FRE 901: How to Authenticate Digital Evidence Under Federal Rules
Updated on
Federal Rule of Evidence 901 tells a federal court what must be shown before an exhibit counts as authentic, but not how to show it for an email, a screenshot or a video. That practical work is done by the illustrations in Rule 901(b), by case law such as Lorraine v. Markel and United States v. Vayner, and, since 2017, by the certifications of Rules 902(13) and 902(14). The standard itself is modest: the proponent needs evidence from which a reasonable jury could find the item authentic, not proof that authenticity is certain. This guide maps each type of digital evidence to the foundation federal courts accept, and tracks where the draft AI rules stand as of October 2026.
The problem: FRE 901 was enacted in 1975. Its drafters were thinking about paper documents, analog photographs, and tape recordings. Today, federal courts apply the same rule to emails, screenshots, social media posts, videos, and AI-generated files, with results that can vary between courts. Deepfakes have pushed the Advisory Committee on Evidence Rules to draft a new Rule 901(c), which in May 2026 it decided to hold in reserve rather than propose. Authentication is only one of the hurdles: the best evidence rule (FRE 1001-1004) then decides which form of the item, original or duplicate, must be produced to prove its content.
The question every litigator must answer: how does FRE 901 actually work for digital evidence, and what should you be doing right now to prepare?
The answer is simpler than the ongoing jurisprudential debate suggests. FRE 901(a) requires only "evidence sufficient to support a finding" that the evidence is what its proponent claims. That is a deliberately low threshold. For digital evidence, a dependable way to support the foundation FRE 901 asks for is forensic certification at source: capturing the data at the moment of creation, sealing it cryptographically, and documenting the chain of custody from the origin. Authentication then rests on a record made at the moment of capture rather than on a reconstruction attempted months later.
What FRE 901 Requires for Digital Evidence
FRE 901 is Federal Rule of Evidence 901, the authentication standard for all evidence in United States federal courts. Under Rule 901(a), a party must produce "evidence sufficient to support a finding that the item is what the proponent claims it is." Rule 901(b) then gives non-exclusive illustrations, including witness testimony, distinctive characteristics, comparison by an expert, and evidence about a process or system. TrueScreen documents its acquisition method in a technical report that describes the process used. The threshold is deliberately low: a prima facie showing. Under Rule 104(b) the judge does not decide whether the item is authentic. The question is whether the evidence is enough for a reasonable jury to find, by a preponderance of the evidence, that the item is what the proponent claims, and the jury then decides. Nothing close to proof beyond a reasonable doubt is required.
The judge's role at this stage is limited. The Advisory Committee Note to Rule 901(a) places authentication among the questions of "relevancy dependent upon fulfillment of a condition of fact", governed by the procedure of Rule 104(b): the court asks only whether the proponent has offered enough for a reasonable jury to find the item genuine, and the jury decides whether it actually is. Preliminary questions that the judge decides alone under Rule 104(a), such as whether a privilege applies or a witness is qualified as an expert, call for the judge to find the fact by a preponderance of the evidence. A proposed amendment to Rule 104, open for public comment from August 14, 2026 to February 15, 2027, would write that preponderance standard into Rule 104(a); its draft Committee Note cross-refers to Rule 901, together with Rule 104(b), among the situations that call for a lower standard of proof than Rule 104(a). For digital evidence, the showing usually means that the file, message or screenshot comes from the claimed source and matches the content as it was captured.
Authentication is one gate, not the whole path to the jury. The Committee Note to Rule 901(b) warns that meeting the authentication requirement "by no means assures admission of an item into evidence, as other bars, hearsay for example, may remain." An authenticated email can still be excluded as hearsay under Rules 801 to 807, as irrelevant under Rules 401 and 402, or under Rule 403 when its probative value is substantially outweighed by the danger of unfair prejudice. Our guide to the admissibility of digital evidence follows those other requirements one by one.
Rule 901(b): The Authentication Methods Courts Use
Rule 901(b) lists illustrative methods of authentication. The list is not exhaustive: the rule itself calls them "examples only" and "not a complete list." In practice, a small group of them handles most digital evidence.
Method 901(b)(1), testimony of a witness with knowledge, is a common method. An employee confirms sending a specific email. A user recognizes their own social media post. It is the simplest path, but also the most vulnerable to challenge: human memory is fallible, and opposing counsel can always argue that the digital content was modified after transmission.
