Authenticating digital evidence: what an RFC 3161 timestamp proves under FRE 901 and Rule 902
- Rule 901(a) sets a low threshold: the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is. Authenticating digital evidence is a foundation question, not a verdict on reliability.
- An RFC 3161 timestamp is narrow and it is checkable. It supports the assertion that a particular datum existed in exactly that form no later than a stated time, and that it has not changed since. It says nothing about whether the content is true.
- Rule 902(13) and Rule 902(14) allow certain electronic records and certified data copies to be self-authenticating on a certification rather than through a foundation witness. Both carry the Rule 902(11) notice requirement, which makes this a pre-trial planning question.
- For a client’s contemporaneous log, the practical value is usually narrowing rather than winning: the timestamp removes the argument about when the record was written, and leaves the argument where it belongs, on weight.
What do the evidence rules ask of a digital record?
Less than most clients assume, and something different from what they assume.
Authentication asks whether an item is what its proponent says it is. It does not ask whether the item is accurate, complete, or persuasive. The Advisory Committee described the concept as “a special aspect of relevancy,” and the operative text of Rule 901(a) is deliberately modest:
Evidence sufficient to support a finding. Not proof, and not a finding of authenticity by the court on the merits. That is the authentication standard, and it is the reason a digital record rarely fails on authenticity alone.
Where does 901 authentication stop and weight begin?
At the point the record is in. Once the foundation is laid, the opposing party is free to argue that the record is self-serving, incomplete, or written with litigation in mind, and the trier of fact is free to agree. Clearing Rule 901 buys admission, not belief.
It also does not buy admissibility on its own. A digital record still has to be relevant, still has to survive hearsay, and still has to get past Rule 403. Authentication is one of several doors, and it is usually the easiest of them.
What does Rule 901 require to authenticate digital evidence?
A showing tied to how the item came to exist. Rule 901(b) then lists methods of authentication, and the list is expressly “examples only, not a complete list,” which matters for evidence produced by a mechanism nobody contemplated in 1975.
Which FRE 901(b) methods of authentication fit an electronic record?
Three of them do most of the work when the record is a log kept on a phone.
- Rule 901(b)(1), testimony of a witness with knowledge. “Testimony that an item is what it is claimed to be.” Your client can say what the log is and that these are the entries they wrote.
- Rule 901(b)(4), distinctive characteristics. “The appearance, contents, substance, internal patterns, or other distinctive characteristics of the item, taken together with all the circumstances.”
- Rule 901(b)(9), evidence about a process or system. “Evidence describing a process or system and showing that it produces an accurate result.” This is the provision that fits a hash chain and a timestamp authority, because both are a process or system whose output can be tested.
In practice these run together. Witness testimony establishes what the record is; the process or system establishes that its dates and its sequence are what they appear to be.
How does circumstantial evidence authenticate a digital record?
By pattern rather than by attestation. Rule 901(b)(4) is the circumstantial evidence route, and for a log kept over months the internal patterns are unusually rich: entries at consistent hours, a cadence that predates the dispute, references that line up with school calendars and text message threads produced in discovery. None of that is dispositive. Taken with all the circumstances, it is ordinarily enough to authenticate a document of this kind.
What is self-authenticating electronic evidence under Rule 902(13) and 902(14)?
Rule 902 lists items that “require no extrinsic evidence of authenticity in order to be admitted.” Two paragraphs added in 2017 speak directly to digital evidence authentication.
Rule 902(13), certified records generated by an electronic process or system:
Rule 902(14), certified data copied from an electronic device, storage medium, or file:
The “process of digital identification” in Rule 902(14) is, in the Committee’s own explanation, hash comparison. The note is worth reading in full, because it is the clearest statement in the rules of why a hash carries evidentiary weight at all:
A fixed-length number produced by an algorithm from the contents of a file. Change one byte and the value changes. Two files with the same value are, for practical purposes, the same file, which is what makes a hash a workable proxy for identity. More terms in the glossary →
What specific evidence does a 902(13) certification have to supply?
Whatever a witness would have had to say. The Committee is explicit that a proponent under these paragraphs “must present a certification containing information that would be sufficient to establish authenticity were that information provided by a witness at trial.” A certification that describes less than a foundation witness would have described does not qualify.
Then there is notice, which is where these paragraphs are most often lost. Rule 902(11) requires that, before the trial or hearing, the proponent give an adverse party reasonable written notice of the intent to offer the record, and make the record and the certification available for inspection, so that the party has a fair opportunity to challenge them. Rule 902(13) and Rule 902(14) both incorporate that requirement. Self-authentication is therefore a decision made weeks out, not at the evidentiary hearing.
When is self-authenticating evidence still open to challenge?
Always. The notice requirement exists, in the Committee’s words, “to give the opponent of the evidence a full opportunity to test the adequacy of the foundation set forth in the declaration.” And nothing in these paragraphs limits a party from establishing or contesting authenticity on any other ground the rules provide. What Rule 902(13) removes is the foundation witness, not the argument.
What is an RFC 3161 timestamp?
A signed statement from a third party that a given hash was presented to it at a given time.
