Overview
A PDF containing text messages can become a central exhibit in a dispute. It can also leave important questions unanswered: Where did the messages come from? Does the document include the full exchange? Do the displayed names identify the actual participants? Was the file changed after export?
The useful starting point is to define which of those questions matters, then identify evidence capable of answering it. DFI Forensics approaches disputed message records by seeking to validate the material against its source where lawfully available. That may involve the original device, an account, a relevant backup, or another participant's records. PDF examination can contribute to the investigation, but the PDF alone may not settle whether the underlying exchange is authentic.
Separate the questions before examining the file
An instruction to “prove these messages are fake” assumes the answer before the investigation starts. A stronger instruction identifies the disputed proposition and permits findings in either direction.
For example, counsel might need to know whether a particular sentence appears in the available source records, whether a displayed exchange omits surrounding messages, or whether an attachment actually belongs to that conversation. Those are different examination questions. A document can reproduce genuine messages accurately while presenting an incomplete sequence. Conversely, an export can contain a formatting error without showing that anyone fabricated the conversation.
Write down the exact message, date range, participants, and disputed detail. Preserve the allegation separately from the facts already established. This keeps the examination proportionate and helps avoid spending the budget on an issue that does not affect the dispute.
Preserve the file as it was received
Keep the received PDF and the email, download record, or production correspondence that accompanied it. Record who supplied it, when it arrived, and any explanation of how it was created. If a different version appears later, retain both rather than replacing the earlier file.
Use a separate working copy for highlighting, annotations, or preparing exhibits. Ask the examiner to document file identification and integrity checks. A cryptographic hash can help demonstrate that the particular file examined has remained unchanged between recorded points. It does not establish that the messages inside the file were genuine before the file was collected.
Also preserve the export instructions or available tool details. Knowing that a document was produced through a particular application, with particular filters, may explain its layout or gaps. Without that information, an examiner may have to leave competing explanations open.
What examination of the PDF can contribute
An examiner can assess the file's internal structure, available metadata, text and image content, and any relevant indications of document processing. The appropriate tests depend on the file. A PDF made from screenshots presents different questions from a text-based export or a scanned printout.
Adobe documents PDF properties such as title and author, metadata such as creation and modification dates, and the ability to edit metadata without changing document content. The practical consequence is that an author field or creation date needs context; neither should be treated as a self-verifying record of who sent a message or when that message was sent. Adobe Document properties and metadata overview (opens in a new tab)
A later PDF creation date may simply reflect a later export. Different fonts may warrant investigation but do not automatically establish alteration. A clean-looking file also does not prove authenticity. The report should explain what each observation supports and what alternative explanations remain.
Work toward the underlying records
Where authority and access allow, the next step is to identify sources that can be compared with the disputed exhibit. Possible sources include:
- The device used to send or receive the relevant messages.
- An accessible account containing the relevant conversation.
- A backup covering the period in question.
- A linked computer or another authorized device.
- Another participant's independently preserved records.
- Related attachments or communications that help establish context.
These are possibilities to assess, not a promise that every source exists or can be collected. Device security, software versions, retention, account settings, and the history of the device can affect what is available. NIST's scientific foundation review emphasizes that investigators may not discover all digital evidence and that software changes can alter the meaning of artifacts. NIST Digital Investigation Techniques Scientific Foundation Review (opens in a new tab)
The comparison should address the disputed text, participant identifiers, chronology, surrounding messages, and attachments where available. A displayed contact name should be distinguished from an underlying phone number or account identifier. Time displays should be interpreted with the relevant time-zone assumptions stated.
When the opposing party's device is unavailable
Lack of access to the opposing party's phone is a real limitation. It does not prevent every useful inquiry, but it can prevent a direct comparison with the alleged source.
Start by identifying what is actually available. The client's device may contain part of the same exchange. A previously preserved backup may cover the relevant period. Production correspondence may identify an export method worth investigating. Counsel can assess whether further preservation or production should be sought through an appropriate process.
The examiner should not imply access that does not exist. A report based only on a PDF should say so. A report based on one participant's records should distinguish that source from the unavailable opposing device. If the question cannot be resolved with the available evidence, an inconclusive result is an appropriate finding.
Importantly, failure to locate a message does not, by itself, prove fabrication. Before drawing an inference, consider whether the collection covered the correct account and period, whether the source was complete, and whether retention or other technical limitations could explain the absence.
Questions worth asking before commissioning work
Can you invalidate the PDF?
The examination should test specified issues, rather than promise a desired result. Technical findings can inform counsel's position. Their legal effect and any question of admissibility depend on the applicable proceeding and should be addressed by counsel.
Will handing over my phone expose every private conversation?
Agree on authority, collection scope, review boundaries, and handling of unrelated or privileged material before collection. A narrowly defined review may still require a broader technical acquisition, depending on the method. The distinction should be explained in advance.
What if we only have screenshots inside the PDF?
Preserve them. They may help identify the disputed material and guide further collection. Ask what can be assessed from those images, what requires underlying records, and whether any conclusion would remain conditional.
Can we begin with a limited assessment?
Yes, a sensible proposal can separate initial file review and source identification from deeper acquisition and analysis. Ask for the decision point: what finding would justify the next stage, and what would make further work unlikely to help?
What a useful report should make clear
A decision-ready report identifies the question examined, the sources received, the methods used, and the findings tied to those sources. It should distinguish confirmed matches from unexplained differences and unavailable information. It should also explain any material collection or interpretation limits.
Before instructing an examiner, gather the original received file, the disputed passages, known device and account details, the relevant dates, and any production history. Avoid changing the devices or accounts merely to produce a cleaner exhibit before discussing preservation.
Contact DFI Forensics to discuss a source-focused assessment of disputed message evidence. The first conversation should establish what needs to be tested, which sources are lawfully available, and whether the proposed work can answer the question that matters to your case.
Sources and scope
PDF properties alone cannot establish whether a particular exhibit is authentic. A useful opinion depends on the available evidence, the examination methods and the limits of what those sources can establish.