Method 901(b)(4), distinctive characteristics, is especially relevant for electronic communications. An email can be authenticated through its content, language, internal references, sender address, and circumstances of receipt considered as a whole. Federal courts have repeatedly accepted this approach for emails, text messages, and social media content.
Method 901(b)(9) is a particularly useful method for digital evidence: "evidence describing a process or system and showing that it produces an accurate result." It allows authentication by demonstrating that the system which generated or captured the evidence produces accurate results. For forensic acquisition, 901(b)(9) is the natural pathway: a witness, or under Rule 902(13) a written certification, describes the acquisition process and shows that it produces an accurate result. The 2017 Committee Note to Rule 902(13) says so expressly: the rule allows "the authenticity foundation that satisfies Rule 901(b)(9) to be established by a certification rather than the testimony of a live witness."
| 901(b) Method | Description | Digital Evidence Application | Typical weight (editorial) |
|---|---|---|---|
| (b)(1) | Testimony of witness with knowledge | Email author, message sender, social media account holder | Moderate: vulnerable to memory challenges and post-transmission alteration claims |
| (b)(3) | Comparison of a disputed item with an authenticated specimen | Forensic analysis of metadata, hash values, system logs | High: requires qualified expert and non-trivial costs |
| (b)(4) | Distinctive characteristics and circumstances | Content, style, metadata, circumstances of receipt | Moderate-high: effective when corroborated by multiple converging elements |
| (b)(7) | A document recorded or filed in a public office as authorized by law, or a purported public record from the office where such items are kept | Filings and registry extracts | High: when the office of origin is shown |
| (b)(9) | Process or system producing accurate results | Forensic acquisition systems, certification platforms, automated logs | High, when a witness or a qualified person's certification describes the process and its accuracy |
| (b)(10) | Methods provided by a federal statute or a rule prescribed by the Supreme Court | Official records under Fed. R. Civ. P. 44 and Fed. R. Crim. P. 27; depositions under Fed. R. Civ. P. 30(f) | Variable: depends on the statute or rule |
The "Sufficient to Support a Finding" Standard
The FRE 901(a) standard is intentionally permissive. The proponent does not need to prove authenticity beyond a reasonable doubt, nor by clear and convincing evidence. It is enough to present evidence from which a reasonable juror could find, by a preponderance of the evidence, that the item is authentic. The final determination of authenticity rests with the jury, not the judge: the judge acts as gatekeeper, verifying only that this threshold has been met.
What does this look like in practice? A judge may admit an email even if opposing counsel raises doubts about its integrity, so long as the proponent has provided at least a reasonable basis for authenticity. Challenges to integrity go to the weight of the evidence, not its admissibility. But the low threshold is not an invitation to be careless: a seasoned litigator knows that weakly authenticated evidence may survive a motion in limine and then lose all credibility before the jury.
Authentication Methods for Specific Evidence Types
Federal courts have applied these standards across landmark digital evidence cases. In Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (D. Md. 2007), Magistrate Judge Paul W. Grimm issued a leading opinion on authenticating electronically stored information, widely cited since, mapping the FRE 901(b) illustrations to emails, web pages, text messages and computer records. In United States v. Vayner, 769 F.3d 125 (2d Cir. 2014), the Second Circuit vacated a conviction and ordered a new trial because the government had offered a printout of a profile page from VK, a Russian social network, without evidence that the defendant created or controlled it. The court repeated that "the bar for authentication of evidence is not particularly high", and still found it had not been cleared. In United States v. Browne, 834 F.3d 403 (3d Cir. 2016), the Third Circuit rejected the government's argument that Facebook chat logs were self-authenticating business records under Rule 902(11): the platform's records custodian could attest that the messages were exchanged between certain accounts, not who wrote them. The court affirmed the conviction only because other evidence at trial linked the defendant to the chats under a conventional Rule 901 analysis.
Each category of digital evidence raises different authentication problems under FRE 901. Emails require one approach, screenshots another, and social media posts raise issues that digital photographs do not share. Federal case law has developed separate standards for each type, and knowing them matters when building an evidentiary foundation.
Emails and Electronic Communications
Email authentication in federal courts typically follows the 901(b)(4) method: the distinctive characteristics of the message, combined with surrounding circumstances, create a sufficient foundation. The sender's address, the specific content of the message, consistent replies within a correspondence thread, references to facts known only to the parties involved: taken together, these elements can satisfy the 901(a) standard.
The practical concern is that emails are easily altered. Headers can be spoofed, body text modified, attachments replaced. In high-stakes litigation, opposing counsel will raise these objections. The strongest response is preventive: acquiring and certifying emails at the moment they become relevant, before any challenge arises. A documented digital provenance from the origin makes later integrity objections far easier to answer.
