Deepfake evidence in court: how to spot a fake and show that your evidence holds up

Deepfakes and digital evidence: the warning from digital forensics

Deepfakes have reached real cases, and authenticity now has to be demonstrated rather than assumed.

The EU AI Act defines a deep fake as “AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful” (Regulation (EU) 2024/1689, Article 3(60)). As evidence, it is that content filed as if it showed what happened. TrueScreen certifies authenticity at the source, so a file captured with it carries its own record of when and how it was captured.

ONIF, Italy’s National Digital Forensics Observatory, has put deepfakes and their detection on the program of its 10th national conference (Genoa, October 16, 2026), noting that deepfakes increasingly put the authenticity of digital evidence to the test (ONIF, September 16, 2026). Its president, Mattia Epifani, says AI and deepfakes are profoundly changing the work of investigators and technical consultants (our paraphrase from the Italian).

Fake photos, video and audio: the scenarios courts are seeing

The cases look alike: a photo that places a defendant elsewhere at the time of the offense, a swapped face in a video, deepfake audio of threats in a custody case.

In Mendones v. Cushman & Wakefield (Alameda County, No. 23CV028772), self-represented plaintiffs filed videos with a summary judgment motion. The court found that two exhibits “are products of GenAI and do not capture the actual speech and image” of the witness, and imposed terminating sanctions (order of September 9, 2025); the giveaways were an expressionless face and looping footage. In a 2020 UK custody dispute, family lawyer Byron James showed that audio of his client’s alleged threats was not a faithful recording; his advice is to always ask for the original (Legal Cheek, January 31, 2020).

Why the naked eye is no longer enough

Human judgment is not a reliable filter: listeners in the 2023 University College London study missed over one synthetic speech sample in four, and training barely helped (Mai et al., PLOS ONE); with faces, 315 participants did slightly worse than a coin toss (Nightingale and Farid, PNAS, 2022).

The liar’s dividend: when real evidence is attacked as fake

Deepfakes also help people wave away genuine evidence, the so-called liar’s dividend. In Huang v. Tesla (2023), a tentative ruling rejected Tesla’s suggestion that recorded statements by Elon Musk might be deepfakes (deepfake case law database). In Burnley v. Valentin (E.D. Va., March 18, 2026), a recording challenged as a cloned voice proved authentic (Justia). For the criminal side, see our analysis of deepfakes and digital evidence in criminal proceedings.

How digital evidence is admitted and challenged in court

A photo, video or recording usually gets into a case easily; the test comes when the other side challenges it.

How a digital recording becomes evidence

Authentication means showing that a photo, video or recording is what the party offering it claims. Courts generally admit such material when something supports the claim, leave its weight to the judge or jury, and expect more after a specific challenge. Deepfake challenges are still rare: in a Federal Judicial Center survey, only 15 of the 931 US federal trial judges who responded had encountered one (Advisory Committee on Evidence Rules, May 2026). TrueScreen documents how and when a file was captured, giving that party something concrete to show if authenticity is disputed.

In the same report, the Committee says it “does not recommend action on the proposed Rule 707 at this time” and finds a Rule 901 amendment for deepfakes “not warranted” “at least for now” (see our article on FRE 707 and AI-generated evidence).

Who has to prove that digital evidence is authentic

The burden generally falls on whoever offers the evidence, once a challenge names something concrete. The US committee’s working draft agrees: an opponent should not get an inquiry merely by claiming an item is a deepfake. When the doubt is specific, the court can ask for more. In Mendones, the judge ordered the files’ full metadata (device, lens, date) and the witnesses’ appearance. AI enhancement can sink real footage too: in State v. Puloka (Washington, 2024), an AI-enhanced version of a genuine video was excluded from a murder trial (ABA).

When filing a fake becomes misconduct or a crime

Filing fake evidence can end a case and, depending on the jurisdiction and the facts, lead to sanctions or prosecution. The May 2026 committee report mentions a defendant who pleaded guilty to obstruction of justice for fabricating audio and video evidence that led to another person’s indictment. Labeling rules will not stop forgers: since August 2, 2026, Article 50(4) of the AI Act requires deployers of AI systems that generate or manipulate deep fakes to disclose them, which a forger will ignore.

What digital forensics can verify after the fact, and where it stops

Analysis of an existing file can surface strong clues, but without the original and its history it ends in an opinion, not a demonstration.

Metadata, file structure and consistency with the device

An expert starts with the file: container, encoding, recompression traces, metadata, and whether it all fits the device that supposedly produced it. In Mendones, one exhibit’s metadata pointed to an iPhone 6, while the plaintiffs’ account required an iPhone 15 or later (NBC, November 18, 2025). For audio, a forensic voice comparison sets the recording against samples of the speaker’s real voice. All of this works best on the original, since forwarded files usually lose their metadata.

AI detection: a probability, not proof

Deepfake detection estimates how likely it is that a file was generated or manipulated with AI: it is a clue an expert has to explain, not a finding. On real-world content from 2024, open-source detectors saw their AUC drop by 50% on video, 48% on audio and 45% on images compared with earlier benchmarks (Chandra et al., Deepfake-Eval-2024, 2025). A file of unknown origin produces an opinion; a file sealed at capture produces a defensible result. TrueScreen certifies authenticity at the source and also offers deepfake and GenAI detection for content it did not acquire.

