How to prove a digital file existed on a certain date
File dates can be edited, so a provable date has to come from outside the file: here is what each method proves and when to use it.
Updated on
Key takeaways
- Created dates, document properties and EXIF data are written by the device and can be edited, so they are clues rather than proof of when a file existed.
- Under Article 41(2) of the eIDAS Regulation, a qualified electronic time stamp enjoys the presumption of accurate date and time and of the integrity of the data bound to them.
- Article 24a(6) eIDAS, inserted by Regulation (EU) 2024/1183, requires a qualified electronic time stamp provided in one Member State to be recognised in all the others.
- The US Copyright Office states that sending yourself a copy of your work, the so-called poor man’s copyright, is not a substitute for registration.
- TrueScreen gives a file a certain date from the moment of certification, with an official digital seal and a qualified timestamp, recognised internationally.
A contract, a photo or some source code ends up in a dispute, and the argument turns on one point: did the file exist on that day, in that exact form? To prove a file existed on a certain date, meaning a date others can rely on without taking your word for it, the date your computer shows is not enough, because anyone holding the file can change it.
How can you prove a digital file existed on a certain date? Bind its content to a point in time through an independent record others can check, not through the date stored in the file. Created dates, EXIF data and device clocks can all be edited. Under Article 41(2) of the EU eIDAS Regulation, a qualified electronic time stamp is presumed accurate in its date and time, and the data bound to it is presumed intact. TrueScreen certifies files, photos, emails and web pages with an official digital seal and a qualified timestamp, recognised internationally, so each one carries a certain date from the moment of certification.
What does it take to prove a file existed on a certain date?
A date shown by the file is a claim; a provable date comes from a record outside the file that someone else can verify.
TrueScreen creates that outside record by certifying the file with an official digital seal and a qualified timestamp, recognised internationally. Every file carries dates. The file system keeps a created and a modified date, PDFs and office documents store their own creation date in the document properties, and a photo carries an EXIF timestamp, sometimes with the date printed on the image as well. Software on the device writes all of them, using a clock that can be set to any day you like.
Two questions get mixed up here. The created date answers “when does this file say it was made?”. A provable date, the kind of proof of date a judge or a counterparty can rely on, answers a different one: “since when is it established that this content existed, unchanged?”. Only the second is likely to hold up when the other side disputes it, because it rests on evidence the holder of the file cannot rewrite.
Rewriting file metadata takes seconds. Command-line tools that ship with common operating systems change file system dates, and free editors rewrite document properties and EXIF fields. That is why EXIF metadata alone is weak evidence of when a photo was taken, and why, to prove a file existed on a certain date, you need evidence from somewhere else: a third party, a record kept by someone other than you, or a cryptographic time stamp tied to the file’s exact content.
What do the traditional methods actually prove?
Notaries, registered mail and emailing yourself each prove something real, but rarely that a specific digital file existed unchanged on a given day.
A notary records facts and documents in a public act, and in many jurisdictions that act carries strong evidentiary weight. If the law requires a public act, or you need a formal witness to a declaration, a notary is the right call. For a digital file, though, the notary records what was presented at the appointment, and each new version means another appointment. TrueScreen does not replace a notarial deed; it serves a different need.
Registered or recorded mail proves that the postal service accepted and delivered an item on a given date. It says little about what was inside, unless the envelope stays sealed until someone opens it in front of a court. With a digital file you would be mailing a printout or a storage device, which proves nothing about the file you keep on your computer today.
Emailing a file to yourself, or mailing yourself a sealed envelope, is the habit known as “poor man’s copyright”. The US Copyright Office is direct about it: “There is no provision in the copyright law regarding any such type of protection, and it is not a substitute for registration.” In the UK, GOV.UK notes that “You get copyright protection automatically” and that “There is not a register of copyright works in the UK”, so the real question there is evidence, not registration. A self-sent email does suggest you held the file on that date, since the mail provider’s servers record when it arrived. You still control the account and the copy, though, and that limits its evidentiary weight.
What does a qualified timestamp prove under eIDAS?