Screenshots and Web Pages
Screenshots are among the most difficult digital evidence types to authenticate. A screenshot is a visual representation of content that can change at any moment: a web page may be edited, a post deleted, a profile removed. The court needs assurance that the screenshot accurately represents what appeared on screen at a specific point in time.
Federal case law typically accepts testimony from a person who viewed the original web page and confirms that the screenshot corresponds to what was displayed. This approach grows weaker over time, though: web content is dynamic, sites change constantly, and a witness's memory may not hold up months after capture.
Certified forensic acquisition reduces that weakness. The page is captured with its URL, date and time, hashed and sealed with a qualified timestamp, and the report describes how the capture was made, which gives a witness or a qualified person a documented process to describe under Rule 901(b)(9) or Rule 902(13). Opposing counsel can still object, but the argument moves from what a witness remembers to what the record shows.
Social Media Posts
Authenticating social media evidence adds a further problem: how do you prove that a particular account belongs to a particular person, and that the post was actually published from that account? Federal courts have addressed this question with varying approaches.
What matters most is the combination of factors: the profile name and photo, content consistent with known facts, confirmation from other users who saw the post, and information provided by the platform itself. In United States v. Barnes, 803 F.3d 209 (5th Cir. 2015), the Fifth Circuit found a sufficient foundation for Facebook messages because a witness testified that she had seen a defendant use Facebook, recognized his account and found that the messages matched his way of communicating. She was not certain he wrote them, and the court held that conclusive proof of authenticity is not required.
The specific risk with social media is volatility. A post can be deleted, an account closed, a platform can change its display format entirely. Certified real-time acquisition, with documented chain of custody, is the most dependable way to preserve the content in the exact form it appeared at the moment of capture. Preservation is not attribution: a certified capture shows what the page displayed, not who created or controlled the account, which still needs other evidence.
Photos and Video
Photographic and video evidence is where generative AI has most visibly disrupted the authentication calculus. Until a few years ago, authenticating a photo meant confirming that the photographer took it and had not altered it. That assumption no longer holds. Synthetic images and video can now be generated at a level of realism that makes visual inspection unreliable as a verification method.
For photos and video with verifiable timestamps, method 901(b)(1) still works: the photographer or videographer testifies in court. But when the content comes from third-party sources or from contexts where AI may have been used, the scrutiny gets much tighter.
The cryptographic hash generated during forensic acquisition at source makes any subsequent alteration immediately detectable, no matter how sophisticated the manipulation. The hash lets anyone verify that the file has not changed since capture: a mathematical check, not an expert opinion. How, when and where the content was captured is what the acquisition report documents.
Chain of Custody for Digital Evidence
Authentication under FRE 901 is inseparable from the digital chain of custody. A digital file that cannot demonstrate an unbroken sequence of possession, transfer, and storage from creation to courtroom faces immediate challenge. Opposing counsel does not need to prove that alteration occurred: pointing to a realistic opportunity for alteration is often enough to raise doubts. Gaps in custody usually go to the weight of the evidence rather than its admissibility, but a documented chain keeps the argument from starting.
For digital evidence, chain of custody means documenting every access, copy, transfer, and storage event from the moment the file was created or acquired. Traditional approaches rely on human logs and testimony, both vulnerable to gaps and inconsistencies. Forensic certification addresses this structurally: the acquisition system records every step automatically, and the cryptographic hash makes any break in the chain immediately detectable. The certified report documents that chain in one place, which reduces how much testimony is needed to explain it.
Self-Authenticating Evidence Under Rule 902
Rule 902 of the Federal Rules of Evidence identifies categories of evidence that require no extrinsic proof of authenticity: they are "self-authenticating." The proponent does not need to call a witness or produce additional evidence to establish authenticity. In 2017, Rule 902 was expanded with subsections (13) and (14), designed specifically for electronic evidence. The reason was straightforward: the evidentiary framework needed to catch up with how evidence actually exists in the real world.
Certified Business Records: 902(11) and 902(12)
Subsections 902(11) and 902(12) cover domestic and foreign business records, respectively. A business record accompanied by a certified declaration from the custodian of records (or a qualified person) attesting to the conditions of admissibility under Rule 803(6) is self-authenticating. No need to bring the custodian to court.
For digital evidence, this pathway is particularly useful in commercial litigation: system logs, database records, and reports automatically generated by enterprise software can be presented with only the custodian's certification, provided the records were created and maintained in the regular course of business.
