FRE 901: *how U.S. courts authenticate* emails, screenshots and AI files

Why authentication matters

Evidence that looks real but isn't has decided court cases since long before Photoshop. Federal Rule of Evidence 901 puts the burden on whoever offers the evidence to show that it is what they say it is. In practice, that means emails, screenshots, text messages, videos and documents all have to be authenticated before a jury sees them.

The rule itself is short. It asks for "evidence sufficient to support a finding that the item is what the proponent claims" ^[1]. It doesn't say how much is enough, so courts decide case by case. What works in one district might not work in another, and what a magistrate waves through one day might be rejected by a different judge the next.

Think of it like a receipt. If you claim you bought a toaster on a certain day, the shop receipt is good proof. If the receipt is a photo of a screen and the date is blurry, the other side will ask questions. Courts do the same with digital files.

Emails: addresses, details and admissions

Most email authentication turns on three things: the sender's address, details in the message and whether the other side admits it's real.

If an email comes from the right address and contains information only the claimed sender would know, courts usually accept it ^[2]. If the recipient replied and the conversation makes sense, that helps. If the other side says "yes, I sent that", authentication is done.

Problems start when the address is generic, the content is vague or the other side denies sending it. Forged headers and spoofed addresses are common enough that judges don't assume an email is genuine just because it looks like one. Metadata from the mail server can help, but the proponent has to ask for it and know what to do with it.

Screenshots: easy to take, hard to prove

A screenshot is a picture of a screen. Courts treat it as what it is: a claim about what was on that screen at a particular moment, with no independent proof that it's accurate or complete.

Social media screenshots are challenged constantly. The other side will say the account is fake, the post was edited, the date is wrong or the screenshot has been cropped to remove context. In response, judges often ask for testimony from whoever took the screenshot, metadata showing when it was captured, or a signed certificate from the platform ^[3].

Some courts have accepted screenshots with little more than testimony that they look right. Others have thrown them out when the proponent couldn't show the post still existed or explain gaps in the timeline. The rule is the same everywhere; the outcomes aren't.

Video, audio and the deepfake problem

Video used to carry weight because it was hard to fake convincingly. That's changing. Generative AI can now produce video and audio that look and sound real, and courts know it.

Authentication of video usually involves testimony from whoever recorded it, metadata showing the file properties, and sometimes expert analysis to confirm it hasn't been edited ^[4]. For audio, voice recognition by someone who knows the speaker can be enough, but if the other side raises a credible challenge, the proponent will need more.

Deepfakes have made judges warier. A video of someone saying something surprising is no longer taken at face value. If the stakes are high and the content is contested, expect the court to ask for proof that the file is what it was on the day it was captured, and that nobody has touched it since.

AI-generated content: the new frontier

When a file is created by an AI system, authentication has an extra layer. It isn't just whether the file is what you say it is; it's also whether the system that made it did what you claim.

Say a company offers a report that its AI generated on a certain date. The other side will ask: which version of the model, which data, and how do we know the file hasn't been edited since? If the company kept no record of the generation event, authentication becomes a problem.

Under the EU AI Act, high-risk systems must log events like this from 2 December 2027 for Annex III systems and 2 August 2028 for those in Annex I, and the logs have to be kept for at least six months ^[5]. U.S. law doesn't require logs, but courts are starting to expect them. When they don't exist, or when the party offering the evidence controlled them the whole time, the other side has an opening.

How a digital witness makes authentication easier

Here, a digital witness fits directly. The thing to seal is the file at the moment it's created, captured or generated: an email as it's sent, a screenshot when it's taken, a video at capture, or a report when the AI writes it. Sealing takes a fingerprint of the file, not the file itself, so the content never leaves your systems. The fingerprint is posted to WitniumChain, which anyone can check, and you get a witness ID back.

Months later, when someone questions the file in court, you or your lawyer calculate the fingerprint again and compare it with the sealed one. If it matches, the file hasn't changed. Change a single pixel or character and it won't match. Anyone can check it, including the other side, the judge and an expert witness, and the check is independent: even we can't make a changed file match.

What it shows is that the file is the one that existed when it was sealed. What it doesn't show is that the content is true, that the sender is who you say, or that the AI's output was correct. Authentication under FRE 901 is narrow: is this thing what you claim? A sealed fingerprint answers that part quickly.

You can seal files through the REST API, the SDK or the MCP server. The first 2,000 witnesses a month are free. Documentation is at witniumchain.com/docs.

How it would work

1. Seal the file when it's created, sent or captured. Your system sends the fingerprint to WitniumChain and stores the witness ID with the file.
2. When the file is challenged, calculate the fingerprint again and check it against the sealed one.
3. Share the witness ID with the court and the other side. They can verify it independently.

What this means for you

If you're a lawyer, ask early whether the other side can authenticate their exhibits, and build your own record as you go. Screenshots and emails are easy to question if there's no corroboration.

If you run systems that generate records people might rely on later—AI outputs, transaction logs, communications with customers—decide now who keeps the proof. Waiting until litigation starts means the other side controls the narrative.

For in-house teams, the question is whether you could show a court that a file is what you say it is, six months or two years from now. If the answer depends on hoping the other side doesn't push, that's a gap.

What to watch

FRE 901 isn't changing, but how courts apply it is. Expect more scepticism about digital evidence as AI tools become common, and more demands for proof that files haven't been altered. The EU's logging requirements for high-risk AI, which apply from 2 December 2027 for Annex III systems, will set a standard that U.S. courts may start to expect even when the law doesn't require it.