A qualified timestamp shows that content existed, in that exact form, no later than the date and time it indicates, and EU law presumes that date accurate.
A qualified electronic time stamp is defined by Regulation (EU) No 910/2014 (eIDAS) as an electronic time stamp that meets the requirements of Article 42 (Article 3(34)); an electronic time stamp is data that “binds other data in electronic form to a particular time establishing evidence that the latter data existed at that time” (Article 3(33)). Under Article 41(2), a qualified one “shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound.” Since Regulation (EU) 2024/1183, Article 24a(6) provides that a qualified electronic time stamp provided in one Member State is recognised as qualified in all other Member States. TrueScreen certifies content with an official digital seal and a qualified timestamp, recognised internationally, so any later change to the certified content is detectable.
In practice, the time stamp is bound to a fingerprint of the file, a hash calculated from its content. Change one character and the fingerprint changes, so the time stamp no longer matches. This is what people mean by a trusted or digital timestamp; the qualified level is the one EU law attaches a presumption to. A time stamp that is not qualified still counts: Article 41(1) says it cannot be denied legal effect or admissibility as evidence solely because it is electronic or not qualified, but it gets no presumption. A qualified electronic seal, under Article 35(2), enjoys the presumption of the integrity of the data and of the correctness of its origin.
Note what a timestamp leaves out. It shows that the content existed no later than a given moment, not when it was first created, who made it or whether it is true. Outside the EU, do not assume any automatic presumption; the effect depends on local law and on the court.
If you want the hands-on procedure for a single document, the guide on how to timestamp a document walks through it, and the article on the legal value of qualified electronic timestamps covers the eIDAS framework in more depth.
Existing file or capture at the source: what each one proves
Certifying a file you already have fixes its content and date from that moment; capturing content at the source also documents how and when it was acquired.
Certifying an existing file proves that the file existed, unchanged, from the moment of certification. It does not show when or how the file was created, or whether someone edited it before. Capture at the source works differently: a photo, a video, a web page or a received email acquired through a certified process keeps the context of its acquisition, including the time and the device used. TrueScreen certifies existing files from the moment they are certified and, with the TrueScreen App, documents when, where (if the flow requires location) and with which device content captured in real time was acquired.
The difference decides how much a court can read into your evidence. Say a client sends you a photo of water damage that was taken a week ago. Certifying that photo today proves it existed, in that form, from today. Had it been taken in the TrueScreen App at the scene, the record would also show when and with which device it was acquired. That gives the evidence more context than a file imported after the fact, though the weight is for the court to assess.
The same applies to web pages and emails. A screenshot saved to your desktop is an existing file with editable metadata; a page captured through a certified process records the acquisition itself. An email you forward for certification gets its certain date from the moment it is received for certification, not from the date in its header.
Neither route proves that what the content shows is true. Certification documents how and when the content was acquired or fixed. Whether the photo shows what it seems to show, or whether a contract’s terms are fair, remains a separate question.
Which method proves what: a side-by-side comparison
Each method answers a different question, so the right choice depends on what the other side is likely to dispute.
| Method | What it proves | What it does not prove | When to use it |
|---|---|---|---|
| File metadata (created date, modified date, EXIF) | What the device or software recorded | That the date is accurate or that the file is unchanged, since anyone can edit it | As a first clue or for internal filing, never alone in a dispute |
| Emailing yourself or a sealed envelope (“poor man’s copyright”) | That something was sent to you on a date, per the mail provider or postal record | The exact content in a verifiable form, or who created it | As a low-effort habit, knowing its evidentiary weight is limited |
| Notary | The facts and documents recorded in a public act, with strong evidentiary weight in many jurisdictions | That a digital file stayed unchanged after the appointment, unless its content was fixed in the act | When the law requires a public act or a formal witness |
| Qualified timestamp (eIDAS) | That the content existed, unchanged, no later than the stated date and time; in the EU, presumed accurate (Art. 41(2)) | When the content was first created, who created it, or whether it is true | Contracts, drafts, reports, code: any file whose existence at a date may be disputed |
| Capture at the source with TrueScreen | When and how the content was acquired, with which device and, if the flow requires it, where; sealed with an official digital seal and a qualified timestamp | That what the content shows is true | Photos of damage or sites, web pages, received emails, evidence you collect yourself |
File metadata and self-sent copies are easy to produce and carry limited evidentiary weight. When the content already exists, a qualified timestamp is how you prove a file existed on a certain date, and capture at the source adds the circumstances of acquisition when you can still collect the content yourself.
