How to preserve text messages as a record

If a conversation might matter in a formal process, whether that is a solicitor, an HR investigation, a landlord dispute, an insurance claim or a court, the way you preserve it matters as much as the fact that you preserved it.

This is not legal advice, and nothing here says what any particular body will accept. It covers what tends to be asked for, and what software can and cannot do about it.

Why screenshots are the weakest option

Screenshots are the most common thing people produce, and the easiest to challenge:

• They are trivially editable. Anyone can change the text in a screenshot in a few minutes. A screenshot carries no evidence of its own origin.
• They are selective by nature. You screenshot the messages that matter to you. The obvious question is what was in the messages either side of them, and a set of screenshots cannot answer it.
• They lose context. Full timestamps, the participants, and whether a message was edited or unsent are frequently cropped out.

Screenshots are better than nothing. They are the floor, not the goal.

What a complete preservation includes

The bar that tends to be applied is roughly: could someone else verify this is the whole thing, unaltered?

That usually means:

The complete conversation, not extracts. Producing only the helpful parts is the fastest way to have the whole submission treated as unreliable. Preserve the entire thread and let the relevant parts be pointed to within it.

Both sides, with attribution. Who sent each message, resolved to an actual identity rather than an unlabelled bubble.

Full timestamps. Not “Tuesday”, the actual date and time, in a stated format. ISO 8601 avoids the ambiguity between British and American date order, which is a real problem in international matters.

The original attachments. At the resolution they were sent, kept as separate files. A photo squashed into a PDF page has lost the metadata and the detail that might be the entire point of it.

A record of what is missing. This one is counterintuitive but important. If an attachment was never downloaded to the device, or a message payload could not be decoded, that should be stated explicitly in the record rather than silently omitted. A preservation that quietly drops things is worse than one that declares its gaps, because a gap you know about can be explained.

Evidence that the copy has not changed. This is where checksums come in.

What checksums actually do

A checksum is a fixed-length fingerprint computed from a file’s contents. Change one byte and the fingerprint changes completely.

If your archive includes a manifest listing a SHA-256 checksum for every file in it, then at any point later you can recompute those checksums and compare. If they match, the files are byte-for-byte identical to when the archive was made. If one does not match, that file has changed.

What this does not do is prove the messages themselves are genuine, or prove when the archive was created. A checksum computed at export time shows integrity from that moment onward. It does not authenticate what came before it. Anyone claiming a checksum makes messages “court-proof” on its own is overselling it.

What it does give you is a straightforward answer to “how do we know this file has not been edited since you produced it,” which is a question that otherwise has no good answer.

If you need to demonstrate when the archive existed, that is a separate step: have the checksum manifest witnessed, emailed to a third party, or timestamped by a service, at the time of export rather than later.

A practical procedure

1. Preserve early. Messages get deleted, accounts get closed, phones get replaced. The copy you make today is worth more than the one you plan to make later.
2. Back up the device first. Connect the phone, open Finder, select the device, Back Up Now. Export from that backup rather than only from a Mac’s synced library, because the backup usually holds more.
3. Export the whole conversation, both sides, all attachments, with timestamps.
4. Do not edit the archive. Not to tidy it, not to remove something irrelevant. If redaction is needed, produce a separate redacted copy and keep the original untouched.
5. Record the checksums, and note the date and time you exported.
6. Store two copies, in different places, and leave them alone.
7. Hand over the whole archive when asked, not a curated subset.

What software cannot promise

No application can make a record admissible. Admissibility is decided by the body receiving it, according to its own rules, and those differ by country, by court and by the type of proceeding. A tool can make a preservation complete, verifiable and clearly documented. Whether that is accepted is not up to the tool, and any product claiming otherwise is making a promise it is not in a position to keep.

If the matter is serious, ask whoever will receive the record what format they want before you produce it. It is a short question that avoids a lot of wasted work.