When a PDF of Text Messages Is Disputed

Overview

A PDF containing text messages can become a central exhibit in a dispute. It can also leave important questions unanswered: Where did the messages come from? Does the document include the full exchange? Do the displayed names identify the actual participants? Was the file changed after export?

We start by understanding which question matters to your case, then identify the evidence that may answer it. When we examine disputed message records, we seek to validate the material against its source where lawfully available. That may involve the original device, an account, a relevant backup, or another participant's records. PDF examination can contribute to the investigation, but the PDF alone may not settle whether the underlying exchange is authentic.

Separate the questions before examining the file

An instruction to “prove these messages are fake” assumes the answer before the investigation starts. A stronger instruction identifies the disputed proposition and permits findings in either direction.

For example, counsel might need to know whether a particular sentence appears in the available source records, whether a displayed exchange omits surrounding messages, or whether an attachment actually belongs to that conversation. Those are different examination questions. A document can reproduce genuine messages accurately while presenting an incomplete sequence. Conversely, an export can contain a formatting error without showing that anyone fabricated the conversation.

Write down the exact message, date range, participants, and disputed detail. Preserve the allegation separately from the facts already established. This keeps the examination proportionate and helps avoid spending the budget on an issue that does not affect the dispute.

Preserve the file as it was received

Keep the received PDF and the email, download record, or production correspondence that accompanied it. Record who supplied it, when it arrived, and any explanation of how it was created. If a different version appears later, retain both rather than replacing the earlier file.

Use a separate working copy for highlighting, annotations, or preparing exhibits. Ask the examiner to document file identification and integrity checks. A cryptographic hash can help demonstrate that the particular file examined has remained unchanged between recorded points. It does not establish that the messages inside the file were genuine before the file was collected.

Also preserve the export instructions or available tool details. Knowing that a document was produced through a particular application, with particular filters, may explain its layout or gaps. Without that information, an examiner may have to leave competing explanations open.

What examination of the PDF can contribute

We can examine the file's internal structure, available metadata, text and image content, and relevant indications of document processing. We choose the tests to fit the file and the question you need answered. A PDF made from screenshots presents different questions from a text-based export or a scanned printout.

Adobe documents PDF properties such as title and author, metadata such as creation and modification dates, and the ability to edit metadata without changing document content. The practical consequence is that an author field or creation date needs context; neither should be treated as a self-verifying record of who sent a message or when that message was sent. Adobe Document properties and metadata overview (opens in a new tab)

A later PDF creation date may simply reflect a later export. Different fonts may warrant investigation but do not automatically establish alteration. A clean-looking file also does not prove authenticity. We explain what each observation supports and which alternative explanations remain, so you can understand the significance of the findings.

Work toward the underlying records

Where authority and access allow, the next step is to identify sources that can be compared with the disputed exhibit. Possible sources include:

• The device used to send or receive the relevant messages.
• An accessible account containing the relevant conversation.
• A backup covering the period in question.
• A linked computer or another authorized device.
• Another participant's independently preserved records.
• Related attachments or communications that help establish context.

These are possibilities to assess, not a promise that every source exists or can be collected. Device security, software versions, retention, account settings, and the history of the device can affect what is available. NIST's scientific foundation review emphasizes that investigators may not discover all digital evidence and that software changes can alter the meaning of artifacts. NIST Digital Investigation Techniques Scientific Foundation Review (opens in a new tab)

The comparison should address the disputed text, participant identifiers, chronology, surrounding messages, and attachments where available. A displayed contact name should be distinguished from an underlying phone number or account identifier. Time displays should be interpreted with the relevant time-zone assumptions stated.

When the opposing party's device is unavailable

Lack of access to the opposing party's phone is a real limitation. It does not prevent every useful inquiry, but it can prevent a direct comparison with the alleged source.

Start by identifying what is actually available. The client's device may contain part of the same exchange. A previously preserved backup may cover the relevant period. Production correspondence may identify an export method worth investigating. Counsel can assess whether further preservation or production should be sought through an appropriate process.

We make the basis of our examination clear. If we can examine only the PDF, we say so. If we use one participant's records, we distinguish that source from the unavailable opposing device. When the available evidence cannot resolve your question, we report an inconclusive finding rather than imply certainty.

Importantly, failure to locate a message does not, by itself, prove fabrication. Before drawing an inference, consider whether the collection covered the correct account and period, whether the source was complete, and whether retention or other technical limitations could explain the absence.

Questions worth asking before commissioning work

Can you invalidate the PDF?

The examination should test specified issues, rather than promise a desired result. Technical findings can inform counsel's position. Their legal effect and any question of admissibility depend on the applicable proceeding and should be addressed by counsel.

Will handing over my phone expose every private conversation?

Agree on authority, collection scope, review boundaries, and handling of unrelated or privileged material before collection. A narrowly defined review may still require a broader technical acquisition, depending on the method. The distinction should be explained in advance.

What if we only have screenshots inside the PDF?

Preserve them. They may help identify the disputed material and guide further collection. Ask what can be assessed from those images, what requires underlying records, and whether any conclusion would remain conditional.

Can we begin with a limited assessment?

Yes, a sensible proposal can separate initial file review and source identification from deeper acquisition and analysis. Ask for the decision point: what finding would justify the next stage, and what would make further work unlikely to help?

What a useful report should make clear

We structure our reporting around your question, the sources received, the methods used and the findings those sources support. We distinguish confirmed matches from unexplained differences and unavailable information, and explain material collection or interpretation limits.

Before instructing an examiner, gather the original received file, the disputed passages, known device and account details, the relevant dates, and any production history. Avoid changing the devices or accounts merely to produce a cleaner exhibit before discussing preservation.

Talk with us about the message evidence in your case. We begin by clarifying what needs to be tested and which sources are lawfully available, so we can assess whether the proposed work is capable of answering your question.

Sources and scope

PDF properties alone cannot establish whether a particular exhibit is authentic. A useful opinion depends on the available evidence, the examination methods and the limits of what those sources can establish.