A screen recording was the only surviving record of the conversation — what made it hold up
The situation
In a civil fraud case the plaintiff presented a screen recording showing a messaging conversation with the defendant, stating the defendant later deleted the messages. The phone had since been replaced and was unavailable. The screen recording was the only surviving representation of the conversation.
What the other side said the evidence showed
The defense argued the recording proved nothing — that a conversation shown on a screen establishes only what was displayed, and displays can be constructed.
A screen recording captures an interface. It does not capture the database behind the interface.
On its own, a recorded interface does not independently establish that the messages were stored natively, that the contact identity was genuine, that the timestamps were authentic, that the conversation was complete, or that nothing was inserted or rearranged. Those are five separate propositions and the recording speaks to none of them directly.
It is also demonstrably easy to construct a visually convincing equivalent — through contact renaming, draft messages, web-interface mockups, message-generator applications, edited HTML, or test accounts. Demonstrating that in a hearing does not prove anyone fabricated anything. It establishes why corroboration is required before an interface recording carries weight.
Which is the productive framing for either side. The question is not whether the recording is fake. It is what independent sources exist that would have to be fake too — and in this matter, several did.
What the examination involved
Defined what the recording could establish on its own
It captured what was displayed on a device at the time of recording. It did not establish native storage, contact identity, timestamp authenticity, completeness, or the absence of insertion or rearrangement.
Demonstrated how a similar interface could be simulated
Contact renaming, draft messages, web-interface mockups, message-generator applications, edited HTML, and test accounts all produce visually comparable results — establishing the need for corroboration, not an accusation.
Identified and tested independent corroborating sources
Email notifications, cloud-account login records, a witness who had seen the messages, bank records matching the amounts discussed, and a screenshot that had been automatically backed up before the phone was replaced.
Assessed whether the corroboration was genuinely independent
Sources that would have to be separately fabricated to sustain a false account carry weight; sources derived from the same device or the same act of capture do not.
What the examination found
- The screen recording alone could not establish native storage, contact identity, timestamps, or completeness
- A visually similar conversation could be constructed through several readily available methods
- Email notifications and cloud login records existed independently of the recording
- Bank records matched amounts discussed in the conversation
- An automatic cloud backup contained a screenshot predating the phone replacement
- A witness had seen the messages on the device
Outcome
The corroborating evidence is what gave the screen recording weight. Standing alone it would have remained a picture of an interface; supported by independent records that would each have had to be falsified as well, it became substantially harder to dismiss.
Takeaways for counsel
- Treat a screen recording as a starting point that requires corroboration, whichever side you're on.
- The productive question is not "is it fake" but "what independent source would also have to be fake."
- Email notifications, cloud login records, backups, and financial records are the corroboration that actually moves the needle.
- Demonstrating that an interface can be simulated is a legitimate argument about weight — it is not an accusation of fabrication, and framing it as one invites a credibility problem.
- When a device has been replaced, ask about cloud backups made before the replacement. They frequently survive the phone.
Services involved
Have a case that turns on digital evidence?
Tell us the case, the device, and your deadline. The scoping call is free, and we'll tell you honestly whether an examination is worth it.
Appointed counsel: see our Colorado public defender program.
More case studies
Surveillance video deleted after a preservation letter: proving spoliation without recovering the footage
The drone video looked decisive until the flight logs put the camera 70 feet away
Deleted files in an employee-theft prosecution: what the artifacts proved, and what they couldn't
Related reading
- Digital evidence terminology for attorneys
What each forensic term means, what it changes in a case, and the question to ask.
- Forensic case studies
Worked examples of how digital evidence is examined, challenged, and presented in court.
- For Colorado public defenders
Independent examination at indigent-defense rates, with estimates written for funding requests.
This case study is illustrative. It is written to show how digital evidence is examined, challenged, and presented in court; it is not an account of any client matter, and any resemblance to a specific case is unintended. The techniques and failure modes described are real. Nothing on this page is legal advice, and no result is a prediction or guarantee of the outcome of any other matter. Inquiries are governed by our Digital Forensics Engagement Terms; contacting us does not create a forensic engagement, chain of custody, or preservation duty.