Short answer: Federal Rule of Evidence 902(14), added by the 2017 amendments to the Federal Rules of Evidence, lets a party authenticate data copied from an electronic device, storage medium or file by a “process of digital identification,” shown by a certification of a qualified person, with written notice to the other side. The Advisory Committee’s note says that such data are “ordinarily authenticated by ‘hash value’”: if the hash values of the original and the copy are the same, it is “highly improbable” that they are not identical. The same note says the rule is limited to authentication, and the opponent remains free to object on other grounds such as hearsay, relevance or, in criminal cases, confrontation, or to challenge whether the data was placed there by the person alleged. A hash therefore shows that two copies match. It does not by itself show when a file was created, who made it, or whether its contents are accurate. A TimeBind adds one narrow thing: a dated record that an exact file existed no later than a recorded time and still matches. It is not a Rule 902 certification.
Last checked 12 November 2026. General information about the United States Federal Rules of Evidence for lawyers, paralegals and litigants, not legal advice. State courts, other countries and individual judges differ, and the rules and local practice can change. TimeBinder is not a forensic examiner, does not provide certifications under Rule 902, and a TimeBind does not by itself authenticate evidence for any court.
Table of Contents
What Rule 902(14) says
Rule 902 lists items of evidence that are self-authenticating, meaning they need no extrinsic evidence of authenticity. Two paragraphs were added in 2017 for electronic evidence:
- 902(13), certified records generated by an electronic process or system. A record generated by an electronic process or system that produces an accurate result, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12).
- 902(14), certified data copied from an electronic device, storage medium, or file. Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12).
In both cases the proponent must also meet the notice requirements of Rule 902(11): reasonable written notice before the trial or hearing of the intent to offer the record, with the record and the certification made available for inspection so the other side has a fair opportunity to challenge them. The 2017 Committee Notes explain the purpose. Producing an authenticating witness is often unnecessary because the adversary frequently stipulates authenticity or does not challenge it, and the new procedure lets the parties find out before trial whether a real challenge will be made.
The text above is from the rule as published by the Legal Information Institute and the Committee Notes, which we opened on 12 November 2026. Read the current rule and your local rules before relying on this summary.
What the Committee Note says about hash values
The note to paragraph (14) is the clearest official description of why hash values matter. It says that data copied from electronic devices, storage media and electronic files are “ordinarily authenticated by ‘hash value,’” and describes a hash value as “a number that is often represented as a sequence of characters” produced by an algorithm “based upon the digital contents of a drive, medium, or file.” Three points follow in the note:
- If the hash values of the original and the copy are different, the copy is not identical to the original.
- If they are the same, it is “highly improbable” that the original and copy are not identical, so identical hash values “reliably attest to the fact that they are exact duplicates.”
- The rule “is flexible enough to allow certifications through processes other than comparison of hash value,” including other reliable means of identification provided by future technology.
The note is just as clear about the limits. The certification “can only establish that the proffered item is authentic.” The opponent “remains free to object” on other grounds, with the example that in a criminal case where data copied from a hard drive is offered, the defendant can still challenge hearsay found on the drive and “whether the information on the hard drive was placed there by the defendant.” It also says a challenge to authenticity may require technical information about the system or process, including possibly a forensic technical expert.
Search interest in this topic is steady: Google autocomplete on 12 November 2026 suggested “hash value digital evidence”, “hash value electronic evidence”, “hashing of digital evidence” and “authenticating digital evidence at trial”.
What a hash comparison shows, and what it does not
| A matching hash can support | It does not, on its own, show |
|---|---|
| The copy before the court is bit-for-bit identical to the file or image that was hashed | That the original was genuine, unaltered before it was hashed, or accurate |
| That a file has not changed between two hash calculations | When the file was created or first hashed, unless the hash is independently dated |
| That the algorithm and tool named in the certification produced the stated value | Who created the file, or who placed it on a device |
| A reliable basis for a qualified person’s certification, if the collection process is sound | That the content is not hearsay, is relevant, or that any other objection fails |
Practitioners usually record the algorithm used. SHA-256 is the common choice today; older algorithms such as MD5 and SHA-1 are no longer considered collision-resistant, so a hash made with them may attract questions. A hash is only as meaningful as the process around it: who collected the data, with what tool, from which source, and when.
Practical checklist for counsel and clients
- Hash at collection, not later. Record the hash of each file or image as soon as it is collected, with the algorithm, tool and version, the person who ran it and the date and time.
- Preserve the original. A hash comparison needs something to compare against. Keep the original media or a verified forensic image, and work from copies.
- Re-hash at each hand-off. Log every transfer and re-check the hash on receipt. A template is in our chain-of-custody log for digital exhibits, and a client-side list is in preserving digital evidence: a checklist to give your lawyer.
- Plan the certification early. Identify who will be the qualified person for a 902(13) or 902(14) certification, what the certification will say, and when written notice must be served. Whether a certification is sufficient is for the court and your local rules.
