How to preserve digital evidence from your Mac: originals, time proofs and complete exports

Updated 2 November 2026

Also in: Español · Português

Keep the originals untouched and work only on copies, write down when and how you collected each item, and make it possible to show later that nothing changed: a checksum for every file, screenshots with a time anyone can verify, and whole conversations exported rather than cropped. A court or an investigator decides what counts as evidence; your job is a record that is complete and can be checked.

Four rules that cover most cases

1. Leave the original alone. Don’t edit it, re-save it or convert it. Opening a photo and saving it again changes the file, even if it looks the same.
2. Copy, then work on the copy. Put the originals in one folder, and do any cropping, marking or printing elsewhere.
3. Write down how you got each item: the date, the device, where it came from and what you did with it. This is the chain of custody, and it answers the first questions anyone will ask.
4. Make changes detectable, with a fingerprint of each file, as described below.

Fingerprint a file on a Mac

A SHA-256 checksum is a long code calculated from every byte of a file. Change one pixel or one letter and the code is completely different, so if the code you record today still matches next year, the file is the same. macOS has the tool built in:

1. Open Terminal (in Applications › Utilities).
2. Type shasum -a 256 with a space at the end, drag the file into the window, and press Return.
3. Copy the code into your log, next to the file’s name and the date.

A checksum proves the file hasn’t changed since you wrote the code down; it can’t prove when that was. For that, you need a time from somewhere other than your own Mac.

Screenshots with a time anyone can check

A Mac names a screenshot with the date and time from its own clock, and that clock can be set to anything; file dates can be changed too. That is why a screenshot on its own is easy to challenge.

What a time proof can’t do: it shows that this exact image existed at that moment, not who made it or whether what was on the screen was true.

Web pages and posts

Capture the whole page with its address visible, and save it as a PDF too: in Safari, File › Export as PDF. Write down the address and the time you saw it. Pages change and disappear, so do this the day you find them.

Text messages

A complete conversation is stronger evidence than a handful of screenshots. Textbound exports a Messages conversation from your Mac in its Record layout (Pro): every message with its sender and a timestamp to the second, attachments with their SHA-256, page numbers, and a fingerprint of the whole export that File › Verify an Export… compares against Messages later. It only reads your message history, never changes it, and uploads nothing. Its guide on printing text messages for court covers what a printout should show.

Photos and videos

Keep the original files: they carry the date taken and, often, the place. From the Photos app, use File › Export › Export Unmodified Original; an ordinary export makes a new, re-encoded file instead. When the evidence is one moment in hours of video, from a doorbell camera or a phone left recording, Seekframe finds it when you describe it (“a person at the door at night”) and opens the clip at that point, analysing the files on your Mac.

What to hand over

• the originals, in their own folder;
• the working copies and printouts;
• your log: what each item is, where it came from, when you collected it, and its checksum.