party who wants to prove what a message said must produce the message. For electronically stored information, FRE 1001(d) defines “original” as “any printout, or other output readable by sight, if it accurately reflects the information” (FRE 1001). The definition does not require a specific medium or a specific file: it requires accuracy. A screenshot, a PDF export or a printed email can each qualify as an original of the underlying data, provided the proponent can show that the output reflects the stored information without additions, omissions or alterations.

What the best evidence rule requires (FRE 1001-1004)

The best evidence rule under the Federal Rules of Evidence has three parts: the definitions (FRE 1001), the requirement of the original with its duplicate exception (FRE 1002 and 1003), and the situations where neither is needed (FRE 1004). Together they decide which form of a document you must produce when its content is in dispute.

The purpose of the best evidence rule has not changed since the common law. The Advisory Committee’s note to Rule 1001 describes a rule that afforded “substantial guarantees against inaccuracies and fraud by its insistence upon production of original documents” (FRE 1001 notes). A copy can be edited, a transcription can drop a word, a memory can invert a figure, and the original is the one form that carries none of those risks. For a digital copy the risks are the same, which is why the rest of the rule turns on the word “accurately”.

Original, duplicate and output readable by sight (FRE 1001(d)-(e))

An original of electronically stored information is any output readable by sight that accurately reflects the data; a duplicate is any counterpart produced by a process that accurately reproduces the original (FRE 1001). The two definitions overlap for digital content, and the word they share decides cases: “accurately”. A screenshot sits in the last row of the table below: the best evidence rule does not exclude it, but the burden of showing accuracy is yours.

When the original is required (FRE 1002) and when a duplicate is enough (FRE 1003)

The original is required whenever you offer a writing, recording or photograph to prove its content, and a duplicate takes its place unless the opposing party raises a genuine question about the original’s authenticity or admitting the duplicate would be unfair.

Under FRE 1003, a duplicate is admissible to the same extent as the original unless a genuine question is raised about the original’s authenticity or the circumstances make it unfair to admit the duplicate (FRE 1003). FRE 1001(e) defines a duplicate as “a counterpart produced by a mechanical, photographic, chemical, electronic, or other equivalent process or technique that accurately reproduces the original” (FRE 1001). The Advisory Committee Notes explain the logic: where no genuine issue exists as to authenticity and no other reason exists for requiring the original, the duplicate comes in. The House Judiciary Committee added that courts should be liberal in recognizing when a genuine question has been raised (FRE 1003 notes). For digital evidence this creates an asymmetry. A duplicate is presumptively fine, but the threshold for challenging it is low, and a challenge that is not answered with something verifiable pushes the proponent back to FRE 1002 and to an original that, for born-digital content, may not exist in any usable form.

The exceptions: original lost, destroyed or unobtainable (FRE 1004)

FRE 1004 lets you prove content with other evidence when all originals are lost or destroyed through no bad faith of your own, when no judicial process can reach one, when the opposing party controls it and fails to produce it after notice, or when the writing is not closely related to a controlling issue (FRE 1004). In digital disputes these best evidence rule exceptions come up constantly, because accounts are deleted and retention policies purge messages. The exception admits secondary evidence without making it credible, and a copy sealed before the original vanished is worth far more than a witness’s memory of a deleted post, which is why preserving digital evidence early is the practical companion of FRE 1004.

Why “is this the original?” is the wrong question for born-digital content

The best evidence rule applies to digital evidence through FRE 1001(d): any output that accurately reflects the stored information is treated as an original. The decisive question for born-digital content is therefore not which file is “the” original but whether you can demonstrate that the copy you produce is accurate and unaltered.

Unlike a paper contract, a born-digital file has no single physical original: a screenshot is an output, an exported chat is a transformation of a database, a download is a copy generated on request by a server. What a court needs under FRE 1001(d) is an output that “accurately reflects the information”, and the difficulty with screenshots is proving that accuracy with nothing beyond the image itself. In Edwards v. Junior State of America Foundation (E.D. Tex. 2021), the plaintiff offered screenshots of Facebook messages; the court found they were not an output that accurately reflected the information, because they lacked the metadata and context of the native file, and the account had since been deleted. The screenshots were excluded and the jury received adverse instructions, with the court observing that only native files could ensure authenticity (Pagefreezer on Edwards). Screenshots are not banned by that decision; an image without verifiable provenance simply carries no proof of its own accuracy.

