Authenticating text messages in Massachusetts: what Rule 901 wants

Massachusetts trial judges see more text-message exhibits than email these days. The standard under Mass. G. Evid. § 901(b) is familiar — authenticate by any evidence sufficient to support a finding that the item is what the proponent claims — but the practical bar is higher than many practitioners realize.

What a screenshot cannot prove

A screenshot shows you an image of a message on a device at a moment. It does not, without more, establish:

• Authorship (anyone with the unlocked device could have typed it)
• Integrity (mobile OS UIs are trivially editable in iOS Shortcuts and Android accessibility)
• Context (threads may be filtered; a reply may be displayed out of order)

Opposing counsel who knows this will keep the exhibit out on a motion in limine.

What a forensic extraction gives you

A proper mobile extraction — Cellebrite UFED, GrayKey, Magnet AXIOM — recovers:

• Message database files with cryptographic integrity hashes
• Sender/recipient handles tied to account identifiers
• Timestamps in multiple system zones (device, server, UTC)
• Deleted messages recoverable from SQLite WAL journals
• Rich-media attachments with MIME headers and EXIF timestamps
• Application metadata (read receipts, edit history, reactions)

Paired with an examiner’s affidavit, this package typically satisfies 901(b)(1) (testimony of a witness with knowledge), 901(b)(4) (distinctive characteristics) and 901(b)(9) (process producing an accurate result) simultaneously.

A practical checklist

1. Preserve the device in airplane mode until forensic imaging.
2. Chain-of-custody log from the moment counsel takes possession.
3. Full logical + file-system extraction when legally available; advanced logical where FBE locks prevent it.
4. Examiner affidavit keyed to the extraction report.
5. Redaction memo for privilege / irrelevant content before production.

When the threshold evidence will live or die on a single thread, we will send an examiner to counsel’s office to image the device in your presence. No data leaves your building until you hand it over.