Screenshot Metadata: What Opposing Counsel Looks For (2026)

July 12, 2026

When you offer a screenshot as evidence, you are inviting a specific examination. Opposing counsel’s expert will not start by arguing about what the image shows. They will start with what the file is: when it was created, on what, by what, and whether any of that matches the story it is supposed to tell. Screenshots fail that examination often enough that there is now a small canon of case law about it.

This guide walks through the most instructive fabrication case, what a screenshot’s metadata actually contains and lacks, and what a capture needs so that this examination helps you instead of hurting you.

The case that shows the whole playbook

Rossbach v. Montefiore Medical Center, No. 1:19-cv-05758 (S.D.N.Y. 2021) is the case every litigator should read before offering a phone screenshot. The plaintiff in a harassment suit produced an image of text messages she said her supervisor sent, claiming she had photographed her damaged iPhone 5’s screen using an iPhone X.

The defense expert took the image apart on its own internal evidence. The court’s findings, in Judge Denise Cote’s opinion: the “heart eyes” emoji in the image “is the version displayed on iPhones running OS 13 or later,” an operating system the iPhone 5 cannot run; “the font used in the image differs, albeit subtly, from that used to display text messages on iPhones”; the contact bar showed the supervisor’s full first and last name “while an authentic iPhone OS image would display only his first name”; and the file “lacked metadata typically associated with a picture from an iPhone X,” with analysis indicating “that it [was] not a photograph at all.” The image did not even show a cracked screen, despite testimony that the iPhone 5 was damaged.

The court’s conclusion was five words: “This image is a fabrication.” The case was dismissed with prejudice, with a reported monetary sanction of $157,026.27 imposed jointly on the plaintiff, her attorney, and his firm. On appeal, the Second Circuit, at 81 F.4th 124 (2d Cir. 2023), affirmed the dismissal and the sanction against the plaintiff, while vacating the sanction against the attorney and firm for want of an express bad-faith finding, and restated the core forensic point: the document “did not depict text messages as they would appear on an iPhone 5 (or, in fact, any iPhone), due to differences in the appearance of icons and contact information, font size and style, and emoji design.”

Notice what carried the analysis: fonts, emoji versions, interface conventions, and missing metadata. No server records were needed. The screenshot indicted itself.

What a screenshot’s metadata actually says

The first thing an examiner runs on your exhibit is a metadata tool, typically ExifTool, the standard utility “for reading, writing and editing meta information in a wide variety of files,” which reads PNG, JPEG, and HEIC alike. Here is roughly what they will and will not find in a typical phone screenshot.

What it contains: a file creation and modification timestamp, pixel dimensions (which hint at the device model), and a color profile.

What it lacks: nearly everything that matters. Forensic practitioners are blunt about this. Screenshots do not carry the rich EXIF data of a camera photograph; iPhone and iPad screenshots contain no GPS data. One forensic firm puts the core problem cleanly: “screenshots sever the link to the source file. There’s no verifiable connection between the screenshot and the original media.” And a screenshot of a web page or message thread contains, as a matter of what the format records, no source URL, no server-side timestamp, and no identity for who wrote what it depicts; those claims ride entirely on the witness offering it. Print it out and it gets worse; as one digital forensics lab likes to say, “there’s no metadata in a piece of paper!”

The ABA Litigation Section’s practice guidance for screenshot evidence says the quiet part plainly: “Metadata such as dates and times, full lists of recipients, document type, and other useful information is often missing in screenshots,” and “courts may also place greater weight on evidence with metadata and other hallmarks of reliability.”

The examination cuts both ways

Rossbach is the fabrication case. Edwards v. Junior State of America Foundation, No. 4:19-CV-140 (E.D. Tex. 2021) is the preservation case, and it stings more because nothing was necessarily fake. Plaintiffs offered screenshots of racist Facebook messages, but the underlying account had been deleted, so the native files, with their metadata, could never be produced or examined. The court reasoned that screenshots alone could not establish authenticity where native files were gone, noted how easily fake social media conversations can be manufactured, and barred the plaintiffs from presenting evidence of the messages at all.

Read the two cases together and the lesson is symmetrical. Metadata scrutiny destroys fabricated screenshots, which is good. It also destroys honest screenshots that cannot back themselves up, which is the part that should worry you. When the only record of the evidence is pixels an interested party produced, you inherit both risks.

What to capture instead

Working backward from what examiners check, a capture that survives the metadata examination needs four properties, and they mirror the chain of custody requirements we cover elsewhere: a recorded URL, timestamp, and process, written by the capture system rather than asserted by a witness; the machine-readable content, not just an image of it; cryptographic hashes computed at capture time, before anything could be altered, which SWGDE’s imagery-integrity best practices treat as baseline (“Hashing should be performed prior to and subsequent to a copy function”); and a capture performed by a neutral automated system, so no interested party is the exhibit’s only voucher. Hashes computed at capture are also what a self-authentication certification under FRE 902(14) is built on.

Screenshots still have a role: leads, working notes, the thing you grab in the ten seconds before a story disappears. But when the content is going to be contested, treat the screenshot as the bookmark, not the exhibit.

Where Permavault fits

Permavault captures the page itself, not a picture of it. Paste the URL and a neutral automated system preserves the full page as it rendered, records the URL, timestamp, and process, fingerprints every file with cryptographic hashes at capture, and stores the result on a permanent decentralized network of roughly 300 independent nodes, funded by a long-term storage endowment. Anyone, including the examiner on the other side, can verify the capture without trusting us, which turns the metadata examination from a threat into your strongest argument.

Each capture is $4.99, with an optional Certificate of Authenticity from $9. The Legal tier adds a qualified electronic timestamp from Disig a.s., an EU-listed qualified trust service provider, applied to the signed capture manifest, plus an independent Bitcoin-anchored timestamp and a declaration template designed to support authentication under FRE 902(13) and 902(14). Under eIDAS Article 41, a qualified electronic timestamp carries a presumption of the accuracy of its date and time in EU courts.

Opposing counsel is going to look at the metadata. The only question is whether what they find ends your exhibit or ends the argument.

This article is general information, not legal advice for any specific matter. Case outcomes depend on their facts; admissibility always depends on the facts, the jurisdiction, and the judge.