How does TrueScreen give a digital file a certain date?
TrueScreen gives a digital file a certain date by certifying its content with an official digital seal and a qualified timestamp, from the moment of certification.
TrueScreen, the Data Authenticity Platform, fixes the content and its certain date from the moment of certification, without certifying how the file was created. Every certification carries an official digital seal and a qualified timestamp, recognised internationally; in the EU, the qualified electronic seal and the qualified timestamp enjoy the presumptions of Articles 35(2) and 41(2) of eIDAS, and any later change is detectable. TrueScreen is not a trust service provider and is not a certification authority. Certifications have full legal and evidentiary value worldwide, while the weight they carry in a specific case is for the court to assess.
The route depends on where the file is and whether it can leave your systems. In the Portal, File certification lets your browser calculate the file’s SHA-256 fingerprint and upload the file; the article on how to certify a file explains the process. On a phone, the TrueScreen App imports a file and gives it a certain date from the import, which is not a forensic acquisition. When a file must not leave your own systems, TrueScreen Business lets you certify only its fingerprint (hash) through the TrueScreen API or the TrueScreen MCP server, so the file itself is never transmitted.
-
Decide whether you are certifying a file or capturing at the source
If the content already exists, certify the file as it is. If you can still take the photo, open the web page or receive the email, capture it through TrueScreen so the acquisition itself is documented.
-
Certify the file or capture the content
Upload the file in the Portal, import it in the TrueScreen App, or send only its hash through the API from TrueScreen Business. For new content, take the photo in the TrueScreen App or capture the page with the Forensic Browser.
-
Keep the original file next to its certification
The certification matches one exact file. Keep that copy unchanged, because an edit changes the fingerprint, which will then no longer match.
-
Present the certification together with the file
When the date is disputed, share the certification with the original file, so the other side can check that the fingerprint and the qualified timestamp match the content in front of them.
Which route fits a contract, a photo, an email or source code?
The right route depends on the kind of content and on whether you can still capture it at the source.
Contracts and documents
A final PDF, a quotation or a technical report already exists as a file, so certify the final version in the Portal. The certain date runs from the moment of certification. For confidential documents, certify only the hash through TrueScreen Business and keep the file inside your systems.
Photos of damage or a construction site
Take the photo inside the TrueScreen App. A photo taken in the app is certified as a real-time acquisition, and the record shows when, with which device and, if the flow requires it, where it was taken, which a file imported from the gallery cannot show.
Emails you have received
Mail Certification certifies messages that reach your workspace’s dedicated address (in To, Cc, Bcc or through a forwarding rule) from senders that administrators have enabled, with any email client. An email already in your inbox is certified by forwarding it, and the certification starts when TrueScreen receives it. Mail Certification certifies the original .eml message and every attachment, except calendar invitations, with SHA-256, and the report shows sender, recipients, subject, SPF, DKIM and DMARC results, body text, attachments and headers. The article on the legal value of email covers the evidentiary side.
Web pages
A web page can change or disappear overnight, so capture it rather than saving a screenshot. The Forensic Browser, a desktop application for macOS and Windows, captures pages through a certified process; the TrueScreen App and the Browser Extension for Chrome and Edge are the other routes.
Creative work and source code
What people often call proof of creation is, in evidentiary terms, proof of anteriority: the file existed, unchanged, from that date. Certifying a manuscript, a design or a release of your source code gives it that certain date. It does not prove authorship and is not a copyright registration. The article on proof of creation for intellectual property looks at this case in detail.
