Home · Guides · updated 2 September 2026

Screenshots, and why an export is stronger

Most chat evidence still arrives as screenshots, because that is what people have. They are the weakest form the same conversation can take, and the difference is worth understanding before a filing depends on it.

What a screenshot is

A screenshot is a picture of what the application was displaying. It is an electronic record and it can be certified. What it is not is the conversation — it is a rendering of part of one, produced by the person who chose the moment and the frame.

The four differences that matter

• A screenshot has no continuity. An export runs from one date to another and the gaps are visible. A set of screenshots shows exactly what was captured, and nothing tells a reader what fell between them.
• A screenshot is croppable by design. Cropping leaves no trace, and taking a screenshot after editing a contact name, or in a chat opened on a second device, produces an image that looks identical to an honest one.
• A screenshot carries no structure to test. An export is a text file written by an application, with an encryption preamble, timestamp formats, filename conventions and archive entry times — features an edited file loses. A PNG has none of that; there is nothing to check.
• A screenshot cannot be reconciled with its attachments. An image thumbnail in a screenshot is a picture of a thumbnail. The file behind it is not produced, cannot be hashed and cannot be opened.

The consequence is not that screenshots are inadmissible. It is that a screenshot answers “what did the screen show” and an export answers “what was in the conversation”, and courts are increasingly alive to the difference.

The hash point

You can hash a screenshot, and you should. But note what it fixes: the image file, from the moment it was hashed. It does not fix the conversation, because the image was already a selection from it. With an export, the hash fixes the whole record — every message in the range, including the ones that do not help you. That is precisely why it is worth more.

When a screenshot is all there is

There are real cases: a status update, a disappearing message, a profile photograph, a message deleted after you saw it, a conversation on a device you no longer have. Produce them, and produce them properly:

1. Produce the original image file from the device. Not a photograph of a screen, not an image pasted into a document, not a print. Each of those is a new file, and each loses whatever the original carried.
2. Hash every image separately and list the values.
3. Depose to how each was taken — which device, when, in which application, and by whom.
4. Say what is not there. If the screenshots are four moments from a two-year conversation, say so. An opponent who establishes that first will make more of it than it is worth.
5. Export the conversation as well if it still exists. Where both are available the export is the record and the screenshots are, at most, corroboration of something the export does not carry.

Screenshots of an export

One thing to avoid entirely: taking screenshots of a transcript, or printing an export to PDF and treating the PDF as the record. The certificate identifies a file by its hash; a converted copy is a different file, the hash no longer matches, and the certificate no longer describes what was filed. Print the readable form by all means — but file the native record with it. See filing a chat exhibit.

What to do first

If the conversation is still on a phone you control, export it before doing anything else. How to export takes two minutes, and it converts the weakest form of the evidence into the strongest one available.

---

This guide explains procedure and states the law as we understand it. It is not legal advice, and Aarohan Enterprises is not a law firm. Whether a court admits a particular record, and what weight it gives it, is for that court to decide. Have an advocate settle anything you intend to file.