When a customer dispute may grow into a court case, save the original download, a readable copy, and a note showing how you obtained it. That combination is more useful than a screenshot alone. It still doesn't guarantee that a court will accept the material.
For a U.S. consumer complaint, the goal is usually a clear, verifiable record. In federal litigation, the evidence may also need authentication, relevance, a hearsay exception, and compliance with filing or discovery rules. State courts can apply different rules. This is general information, not legal advice.
What to save from each source
Digital evidence may include emails, text messages, social media posts, web pages, receipts, account notices, contracts, photos, audio, videos, and downloaded account records. Preserve the source's native format when possible, then create a readable copy for review.
| Source | Preserve when possible | Don't rely on alone |
|---|---|---|
| The native message file, complete thread, headers, attachments, and a readable PDF | A cropped screenshot showing only one message | |
| Text messages | An export or complete conversation showing contacts, dates, and times | Individual screenshots without surrounding messages |
| Website or social media post | The page URL, account name, capture time, print-to-PDF copy, and screenshots | An image with no source or date |
| Receipt or account record | The original PDF or email, transaction number, terms, and visible account details | A renamed file with no explanation of where it came from |
| Photo, audio, or video | The original file, source device or account, and a record of any conversion | An edited clip presented as the original |
Use the platform's export function when it has one, but save a readable copy as well. An export may retain information that a screenshot omits, while a PDF or screenshot can make the record easier for a company, agency, or lawyer to review.
For text messages, practical documentation guidance recommends keeping the contact, date, time, and surrounding conversation visible. For web and social media records, 2Civility's preservation guidance suggests using more than one capture method, such as a screenshot and a print-to-PDF copy. These resources can help with preservation, but neither one guarantees admissibility.
What do FRE 901 and 902 require?
In a U.S. federal case, Federal Rule of Evidence 901 requires enough evidence to support a finding that an item is what the proponent claims it is. The rule gives examples, including testimony from someone with knowledge of the item or the process that created it. Those examples aren't the only possible ways to authenticate evidence.
Rule 901 doesn't require a particular file format or a SHA-256 hash. A hash can help show that a particular file has not changed since the hash was calculated, but it doesn't by itself prove:
- Who created the file
- Who controlled the account
- Whether the message or recording is truthful
- Whether the file was collected lawfully
- Whether the evidence is relevant or complete
Rule 902 covers categories of evidence that may be self-authenticating. They include some certified business records and records produced or copied by a reliable electronic process. The required certification and notice procedures matter. A PDF downloaded from a company's website doesn't automatically qualify just because the company published it.
Authentication is only one issue. A court may also consider hearsay, relevance, privilege, completeness, and other procedural requirements. Federal Rules of Evidence apply in federal courts; state courts may use different rules.
How to preserve a digital download
1. Identify the source and capture it promptly
Before downloading, write down where the information came from. Record the website, account, email address, device, app, or customer portal involved.
If a post, message, video, or account notice could disappear, capture it promptly. Don't delete the account, clear the app, edit the message, or assume the platform will keep the material indefinitely. Routine retention settings can remove emails, messages, and video footage.
Only access and copy information you're authorized to see. If the material is in another person's account, a work system, or a shared device, ask a qualified attorney about the proper process before accessing it.
2. Preserve the surrounding context
A file without context can be hard to understand or authenticate. Keep, where available:
- The full email or message thread
- Sender, recipient, account name, and profile information
- The page URL or message location
- The displayed date, time, and time zone
- Related attachments and linked documents
- The transaction, order, or case number
- Relevant terms, notices, or account screens
For a website, use the browser's Print command to create a PDF and take a screenshot of the visible page. Interactive content, comments, advertisements, and embedded media may not appear in the PDF. Save separate captures when those details matter.
3. Keep the native file separate from working copies
Save the original export or downloaded file without overwriting it in an editor. Keep its original filename when practical. Make a separate copy for highlighting, cropping, redaction, or annotation.
A simple folder structure can help:
OriginalsReadable copiesWorking copiesEvidence logExports and attachments
Label edited copies clearly. An annotated or redacted copy shouldn't be presented as the untouched original.
4. Record dates, metadata, and the collection method
File metadata can include creation dates, modification dates, device information, location data, and application details. Email headers may show routing information and timestamps. Preserve these details when available, but don't treat an operating-system timestamp as proof of when the underlying event occurred.
A download can create a new file timestamp, and an export can remove or change metadata. Record both the date and time displayed by the source and the date and time you captured or downloaded the material, including the time zone.
Your collection notes should identify:
- The device and app or browser used
- The account or page visited
- The collection date and time
- The export, download, print, or screenshot method
- Any conversion or compression
- Missing attachments, unavailable comments, or other limitations
The text-message documentation resource can help identify details that should remain visible, such as contacts and timestamps. It's a practical preservation resource, not a promise that a court will accept a particular format.
5. Consider a SHA-256 hash for important files
A SHA-256 hash is a digital fingerprint of a file. If the file changes, its hash will normally change too. You can calculate the hash when the file is acquired and calculate it again after transferring or copying the file.
Hashing can be useful for:
- Video or audio files
- Large groups of exported records
- Files sent to an attorney or forensic examiner
- Evidence whose integrity is likely to be challenged
A hash isn't required for every ordinary customer complaint. It also doesn't prove that the source is genuine. It helps show only that the file reviewed later matches the specific file that was hashed earlier.