Conclusion
The date a file shows is a statement anyone holding the file can change, so it rarely settles a dispute on its own. A provable date comes from outside the file: a qualified timestamp shows that the content existed, unchanged, no later than a given moment, and in the EU it carries a presumption of accuracy. When you can still collect the content yourself, capture at the source also records how and when it was acquired. TrueScreen certifies existing files from the moment of certification and captures photos, web pages and received emails at the source, with an official digital seal and a qualified timestamp, recognised internationally.
FAQ: proving when a digital file existed
How can you tell when a document was created?
The file system shows a created and a modified date, and PDFs and office documents store a creation date in their properties. These dates show what the software recorded on that device, not a verified fact: the device clock may have been wrong, and the fields can be edited. To show when a document existed in a way others can rely on, you need an independent record, such as a qualified timestamp bound to its content.
Is it possible to tell when a PDF was created?
A PDF usually stores a creation date and a modification date in its document properties, written by the program that produced it. Any PDF reader displays them, but they come from the computer’s clock, and metadata editors can change them. Treat them as a clue, not proof. A qualified timestamp applied to the PDF’s content shows that the file existed, in that exact form, no later than the time it indicates.
Can you change a file’s created date?
Yes. File system dates, document properties and photo EXIF data can all be modified with command-line tools that ship with common operating systems or with free metadata editors, and setting the device clock to another day changes the dates of every new file. A created date alone therefore rarely settles a dispute. A date becomes provable when it comes from a record outside the file, such as a qualified timestamp bound to its content.
Can you still do a poor man’s copyright?
You can still email a file to yourself or mail yourself a sealed copy, but the US Copyright Office states that copyright law has no provision for this practice and that it is not a substitute for registration. In the UK, copyright protection is automatic and there is no register of copyright works. A self-sent copy suggests at most that you held the work on that date, so its evidentiary weight is limited.
Is a qualified timestamp recognised outside the European Union?
Inside the EU, the eIDAS Regulation gives a qualified electronic time stamp a presumption of accurate date and time and of data integrity, and Article 24a(6) requires every Member State to recognise one provided in another. Outside the EU, do not assume any automatic presumption; the effect depends on local law and on the court. The timestamp still remains an independent, verifiable record of when the content existed.
How can I prove a digital file existed on a certain date without going to a notary?
TrueScreen certifies the file with an official digital seal and a qualified timestamp, recognised internationally, so the file has a certain date from the moment of certification and any later change is detectable. For photos, web pages and received emails, capture at the source with TrueScreen also documents how and when the content was acquired. TrueScreen does not replace a notarial deed; it serves a different need.
Sources and verification
Every figure and principle cited here links to its source, listed with type and date. Links checked on the publication date.
| Source | Type | Date | What it supports |
|---|---|---|---|
| Regulation (EU) No 910/2014 (eIDAS), Art. 3(33) and (34) | Law | July 23, 2014 | Definitions of electronic time stamp and qualified electronic time stamp |
| Regulation (EU) No 910/2014 (eIDAS), Art. 41(1) | Law | July 23, 2014 | Legal effect and admissibility of electronic time stamps that are not qualified |
| Regulation (EU) No 910/2014 (eIDAS), Art. 41(2) | Law | July 23, 2014 | Presumption of accurate date and time and data integrity for qualified time stamps |
| Regulation (EU) No 910/2014 (eIDAS), Art. 35(2) | Law | July 23, 2014 | Presumption of integrity and correct origin for qualified electronic seals |
| Regulation (EU) 2024/1183, Art. 24a(6) eIDAS | Law | April 11, 2024 | Recognition of qualified time stamps in all Member States; Art. 41(3) deleted |
| US Copyright Office, Copyright FAQ | Document | 2026 (accessed October 15, 2026) | Poor man’s copyright is not a substitute for registration |
| GOV.UK, How copyright protects your work | Document | 2026 (accessed October 15, 2026) | Copyright is automatic in the UK and there is no register of works |
Give your files a certain date
Certify files, photos, emails and web pages with an official digital seal and a qualified timestamp, recognised internationally.
TrueScreen editorial team
This section is edited by the TrueScreen editorial team, which brings together expertise in digital forensics, the law of digital evidence and regulatory compliance. Every article is checked against primary sources: legislation, published rulings, technical standards and official documentation, always cited in the text.