More detail in our report on falling deepfake detection accuracy.

Content Credentials (C2PA): what they show and what they do not

Content Credentials, built on the C2PA standard, are a signed manifest recording who created or edited a file and with which tools. A valid manifest adds history. A missing one means the information is absent, not that the file was tampered with, since not every capture device or platform writes or preserves Content Credentials.

Feature

Capture, analyse and certify any online content.

TrueScreen Forensic Browser certifies web pages at capture and includes Media Inspector to analyze files that already exist.

Discover more →

Integrity, provenance and chain of custody: what makes evidence defensible

Digital evidence holds up when you can show what happened to the file from the moment it was captured.

Digital evidence is defensible when its integrity, provenance and chain of custody can be shown: that the file has not changed since capture, where it came from and who handled it at each step. ISO/IEC 27037:2012 sets international guidelines for identifying, collecting, acquiring and preserving potential digital evidence, and Article 19 of the Council of Europe’s Budapest Convention of November 23, 2001 covers the search and seizure of stored computer data. TrueScreen follows ISO/IEC 27037 when it acquires content and records the time, location, device and network of each capture.

Hash, qualified timestamp and qualified electronic seal

A hash is a fingerprint of a file’s content: change a single bit and the SHA-256 value changes completely, so anyone can check a copy against the original. A qualified electronic time stamp (eIDAS, Article 3(34)) shows that the data existed in that form at a given moment. A qualified electronic seal (eIDAS, Article 3(27)) links the data to the organization that sealed it and reveals later changes; unlike a signature, it expresses no one’s consent. A documented digital chain of custody completes what a third party can check.

Documented acquisition: ISO/IEC 27037 and the Budapest Convention

ISO/IEC 27037 sets repeatable, documented methods for acquiring and preserving potential evidence, while whether a video shows something genuine remains a question for analysis; the Budapest Convention (Article 19) covers search and seizure by the authorities. Our guide to web evidence acquisition under ISO/IEC 27037 applies the method to web pages.

Deepfake evidence in court: what to do in practice

Steps 1 to 4 apply to a suspect file from the other side, step 5 to your own evidence: work on originals, be specific, use experts, document everything.

1. 1

   Ask for the original file, not a copy

   Request the native file and the device or account it came from: a screenshot, re-export or forwarded clip has lost most of the metadata an expert needs. Keep what you received untouched.

2. 2

   Challenge the evidence specifically, not generically

   Point to what does not add up: missing expressions, looping frames, metadata that contradict the story, a voice whose cadence differs from known recordings. A vague “it could be AI” invites the court to dismiss the objection.

3. 3

   Bring in a digital forensics expert

   An expert can examine metadata, file structure and device consistency, run a forensic voice comparison on audio and treat any AI detector output as a clue. Our guide on how to instruct a forensic IT expert lists what to ask.

4. 4

   Demand a documented chain of custody

   Ask who captured the file, when, with what device, and who has held it since. Gaps do not prove a fake, but they weaken the evidence.

5. 5

   For your own evidence, certify it when it is created

   Capture at the source instead of collecting screenshots later. With the TrueScreen App you can certify photos, videos and audio recordings as they happen, each with a SHA-256 hash and a technical report the other side’s consultant can verify without TrueScreen.

What is source-certified digital evidence?

TrueScreen, the Data Authenticity Platform, certifies photos, videos, audio and web pages at the moment they are created.

Source-certified digital evidence is content acquired with a forensic methodology whose integrity, capture date and method of acquisition can be demonstrated at any later point. TrueScreen protects, verifies and certifies data authenticity, protecting it from fraud, disputes and tampering.

The methodology combines forensic acquisition, data verification, a technical report and certification with a qualified electronic seal and a qualified timestamp, recognized internationally. TrueScreen is not a trust service provider or a certification authority. The certification attests how and when the content was captured and that it has not changed since, not that the scene in front of the lens was genuine: a staged scene stays staged.

Certifying photos, videos, audio and web pages as they are created

In a forensic acquisition, content is captured in a controlled environment where no person, software or AI can alter it during capture, and the time, location, device and network are recorded. Alteration is prevented during acquisition and detectable afterwards. The TrueScreen App certifies photos, videos, audio, the phone screen and location; the Forensic Browser certifies web pages and browsing sessions on macOS and Windows; the Browser Extension works from Chrome or Edge.

Each package can be verified without TrueScreen by a court-appointed expert or the opposing consultant, who still evaluates the evidence. In a custody case, a recording of threats certified in the App arrives with hash, timestamp and report; a file of unknown origin leaves only probabilistic clues. Certified evidence can be presented in court, and its weight stays with the judge.

Analyzing content that already exists

For files it did not acquire, TrueScreen offers AI Analysis in the Forensic Browser’s Media Inspector. It examines photos, videos and audio for signs of generation or manipulation, returns a confidence level, flags rebroadcasting (a photo of a screen) and reads the markings a file declares about how it was made, such as C2PA manifests (Content Credentials) and generator tags. The analysis is probabilistic and can be wrong, so a person decides, and it never carries the weight of a certification made at capture. See the deepfake detection page.

Conclusion