6. Keep a simple chain-of-custody log
A chain-of-custody log records what happened to the evidence after collection. A spreadsheet or text document may be enough for a routine consumer dispute if the entries are consistent and detailed.
| Field | Example |
|---|---|
| Evidence ID | E-001 |
| Description | Complete email thread and two attachments |
| Source | Customer account portal |
| Captured | March 12, 2026, 2:14 p.m. Eastern |
| Method | Native export and print to PDF |
| Original filename | account_notice.eml |
| Hash | SHA-256 value, if calculated |
| Storage | Encrypted drive and restricted backup |
| Access history | Date, person, reason, and action |
| Limitations | One linked page was no longer available |
Add an entry whenever someone copies, transfers, opens for examination, redacts, or sends the file. The log is an audit trail; it isn't proof that the content is true.
7. Store and share the files securely
Digital evidence can contain names, addresses, financial information, health information, passwords, or private conversations. Keep the original in access-controlled storage and maintain a backup in a separate secure location.
Avoid public file-sharing links and ordinary email for highly sensitive material unless the recipient gives you a secure method. The FTC's data security guide is written for businesses, but its advice to trace where sensitive information flows can help you decide how to store and send evidence.
When appropriate, redact unrelated personal information from a copy. Keep the unredacted original protected, and record what you removed and why.
What should you send in a consumer dispute?
Begin with a short timeline. State what happened, identify the relevant dates, and refer to clearly labeled files such as E-001 and E-002.
Send the company, platform, or agency:
- A concise description of the issue
- The specific action or correction you want
- Copies of the most relevant evidence
- The transaction, account, or case number
- A request for written acknowledgment
Keep the original files and evidence log. Don't send your only copy, your account password, or unrelated personal records.
If the matter could go to court, preserve the native files as well as PDFs and screenshots. Follow the court's filing instructions instead of assuming an email attachment or cloud link will be accepted. A lawyer can advise you about materials that may be needed for discovery, authentication, or a formal request for records.
Do screenshots, hashes, or blockchain prove authenticity?
Each method answers a different question:
| Method | What it can help show | What it doesn't establish by itself |
|---|---|---|
| Screenshot | What appeared on a screen at a particular capture time | Who created the content or whether the screen was altered before capture |
| Print-to-PDF copy | A readable version of the page or record | Every piece of hidden, interactive, or original metadata |
| Native export | More of the source record and available metadata | That the export process was accurate or that the content is truthful |
| SHA-256 hash | That a particular file matches the file previously hashed | Who created it, where it came from, or whether it's admissible |
| Blockchain or audit log | That an entry was recorded in a particular system | That the underlying data was accurate, complete, or lawfully collected |
Blockchain isn't a legal shortcut. Rule 901 focuses on whether the item can be identified as what it's claimed to be, not whether it was placed on a blockchain. A careful collection record and a reliable explanation of the source may be more useful than a complex system that doesn't show how the data was obtained.
When should you use a forensic examiner?
Basic preservation is often enough for receipts, emails, account notices, and visible messages. Consider qualified forensic help if:
- Important files were deleted or a device is damaged
- A phone or computer is locked or encrypted
- The evidence includes a large cloud account or many devices
- The opposing side disputes the file's authenticity
- You need a report explaining the collection process
- The matter could involve serious litigation or a criminal investigation
Ask an examiner how they will preserve the original, calculate hashes, document access, protect private data, and explain their methods. A vendor's software can't by itself make evidence admissible. The court decides admissibility, and the collection history still matters.
Common digital evidence mistakes
- Saving only a screenshot instead of the native file or complete record
- Editing, cropping, compressing, or renaming the only original
- Failing to record the source URL, account, date, time, or time zone
- Saving one message without the surrounding thread
- Treating a downloaded file's timestamp as the date of the original event
- Mixing original files with annotated working copies
- Sending private data through a public link
- Assuming a matching hash proves authorship or truth
- Waiting until after an account, post, or recording has been deleted
Fixing these problems can be difficult after the fact. Preserve the source first, then make the clean copy you plan to share.
Frequently asked questions
Is a screenshot enough for a consumer complaint?
It may help show what you saw, but it's stronger when paired with the source URL or account, capture time, full context, and a native export or PDF. Keep the screenshot as a supporting copy rather than your only record.
Does FRE 901 require a SHA-256 hash?
No. Rule 901 requires evidence sufficient to support identification or authentication. A hash can support an explanation of file integrity, but the rule doesn't make one hashing method mandatory.
Should I put my evidence on a blockchain?
Usually not for an ordinary consumer dispute. A blockchain entry can record that information was logged, but it doesn't verify the underlying file, the person who created it, or the circumstances of collection.
How long should I keep digital evidence?
There isn't one retention period for every dispute. Keep the original, collection log, and related communications until the complaint or legal matter is resolved and applicable instructions or deadlines have passed. If a lawsuit is possible, ask a lawyer before deleting anything relevant.
What if the company says my download isn't acceptable?
Ask what format or information is missing. If appropriate, provide a readable copy and the native file through a secure channel, while keeping the original. Request the response in writing. If the matter moves toward litigation, check the court or agency's specific submission requirements.