- Know what you are not proving. If the dispute is about who made a file, whether its content is true, or whether it was changed before collection, a hash match will not resolve it. Consider whether a forensic examiner is needed; see forensic examination versus an independent timestamp.
- Add an independent date where timing is disputed. A hash alone has no date. If you need a checkable record that the exact file existed no later than a certain time, you can add a dated record of the hash, for example a TimeBind. See what a hash timestamp is, and how it differs from notarisation.
- Outside the United States, check local rules. Rule 902(14) is a US federal rule. For other systems, see deepfake evidence and the rules in the US, England and Wales and the EU and eIDAS 2.0 and electronic ledgers.
What a TimeBind does and does not show
A TimeBind is a dated, checkable record that an exact file existed no later than a recorded time and still matches. The SHA-256 fingerprint is made in your browser and the file is never uploaded. The record is anchored to Bitcoin (a Merkle root in an OP_RETURN). Your first Pooled TimeBind is free; after that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. See how it works.
For a litigator that means a client can fingerprint an exact document, export or screenshot, and later show that the file existed no later than a recorded time and still matches. The fingerprint is calculated in the browser, so the file itself is not sent to TimeBinder.
A TimeBind is not a certification under Rule 902(11), (12), (13) or (14). It does not identify who collected or created the file, does not show that its contents are accurate or complete, and does not decide whether a court will accept it. Courts and rules differ; see our overview of how the rules treat blockchain timestamps and the guide for lawyers on forgeries and backdating.
Limits
This page summarises a federal rule and its Committee Notes at a point in time. Case law, local rules and judicial practice vary, and nothing here tells you how a particular court will treat a particular certification. We have not reviewed any case for this article. If you are preparing evidence for a real matter, take advice from counsel in the relevant jurisdiction and, where needed, a qualified forensic examiner.
Tools that can help
The free bulk SHA-256 manifest tool produces a CSV of file hashes in the browser. The SHA-256 hash checker compares a single file to an expected value. For the surrounding process, use the chain-of-custody log and the legal timestamping hub.
Frequently Asked Questions
-
What does Federal Rule of Evidence 902(14) cover?
Data copied from an electronic device, storage medium or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that meets Rule 902(11) or (12). The proponent must also give the written notice required by Rule 902(11). It was added by the 2017 amendments.
-
Does a matching hash prove a file is genuine?
No. According to the Advisory Committee note, identical hash values attest that the original and the copy are exact duplicates. The note adds that the certification establishes only authenticity, and that the opponent can still object on other grounds, including whether the information was placed there by the person alleged.
-
Does a hash show when a file was created?
Not by itself. A hash is calculated from a file’s contents and carries no date. A date needs an independent source, such as a record kept at collection or an independent timestamp that records the hash by a given time.
-
Is a TimeBind a Rule 902(14) certification?
No. A TimeBind is a dated, checkable record that an exact file existed no later than a recorded time and still matches. A Rule 902(13) or (14) certification is made by a qualified person who complies with Rule 902(11) or (12). A TimeBind may help support the timeline around such a record but does not replace it.
-
Should I use SHA-256 or MD5 for digital evidence?
Practitioners generally record the algorithm used and prefer SHA-256 today. MD5 and SHA-1 are no longer considered collision-resistant. Which algorithm a court or opposing expert will accept is a matter for your jurisdiction and your forensic examiner.
Sources checked
- Federal Rules of Evidence, Rule 902 and the Committee Notes on Rules, 2017 Amendment (paragraphs (13) and (14)), Legal Information Institute, https://www.law.cornell.edu/rules/fre/rule_902 (read 12 November 2026)
- Rule 902, Title 28, Appendix, Rules of Evidence, U.S. Government Publishing Office, https://www.govinfo.gov/content/pkg/USCODE-2019-title28/pdf/USCODE-2019-title28-app-federalru-dup2-rule902.pdf
- Federal Judicial Center, “Amendments to the Federal Rules of Practice and Procedure: Evidence 2017 — Self-Authenticating Electronic Evidence” (video transcript), https://www.fjc.gov/sites/default/files/materials/35/Evidence%20Rules%20902%2013%20and%2014%20Video%20Transcript.pdf
- Google autocomplete, 12 November 2026 (US): “hash value digital evidence”, “hash value electronic evidence”, “hashing of digital evidence”, “authenticating digital evidence at trial”
- YouTube (supporting interest, mostly older): Rakesh Kapoor, “What is Hash Value in Electronic Evidence”, 25 October 2023, 50,706 views; Law Spectrum, 3 June 2026, 7,174 views (both when checked 12 November 2026)
Add an independent date to the files you hash
Your first Pooled TimeBind is free, with no credit card required. After that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. Click here to start, or see plans and pricing.
Related: GitHub Actions CI secret stealer: what developers should keep.