A screenshot is an output, not the original: what happens in court

In court a screenshot is an output readable by sight under FRE 1001(d): it qualifies as an original only if you can show it accurately reflects the underlying data. A best evidence objection says that you have offered neither the electronic record nor an accurate output of it, and Edwards shows what happens when the answer is weak: nothing tied the screenshots to the source and the account was gone, so the court could not test accuracy and sanctioned the party (Pagefreezer on Edwards). It is one of several objections a court can raise against screenshot evidence. Organizations use TrueScreen to capture screenshots, exported chats and downloaded files with a forensic methodology, so that a best evidence objection is answered with a verifiable hash rather than with the witness’s memory.

Exported chats and downloaded files: when the duplicate’s accuracy is challenged

Exports and downloads are duplicates under FRE 1001(e) only if the process that produced them accurately reproduces the original, and that is what your opponent will test. Screenshots of text messages can be used in court on the same condition: they must reflect the conversation accurately, including the context a cropped capture leaves out.

The examples share one pattern under the best evidence rule: nothing in the last column restores an original you never had, and each entry replaces it with a demonstrable fact about the copy.

What the case law says: Lorraine v. Markel, United States v. Bennett, Edwards

Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (D. Md. 2007), is the map. Magistrate Judge Paul W. Grimm set out five hurdles for electronically stored information: relevance (Rules 401-403), authentication (901-902), hearsay (801-807), the best evidence or original writing rule (1001-1008) and unfair prejudice (403), and he listed hash values and metadata analysis among the accepted authentication methods (Lorraine v. Markel).

United States v. Bennett, 363 F.3d 947 (9th Cir. 2004), is the cautionary tale. An officer testified that a boat’s GPS display showed a route from Mexico; nobody produced the device or a printout. The Ninth Circuit reversed the importation conviction because the testimony proved the content of the GPS data in violation of FRE 1002 (United States v. Bennett). Edwards (E.D. Tex. 2021) applies the same logic to screenshots: an output without metadata, context or native file failed FRE 1001(d) (Pagefreezer on Edwards).

From original to integrity: what the proponent of a digital copy must show

To satisfy the best evidence rule with a digital copy, you must be able to show that the copy is identical to what was acquired (the hash value), when it came into existence (the certified timestamp) and who has handled it since (the chain of custody).

Hash values: proving the copy is identical

A hash value is the technical proof that a duplicate “accurately reproduces the original” under FRE 1001(e): if the hash of the file produced in court matches the hash computed at acquisition, the two files are identical bit for bit.

A cryptographic hash is a fixed-length fingerprint of a file: if the hash computed in court matches the hash computed at capture, the copy is bit-for-bit identical to what was acquired. SHA-256, the algorithm most often used for digital evidence, is specified by the National Institute of Standards and Technology in FIPS 180-4, the Secure Hash Standard (NIST FIPS 180-4). It produces a 256-bit value, which means 2^256 possible outputs, and changing a single bit of the input produces a completely different hash. The comparison is deterministic and requires no trust in the person presenting the file: anyone with the file and a standard tool can recompute the value. This is why hash values appear both in Lorraine v. Markel among the accepted methods for authenticating electronically stored information (Lorraine v. Markel) and in the committee note to FRE 902(14), which identifies hashing as the typical “process of digital identification” for certified copies of electronic data (FRE 902).

The hash must be computed at acquisition: a hash of an edited file attests the integrity of the edited file. Proving that a screenshot is real therefore starts before it leaves the device (how to certify a screenshot; see also SHA-256 hash and qualified timestamp).

Certified timestamps and chain of custody: proving when the copy came into existence

A hash proves what the copy is; a certified timestamp proves when that copy existed; a chain of custody proves who handled it in between. Timing matters under FRE 1004(a), where the court will want to know that your copy predates the loss of the original, and under FRE 1003, where a copy provably created before the dispute arose is much harder to attack (see chain of custody in US proceedings).