Certified Electronic Records: 902(13) and 902(14)
Subsections 902(13) and 902(14), introduced in 2017, reshaped authentication for digital evidence in federal courts. Rule 902(13) applies to "certified records generated by an electronic process or system": records whose generation process is described and whose accuracy is attested by a written certification from a qualified person. Rule 902(14) covers "certified data copied from an electronic device, storage medium, or file": data whose accurate copying is verified through a digital identification process.
What this means in practice: a record generated by an electronic process, or data copied and verified through a process of digital identification such as a hash comparison, can be authenticated by a written certification instead of a live witness. The certification must come from a qualified person and comply with the certification requirements of Rule 902(11) or 902(12). In Rule 902, a "qualified person" is not defined by a credential: it is the records custodian or another person who can attest from knowledge of the process or data being certified. The phrase comes from Rule 902(11), and it has nothing to do with a timestamp "qualified" under the EU eIDAS Regulation. Before the trial or hearing, the proponent must also give the adverse party reasonable written notice and make the record and the certification available for inspection. The federal rule sets no fixed number of days; local rules and scheduling orders often do. The 2017 Committee Note is explicit about the limits: the certification satisfies the authentication requirement only, and the opponent remains free to object on hearsay, relevance or, in criminal cases, confrontation grounds. What that certification must contain, who may sign it and what it does not cover are explained in our insight on the certification a qualified person must sign under 902(13) and 902(14).
Legal teams use TrueScreen to acquire screenshots, emails, web pages and media files at the moment they become relevant. The forensic report records the acquisition process, the checks run on the acquisition environment and device, the hash and the timestamp: the technical content a qualified person relies on when signing a 902(13) or 902(14) certification. The certification itself remains a statement by that person, and serving notice on the other side remains the proponent's job.
| Feature | Rule 901 (Standard Authentication) | Rule 902 (Self-Authentication) |
|---|---|---|
| Extrinsic evidence required | Yes: witnesses, experts, supporting documentation | No: a compliant certification replaces the live witness on authenticity |
| Litigation costs | Higher: depositions, expert witnesses, courtroom testimony | Lower: certified declaration served with pretrial notice |
| Exclusion risk | Depends on the sufficiency of the foundation | Lower on authenticity; hearsay, relevance and other objections are unaffected |
| Applicability to digital evidence | Universal: any type of evidence | Mainly certified electronic records (13) and copied data (14) |
| Challengeability | At any point during the proceedings | The opponent can still dispute authenticity and raise hearsay, relevance or confrontation objections; pretrial notice and inspection give a fair opportunity to do so |
Draft Rule 901(c) and Rule 707: Where the AI Evidence Rules Stand
As of October 3, 2026, no federal rule of evidence written for artificial intelligence or deepfakes is in force, so AI-related exhibits are still handled under the existing rules, such as Rules 901, 702 and 403. The Advisory Committee on Evidence Rules is working on drafts of a new Rule 901(c) on deepfakes and a new Rule 707 on AI output, and in its report of May 17, 2026 it decided to advance neither for now. Both are on the agenda of its meeting scheduled for October 15, 2026 in Boston, where panels of technical experts, judges and practitioners are expected to discuss them. Separately, the proposed amendment to Rule 104 is open for public comment until February 15, 2027; it would codify the preponderance standard for preliminary questions the judge decides, and its draft Committee Note cross-refers to Rule 901, together with Rule 104(b), among the situations that call for a lower standard of proof.
Draft Rule 901(c): A Deepfake Rule Held in Reserve
The working draft of Rule 901(c) addresses items that a party claims were "fabricated, in whole or in part, by generative artificial intelligence." In May 2026 the Committee concluded that "at least for now, an amendment to Rule 901 to address deepfakes is not warranted". In a Federal Judicial Center survey, only 15 of the 931 judges who responded reported having encountered a deepfake challenge. The draft is kept ready in case the existing rules prove inadequate.
Under the draft, as it stands in the May 2026 report, a party claiming that an item is a deepfake must first present evidence sufficient to support a finding of fabrication; a bare allegation is not enough. Only then must the proponent show the court that the item is more likely than not authentic, a Rule 104(a) standard higher than the ordinary 901(a) showing. The draft applies to items offered under Rule 901 or Rule 902 and requires the party alleging fabrication to give reasonable pretrial notice. The Committee received suggestions on this topic, including one from Professor Rebecca Delfino.
