Are Text Message Screenshots Evidence? What HR Should Check

An employee walks into HR with a screenshot. It shows a coworker sending something ugly. The thread looks right. The names look right. The timestamps look right.

Can you act on it? Not yet.

Short Answer: A Screenshot Is a Claim

Courts do admit screenshots. But admitting a screenshot is not the same as proving it is true. Digital forensics expert Lars Daniel puts it this way: a screenshot of a text message is a photocopy of evidence. It shows what a screen displayed at one moment. It is not the message record itself.

In US federal court, the test is Federal Rule of Evidence 901. The person offering an item must "produce evidence sufficient to support a finding that the item is what the proponent claims it is." The rule lists ways to do that. One is testimony from a witness with knowledge. Another is the item's appearance, contents, substance and other distinctive characteristics, taken together with the circumstances.

Your HR file is not a courtroom. But the same question applies: what shows this is what it says it is?

Why Screenshots Are Weak Evidence

• Anyone can make one. Daniel notes that free websites have let people build fabricated text conversations for over a decade. No account, cost or skill needed. Generative AI makes it faster.
• A screenshot has no record behind it. A real text is a database entry on a phone. It has system-written timestamps, sender and recipient identifiers, delivery and read flags, and traces left by deletion. A screenshot has none of that.
• You see one moment. It does not show what came before, what came after, or what was deleted.
• It cuts both ways. Daniel calls this the "liar's dividend." When fakes are easy, real messages can be denied as fake.

Fakes already decide cases. In Daniel's workplace investigations column, a federal employment case was dismissed with prejudice after the court found the plaintiff's image of harassing texts was fabricated. In another matter, a Colorado disciplinary ruling disbarred a former prosecutor over four fabricated texts that framed a coworker for sexual harassment. The coworker was cleared when a forensic exam of his own phone found no communication between his number and hers.

How Fakes Get Made (The Short Version)

You do not need a how-to to spot one. Know the families:

1. Edited real chats. Someone changes the words, names or times in a real image.
2. Built from scratch. A design tool or a mockup generator produces a clean thread that never existed.
3. AI generated. An image model draws the whole conversation.
4. Real messages, wrong person. Someone sends texts to themselves and relabels the contact. In the Colorado matter, the ruling says she did exactly that.

All four produce the same artifact: a flat picture. That is why the picture alone cannot settle it.

Here are two teaching examples. Both are made in Mockly with fictional coworkers. Either could be handed to an investigator, and nothing in the image tells you which thread is real.

What Investigators Do Instead

Daniel calls a forensic examination of the device "the strongest, and often only, available answer" to whether a specific conversation existed. In his words, device-level forensics "in almost every instance is as close to proof as digital evidence gets." Here is what the toolbox looks like.

• Examine the device. The phone holds the message record and the artifacts around it. Daniel says the device can corroborate a real thread or show it is not real. In the Rossbach v. Montefiore Medical Center case he cites, forensic analysis showed the text image was not a photograph and did not match how an iPhone renders text. The court found by clear and convincing evidence it was fabricated.
• Check both phones. Tracey Diamond of Troutman Pepper Locke, quoted in the column, recommends checking the accuser's phone and the alleged sender's phone to see whether the messages appear on both. She also recommends checking deleted files.
• Use carrier records, with limits. Daniel says they can show messages moved between two numbers. They generally do not contain message content. For many modern messaging apps, they may not show even that.
• Use backups, with limits. Cloud backups may be stale, partial or never enabled. They hold only what synced.
• Use employer systems. For Slack, Teams and email, the column notes that company archives and audit logs keep records neither side can easily rewrite. Personal phones sit outside them.
• Get a certified copy. Federal rules also let data copied from a device be authenticated by a "process of digital identification," shown by a certification from a qualified person (Rule 902(14)).
• Treat metadata as a hint. A file's details can raise doubt, but Daniel has a whole post on why metadata alone cannot prove a file is real.

Keep a chain of custody. Write down who held the device or file, when, and what they did with it. The Colorado case shows what goes wrong without one: per the ruling, she destroyed her phone and laptop before examination.

A Checklist for HR Before You Act

1. Ask for the original, not the picture. Ask the person to show the thread on their phone, and for an export of the conversation.
2. Ask for context. Get the whole thread, not one crop. Note what is missing around it.
3. Preserve now. Ask both parties to keep their phones and not delete anything. Daniel's preservation letter guide covers why this matters.
4. Check company systems first. If the thread was on Slack, Teams or work email, pull the archive and audit logs.
5. Get consent or counsel before you touch a personal device. Daniel notes access to personal devices requires consent or counsel.
6. Bring in a forensic examiner when the stakes are high: a firing, a harassment claim, a legal threat.
7. Hold the discipline. Acting on a fake wrongly punishes someone. Dismissing every message as possibly fake lets real misconduct continue. Daniel names both risks. Neither is fine, so check first.
8. Write down who did what. Date, person, step. This is your own chain of custody.

Diamond reminds employers that they owe a prompt and thorough investigation whenever a policy or law may have been violated. Verifying is part of that duty.

Red Flags in the Picture Itself

The picture cannot prove a thread is real, but it can show it is fake. Read receipts on the wrong side, a status bar from the wrong phone, a timestamp in the wrong spot, replies that arrive too fast, a conversation that is a little too tidy. Our guide on how to spot a fake screenshot goes app by app.

A clean result proves nothing. A fake can pass every visual check. Use red flags to decide how hard to dig, not to decide the case.

Where Mockly Fits

Mockly makes mockups for creators, teachers and marketers: tutorials, course material, client decks and storytelling. It is not for evidence, and you should never pass a mockup off as a real conversation. Honest mockup tools say so on the output. Free exports from Mockly carry a watermark.

If you teach digital literacy or run HR training, a mockup is a handy way to show staff how convincing a fake can look. Build one with fictional names in the text message editor, the iMessage editor or the Slack editor.

FAQ

Are text message screenshots admissible as evidence?

Often, yes. Courts can admit them. But the party offering one must still show it is what they say it is, under rules like Federal Rule of Evidence 901. Admissible is not the same as true. Ask a lawyer how your state handles it.

Can HR rely on a screenshot to fire someone?

It is risky on its own. Verify first: ask for the original thread, check company systems, and get counsel involved. Acting on a fabricated message can wrongly discipline someone.

How do you verify a text message screenshot?

Find the message on the device it came from, ideally both devices. A forensic examiner can show whether a thread existed. Carrier records and backups can help but have limits. Metadata alone does not prove a file is real.

Can a phone carrier confirm a text was sent?

Carrier records can show messages moved between two numbers. They generally do not contain message content, and for many messaging apps they may not show even that.

Can employers look at an employee's personal phone?

Access to a personal device requires consent or counsel. Do not take the phone or search it on your own.

What if the message is real but the sender says it is fake?

That is the liar's dividend. A device-level exam can corroborate a real thread, which is the same tool that clears someone framed by a fake.

Does Mockly help people fake real conversations?

No. Mockly is for fictional and approved scenarios: content, teaching and client work. It is not for evidence, and it is not for deceiving anyone.