The European Union set the reference standard in the eIDAS Regulation: under Article 41, a qualified electronic timestamp enjoys a presumption of the accuracy of the date and time it indicates and of the integrity of the data bound to it (Regulation (EU) 910/2014). US courts are not bound by eIDAS, but those are the two facts a certified timestamp is expected to prove anywhere. Proving when a copy came into existence is the role of a certified timestamp: TrueScreen, the Data Authenticity Platform, applies it at capture and records it in the certification report.

How the best evidence rule connects to FRE 901 and FRE 902(13)-(14)

Authentication and the best evidence rule answer different questions: FRE 901 asks whether the item is what you claim it is; FRE 1002 asks which form of the item you must produce to prove its content. The two rules converge on the same evidence. FRE 902(13) makes certified records of an accurate electronic process self-authenticating, and FRE 902(14) does the same for “data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification”; the committee note names hash values as the typical method (FRE 902). Both took effect on December 1, 2017, and a certification that satisfies 902(14) authenticates the copy under Rule 901 and documents the accuracy that Rules 1001(e) and 1003 require.

How is a digital copy certified with evidentiary value?

TrueScreen, the Data Authenticity Platform, certifies a digital copy at the moment of acquisition by binding the file to its cryptographic hash, a certified timestamp and a documented chain of custody, so the proponent can show the duplicate accurately reflects the source under FRE 1001(e) and 1003. Certification does not turn the copy into an “original” in the paper sense; it makes the facts a court checks independently verifiable.

A digital copy acquires evidentiary value when three facts can be verified independently: what was captured (the hash), when it was captured (a certified timestamp) and who handled it since (the chain of custody). TrueScreen applies a patented forensic methodology aligned with ISO/IEC 27037, the international standard for the identification, collection, acquisition and preservation of digital evidence: content is acquired in a controlled environment, the acquired data is verified (device integrity, metadata such as time, location and network identifiers, matching hashes across the package), and the result is certified with an official digital seal and official timestamp, internationally recognized, integrated by TrueScreen. The benchmark for what such a timestamp proves is Article 41 of the eIDAS Regulation (EU) 910/2014, under which a qualified electronic timestamp carries a presumption of accuracy of date and time and of integrity of the bound data (Regulation (EU) 910/2014). The output is a report, in PDF and JSON, that a third party can read and verify without relying on the platform.

Take an HR manager who must produce an employee’s Slack and WhatsApp messages in a federal proceeding. A screenshot from a colleague’s phone is an output under FRE 1001(d) whose accuracy will be contested under FRE 1003: who took it, when, was anything cropped. With TrueScreen the acquisition happens in real time, in a controlled environment where neither the operator nor any software can alter what is being captured, and it produces the file, its SHA-256 hash, the certified timestamp and the technical report in one package. Opposing counsel can recompute the hash on the file produced in discovery and confirm it matches the one recorded at acquisition.

Two distinctions matter. Real-time acquisition certifies content from the moment it comes into existence; importing an existing file certifies only that it has not changed since import. And TrueScreen guarantees the how, not the what: it attests that the acquisition was genuine and the content unaltered since, not that what appeared on the screen was true. The package is a self-contained forensic copy: the opposing party or the court can re-verify hash, seal and timestamp with standard tools, without the platform and without trusting whoever handed the file over.

FAQ: the best evidence rule and digital copies

Does the best evidence rule apply to screenshots and exported chats?
+

Yes, whenever a screenshot or an export is offered to prove what a message, post or page said. Under FRE 1001(d), an output “readable by sight” counts as an original of electronically stored information only if it accurately reflects the information, and under FRE 1003 a duplicate is admissible unless a genuine question is raised about authenticity. Screenshots fail at that point when nothing supports their accuracy: in Edwards v. Junior State of America Foundation (E.D. Tex. 2021), Facebook screenshots without metadata or native files were excluded and the jury received adverse instructions. The rule is met by demonstrating integrity, with a hash computed at capture, a certified timestamp and documented custody, rather than by labeling the file “original”.

