There is a real distinction between “I have proof” and “I have an exhibit.”
Evidence sitting on your phone is raw material; an exhibit is that material authenticated, labeled, and presented so a court can rely on it.
This guide walks the path between the two so you know what a lawyer or examiner is actually doing with what you hand over.
1. Authenticate it
The threshold question for any exhibit is authentication: is this item what you say it is?
Federal Rule of Evidence 901 sets that bar, and Rule 902 lists records that are self-authenticating — including, under 902(13) and 902(14), certain electronic records and copies certified by a qualified person.
Preserving the original (not just a screenshot) is what makes authentication possible.
2. Preserve custody and integrity
A court wants confidence the item has not changed.
That comes from a documented chain of custody and verifiable integrity — SWGDE’s best practices cover the handling, and NIST’s SP 800-86 frames the forensic process around protecting the original data’s integrity.
Hashing on ingest is the practical mechanism: a fingerprint that proves nothing changed.
3. Summarize the voluminous parts
Cases often involve more records than anyone can read in a courtroom — a thousand transactions, a year of messages.
Federal Rule of Evidence 1006 allows those to be presented through an accurate summary, provided the originals were available.
That is how a mountain of data becomes one clear exhibit without losing its backing.
4. Label and present
Finally, the item is numbered, labeled, and packaged with the context a court needs.
Done well, the exhibit tells its own story: here is the item, here is proof it is genuine, here is where it has been.
SleuthX produces court-ready reports and numbered exhibits from evidence held in its chain-of-custody vault.
If you are still gathering material, start with organizing evidence for a lawyer or the police.