For anyone managing digital evidence in litigation, the draft suggests what a court could look for once a challenge is properly raised: corroboration that the item is more likely than not authentic. Evidence documented at the moment of capture, with a hash, a timestamp and a description of how it was acquired, can help answer such a challenge.
Proposed Rule 707: AI Output Offered Without an Expert
The revised draft of Rule 707 under study addresses a different problem and does not deal with deepfakes. Titled "Evidence Produced by Artificial Intelligence and Presented at Trial Without an Expert", it covers output acknowledged to come from an AI system and offered without an expert witness, for example through a lay witness who simply ran the program, and would subject that output to reliability requirements equivalent to those of Rule 702. The earlier version, published for comment in August 2025, was framed around "machine-generated" evidence and applied the standards of Rule 702(a)-(d); it drew dozens of written comments before the period closed on February 16, 2026. At its meeting of May 7, 2026 the Committee voted to withdraw that version and to study the revised draft instead of republishing it for now.
The draft Committee Note to the revised text makes a point that matters for anyone relying on certification: when AI output is the equivalent of expert testimony, "it is not enough that it is self-authenticated under Rule 902(13)", because that rule "covers authenticity, but does not assure reliability." Our analysis of proposed Rule 707 and AI-generated evidence follows the rule in more detail.
Neither draft changes what a careful proponent should do today. Evidence acquired with TrueScreen, the Data Authenticity Platform, carries from the moment of capture a hash, a timestamp and a technical report describing how it was acquired: material a witness or a qualified person can use to lay the foundation under Rule 901(b)(9), and the kind of corroboration a court could look for if an opponent ever made the showing the draft Rule 901(c) describes.
How Forensic Certification Supports FRE 901 Authentication
Forensic certification at source works on a principle opposite to traditional authentication: instead of reconstructing authenticity after the fact, it embeds authenticity in the data at the moment of creation. That inversion addresses most of the problems outlined above. TrueScreen, the Data Authenticity Platform, applies it through a forensic methodology consistent with ISO/IEC 27037: forensic acquisition at the source, verification of the device, the metadata and the captured content, technical reporting, and certification with an official digital seal and a timestamp qualified under the EU eIDAS Regulation. A third party can examine the resulting evidence package independently.
How Certified Acquisition Fits Rule 901(b)(9) and Rule 902(13)
Certified forensic acquisition sits where Rule 901(b)(9) and Rule 902(13) meet. Under 901(b)(9), the certified acquisition process can be presented as a documented "process or system" that "produces an accurate result." The technical report accompanying each acquisition describes the process, documents the verifications performed and records their results. Under 902(13), the output of the acquisition can be offered as a "record generated by an electronic process or system", provided a qualified person signs a certification that complies with Rule 902(11) or (12) and the proponent gives the required notice. A TrueScreen certification is not the written certification that Rules 902(11), 902(13) and 902(14) require: that remains a statement signed by a qualified person.
The TrueScreen platform generates a forensic report that documents each step, from the checks run on the acquisition environment and device to the final cryptographic hash, the qualified timestamp and the digital seal. Together with the certified data, the report gives the witness or the qualified person who lays the foundation a documented process to describe, so the chain of custody does not have to be reconstructed from memory.
From Reactive Authentication to Proactive Certification
The traditional model for authenticating digital evidence is reactive: data is collected, stored, and only at the time of trial does anyone address the question of its authenticity. The weaknesses are obvious once you think about them. As the gap between data creation and the authentication attempt grows, proving the absence of alterations gets progressively harder. And without cryptographic sealing at source, there is simply no mathematically verifiable way to rule them out. If the draft Rule 901(c) held in reserve by the Advisory Committee were ever adopted, a proponent facing a properly supported claim of fabrication would have to show the court that the item is more likely than not authentic, which is more than the ordinary Rule 901(a) showing.
The proactive model flips this. Certifying at source means authenticity becomes a property of the data itself, not something attributed afterward. The TrueScreen mobile app enables certified acquisition of photos, videos, screenshots, and documents directly from the user's device, with a qualified timestamp and instant cryptographic sealing. For email certification, the process works the same way: content is acquired and certified at the moment it becomes relevant to litigation.
Consider the scenario the draft Rule 901(c) describes: opposing counsel presents evidence that an exhibit was generated or altered with AI. The proponent who certified the data at source can answer with a forensic report showing how and when the content was acquired and which checks were run on the acquisition environment, and with a hash showing that it has not changed since. This answers the claim that the file changed after capture. It does not answer a claim that the content was already synthetic or staged when captured, and it does not show who created or controlled the account behind a post: those questions need other evidence, the gap at issue in Vayner. The court still weighs that showing, but it rests on a record made at capture rather than on a witness's memory.