What does the best evidence rule not apply to?
+

The best evidence rule does not apply when a party proves a fact that exists independently of any document, even if a document happens to record it: a witness who watched a payment can testify to it without producing the receipt. It does not apply to physical objects that are not writings, recordings or photographs, such as a weapon or a DNA sample, and FRE 1004(d) removes it for writings “not closely related to a controlling issue”. It is also distinct from the parol evidence rule, which concerns contract interpretation. What remains is narrow but constant in digital disputes: proving the content of a message, a web page, a file or a recording.

Is a printout or PDF of an email an original under FRE 1001?
+

Yes, if it accurately reflects the stored data. FRE 1001(d) provides that, for electronically stored information, “original” means any printout or other output readable by sight that accurately reflects the information. The condition is the adverb: a PDF that drops the headers, the attachments or the server timestamps may still be admitted as a duplicate under FRE 1003, but it invites a genuine question about completeness. An email exported with full headers and attachments, with a hash computed at export, removes that question, because you can show that the file produced in court and the file acquired that day have the same fingerprint.

Can cropped screenshots be used as evidence in court?
+

Cropping is an alteration, and alteration is the textbook “genuine question” that allows a court to refuse a duplicate under FRE 1003. A cropped screenshot can still be admitted if you explain the crop and the opposing party cannot show that the omitted portion changes the meaning, but courts increasingly ask for the complete capture or the native file, as the Edwards decision in the Eastern District of Texas illustrated for Facebook messages in 2021. The safer route is to produce the full capture, with a hash computed at acquisition, and to use the cropped version only as a demonstrative aid alongside the complete one.

How do you prove that a digital copy is identical to the original?
+

By comparing hash values. A cryptographic hash such as SHA-256, specified by NIST in FIPS 180-4, is a fixed-length fingerprint of a file: change one bit and the fingerprint changes entirely, across 2^256 possible values. If the hash computed at acquisition matches the hash recomputed on the file produced in court, the copy is bit-for-bit identical. With TrueScreen, the Data Authenticity Platform, the SHA-256 hash is computed at acquisition, bound to a certified timestamp and recorded in the certification report, so the opposing party or the court’s expert can repeat the comparison with standard tools, without relying on anyone’s testimony.

What is the difference between the best evidence rule and authentication under FRE 901?
+

They answer different questions. Authentication under FRE 901 asks whether the item is what the proponent claims: is this really a message from that account? The best evidence rule under FRE 1002 asks which form of the item must be produced to prove its content: the original, a duplicate or secondary evidence. A screenshot can be authenticated by a witness and still fail the best evidence rule if its accuracy as a copy is genuinely disputed. Lorraine v. Markel (D. Md. 2007) lists both as separate hurdles for electronically stored information. A forensic acquisition addresses both: the documented process supports authentication, and the hash supports the duplicate’s accuracy under FRE 1003.

What are the exceptions to the best evidence rule (FRE 1004)?
+

FRE 1004 lifts the best evidence rule in four situations: all originals are lost or destroyed, and not by the proponent acting in bad faith; no original can be obtained by any available judicial process; the opposing party had control of the original, was put on notice that it would be a subject of proof and failed to produce it; or the writing, recording or photograph is not closely related to a controlling issue. For digital evidence the first exception is the most common, because accounts and messages are deleted routinely. It opens the door to secondary evidence but does not make it credible: a copy hashed and timestamped before the loss remains far stronger than recollection.

Does the best evidence rule apply to video and audio recordings?
+

Yes. FRE 1001(b) defines a recording as “letters, words, numbers, or their equivalent recorded in any manner”, and FRE 1002 requires the original recording to prove its content. A witness may describe an event seen with their own eyes, but a witness who describes what a recording shows is proving its content and must produce it. United States v. Bennett (9th Cir. 2004) applied this logic to a GPS display: an officer’s testimony about the route it showed led to a reversed conviction because neither the device nor a printout was produced. A compressed copy shared through a messaging app is a duplicate whose accuracy can be challenged; the native file with its hash closes that question.