If you may need files as evidence, stop changing them, make a protected copy, write down where each file came from, and record a fingerprint and a timestamp of the copy. Don’t edit, rename or “tidy up” the originals, don’t delete anything, and don’t rely on screenshots alone. Your lawyer will tell you what to preserve and how, so use this checklist as a starting point and ask first if the matter is serious. A timestamp shows a file existed no later than a recorded time. It doesn’t show the contents are true. This is general information, not legal advice.
Table of Contents
1. Stop and leave the originals alone
- Don’t edit, rename, move or re-save the files you care about.
- Turn off auto-delete settings for chats and email if you can, and ask your lawyer first.
- Don’t delete accounts, devices or old messages, even if they seem harmless. Deleting material that may be relevant can cause problems later.
2. Write down the basics now
For each important item, record:
- What it is (a contract draft, a chat, a photo, a design file).
- Where it came from (device, account, folder, link).
- Who has had access and who made changes.
- When you found or saved it, and the date and time on your device.
Write this in a plain note and keep the note with the files.
3. Make a protected copy
Copy the originals to a folder or drive you won’t touch, and work from another copy. Keep the original in place. Copying can change file dates; see what happens to file dates when you copy, zip or download. For a complex matter, ask whether a forensic copy is needed.
4. Record a fingerprint of each file
A fingerprint (SHA-256 hash) lets anyone check later that a file hasn’t changed. US Federal Rule of Evidence 902(14) refers to data “authenticated by a process of digital identification” (the rule), and lawyers often ask for hash values. You can compute one with the free SHA-256 hash checker. Write the value in your note.
5. Timestamp the copies
A fingerprint on its own has no date. A TimeBind records the fingerprint on the Bitcoin blockchain, and the Proof of Time Certificate shows that the exact files existed no later than the recorded time. Your browser makes the fingerprint and the files stay on your device, which helps if they are confidential. Add the note too. See how to timestamp a file.
6. Handle messages, emails and photos carefully
- Chats and texts: export them from the app if possible, and ask your lawyer which format they prefer.
- Emails: keep the original message in your mailbox, and ask your lawyer how to export it with headers.
- Photos and videos: keep the original file from the camera, not a copy sent through a chat app. See how to verify when a photo was taken.
- Screenshots: helpful as a pointer, but weak on their own. See can screenshots be used as evidence?
7. Give your lawyer one organised set
A folder with the files, your note, the fingerprints and the certificate is easier to work with than loose attachments. If the other side may claim a file is fake, read what to do if the other side says your evidence is a deepfake. Law firms can see the legal timestamping hub and timestamping for law firms.
If you are about to let an AI assistant edit those files, the free AI agent file-access checklist reviews copies, permissions and the task first. It is not a backup and not legal advice.
If the next step is putting a client file into an AI tool, see also the free client-file AI tool checklist. It looks at the current terms and the exact copies to keep. It cannot decide whether privilege was waived, and it is not legal advice.
If the next step is an AI notetaker on a client call, see also the free AI notetaker consent checklist. It cannot decide recording law or privilege, and it is not legal advice.
Frequently Asked Questions
-
Should I copy my files or leave them where they are?
Leave the originals where they are and make a separate protected copy. Ask your lawyer if you need a forensic copy.
-
Is a screenshot enough evidence?
Usually not on its own. Keep the original file or message and use a screenshot only as a pointer. A screenshot is easy to edit and doesn’t show where the content came from.
-
Do I need a hash value?
You don’t always need one, but it makes it easy to show later that a file hasn’t changed. A timestamp gives that fingerprint a recorded time.
-
Can a timestamp show my files are true?
No. It shows a file existed no later than the recorded time and still matches its fingerprint. It doesn’t show that what is in the file is accurate or who made it.
-
What does a TimeBind cost?
Your first Pooled TimeBind is free, with no credit card required. After that, Pooled TimeBinds start from US$5, and an ASAP TimeBind is US$15. See plans and pricing
Preserve first, ask questions after
Free to start. The files stay on your device and your browser makes the fingerprint.
Last fact-checked: 10 November 2026.
Date your preserved copies
Put the key files, exports and a short note (up to 10 files) in one TimeBind before you hand them to anyone.
Make your first TimeBind free → See plans and pricing
Your first Pooled TimeBind is free, with no credit card required. After that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. Your browser makes the fingerprint and the file stays on your device. A TimeBind shows a file existed no later than the recorded time. It doesn’t show who made it.
Related: Hash values as digital evidence: what FRE 902(14) says.