General information on US federal rules; not legal advice. State courts and other jurisdictions apply their own rules.
FAQ: FRE 901 and Digital Evidence Authentication
What does FRE 901 require for digital evidence?
FRE 901(a) requires "evidence sufficient to support a finding" that the digital item is what the proponent claims, for example that a file comes from the declared source and has not been altered since. The bar is prima facie: under Rule 104(b) the judge does not decide whether the item is authentic, only whether the evidence is enough for a reasonable jury to find, by a preponderance of the evidence, that it is what the proponent claims; the jury then decides. Meeting Rule 901 does not resolve hearsay or relevance objections, which are decided separately.
How to authenticate emails for federal court?
Emails in federal courts are typically authenticated under Rule 901(b)(4), through distinctive characteristics: sender address, consistent content, internal references, circumstances of receipt. A stronger approach is forensic certification of the email at the moment it becomes relevant, which supports a foundation under Rule 901(b)(9) by documenting the acquisition process and cryptographically sealing the content.
What is self-authenticating evidence under Rule 902?
Rule 902 identifies evidence that requires no extrinsic proof of authenticity. For digital evidence, subsections 902(13) and 902(14), introduced in 2017, allow certified electronic records and data copied from electronic devices to be authenticated without a live authenticating witness, provided a qualified person signs a certification, the opposing party receives reasonable written notice before trial and can inspect the record. The certification satisfies the authentication requirement only: hearsay, relevance and, in criminal cases, confrontation objections remain open.
What is draft Rule 901(c)?
Draft Rule 901(c) is a working draft on deepfakes prepared by the Advisory Committee on Evidence Rules. A party claiming that an item was fabricated with generative AI would first have to present evidence sufficient to support a finding of fabrication; the proponent would then have to show that the item is more likely than not authentic. In its report of May 17, 2026 the Committee decided that an amendment is not warranted for now and kept the draft in reserve; it is on the agenda of the Committee's meeting scheduled for October 15, 2026.
How to authenticate screenshots for court?
Screenshots are typically authenticated through testimony of a person who saw the original web page (Rule 901(b)(1)) or the distinctive characteristics of the content (Rule 901(b)(4)). A stronger approach is certified forensic acquisition: the web page is captured with a qualified timestamp and cryptographic sealing, creating a verifiable record documenting the URL, date, time, and exact content at the moment of capture.
How to authenticate a document in federal court?
To authenticate a document in federal court, the proponent must satisfy FRE 901(a) by producing evidence sufficient to support a finding that the document is genuine. The most common methods are testimony from a person with knowledge of the document (901(b)(1)), distinctive characteristics of the document itself (901(b)(4)), and for electronic records, a certification describing the system that generated or stored the document (902(13) or 902(14)). For digital documents, forensic certification at source supports a foundation: the document is sealed with a cryptographic hash and qualified timestamp at acquisition, giving the witness or certifying person a documented process to describe.
Do screenshots hold up in court?
Screenshots can be admitted as evidence in federal court, but they face higher scrutiny than other digital evidence types because they are second-level representations of content that may have changed. A witness who viewed the original content can testify under 901(b)(1), but this approach weakens over time. The stronger method is certified forensic acquisition: the content is captured in real time with a qualified timestamp, cryptographic hash, and documented URL, creating a verifiable record that supports a foundation under 901(b)(9). Certification does not settle hearsay or relevance objections, which the court decides separately.
What is the difference between Rule 901 and Rule 902?
Rule 901 requires the proponent to present extrinsic evidence of authenticity: witnesses, expert testimony, or other supporting documentation. Rule 902 identifies categories of evidence that are "self-authenticating" and require no extrinsic proof. For digital evidence, the key Rule 902 subsections are 902(13) for records generated by a certified electronic process and 902(14) for certified data copies. Evidence that qualifies under Rule 902 is typically simpler and less expensive to authenticate because a certification replaces live testimony on authenticity. Forensic certification can support both pathways: it documents the process a witness describes under Rule 901(b)(9) and the content of a qualified person's certification under Rule 902(13) or 902(14).
TrueScreen editorial team
This section is edited by the TrueScreen editorial team, which brings together expertise in digital forensics, the law of digital evidence and regulatory compliance. Every article is checked against primary sources: legislation, published rulings, technical standards and official documentation, always cited in the text.