RFC 3161 is the IETF standard for the Time-Stamp Protocol, published in August 2001. Its opening sentence is the whole of the claim it supports:
A Time Stamp Authority receives a request, adds a time from a trustworthy source, and returns a token signed with a key reserved exclusively for timestamping. Verification is arithmetic: hash the record again, compare it to the hash inside the token, and check the authority’s signature. Anyone can do it, including opposing counsel, and it does not require trusting the party who obtained the token.
What does the timestamp authority actually see?
Nothing, by design, and this is the part that tends to surprise. The standard requires the authority:
and
and
The content never leaves the device. A one-way hash goes out and a token comes back. So there is no third-party copy of your client’s entries anywhere, and no register of who asked. In Documented’s case the authority is DigiCert, which is deliberately not us: a timestamp issued by the same party that stores the record proves considerably less than one issued outside that chain.
What does an RFC 3161 timestamp prove, and what does it not prove?
This is the section worth reading twice, because the value of the mechanism is entirely in its narrowness.
| Proposition | Does the token support it? |
|---|---|
| This data existed in exactly this form no later than the stated time | Yes, that is the assertion the standard is built to support |
| This data has not been altered since | Yes, any change produces a different hash and the token no longer matches |
| The entry was written by this person | No, the authority records no identity |
| The event described in the entry happened | No, a timestamp speaks to the data, never to the world |
| The entry was written at the moment the event occurred | No, it establishes a ceiling on the time of authorship, not the moment of it |
| The record is complete | No, nothing prevents a client from writing some days and not others |
The last three lines are the honest limits, and stating them is what makes the first two usable. A timestamp is not corroboration of content. It is corroboration of sequence and of time, which happens to be the thing a contemporaneous log is most often attacked on.
How does a hash chain support authenticity under FRE 901(b)(9)?
By making the order of the entries testable rather than asserted.
Each entry’s hash incorporates the hash of the entry before it, so the entries form a sequence that can only be recomputed one way. Editing or deleting an earlier entry changes its hash, which breaks every link after it. The break does not repair itself and does not hide; it shows up when the chain is recomputed. Combine that with an independent token on each entry and you have a process or system whose accuracy can be described and demonstrated, which is what Rule 901(b)(9) asks for.
Two cautions belong here. This is tamper-evident, not tamper-proof: the mechanism reveals alteration, it does not prevent it, and the distinction matters when you are the one describing it to a court. And a verifiable chain says nothing about the truthfulness of what was typed into it. Tamper-evident, not tamper-proof sets out where that line falls in plain language.
What does authenticating evidence at trial look like when the record is your client’s own log?
Ordinarily unremarkable, which is the point.
Your client testifies to what the log is and that they kept it (Rule 901(b)(1)). If the exhibit is an export rather than the phone, the export carries its audit trail, so the copy can be tied to the original by hash comparison, which is the Rule 902(14) mechanism whether or not you proceed under that paragraph. Where the date of authorship is genuinely contested, the tokens are what convert “she says she wrote these at the time” into something the other side can check and, more usefully, something they can stop contesting.
Do digital documents need a witness to authenticate them?
Not necessarily. Rule 902(13) and Rule 902(14) exist precisely so certain digital documents can be authenticated on a certification instead of live testimony. In a custody matter your client will usually be testifying anyway, so the certification route often saves less than it does in a commercial case. Where it earns its keep is volume, and in avoiding a foundation skirmish over an exhibit that is not really in dispute.
Hearsay remains a separate question, and the timestamp does not answer it. Rule 803(1) covers a statement describing an event made while or immediately after the declarant perceived it. Rule 803(6) covers records kept in the course of a regularly conducted activity as a regular practice. A dated, unbroken, months-long log makes the factual predicates for both easier to establish. It does not satisfy either rule by itself, and no timestamp changes what an entry is. What kind of documentation holds up in family court is the client-facing version of that distinction.
What does digital evidence authentication change in case prep?
Mostly it changes the calendar, and the intake conversation.
- Decide on 902(13) or 902(14) early. The notice requirement is a deadline. A certification identified the week of the hearing is a certification you cannot use.
- Ask for the audit trail with the export, not after. An export with its trail attached is verifiable by the other side without a further request.
- Use the mechanism to buy a stipulation. Authenticity is far easier to stipulate to when the opposing party can verify the claim themselves. That is often the whole return on the exercise.
- Plan for volume. Rule 1006 permits a summary of voluminous records. A running index of entries by month, with the entries beneath it, reads better than four hundred exhibits and is less exposed to Rule 403.
- Ask three questions at intake. When did the record start; was anything written later about earlier dates; has anything been edited. You would rather learn the answers from your client than from a cross-examination.
On the second and third of those, cadence is what makes the answers good ones. How often should you actually document? is the piece clients are pointed to, and it argues the same thing Rule 803(6) does: a regular practice is worth more than a pre-hearing burst.
Where the argument still lives
A client’s log is a one-sided record and the mechanism does not pretend otherwise. What it establishes is narrow: these entries existed in this form by these dates, and they have not been revised since. Whether that helps in a given matter is your judgment, not a vendor’s, and so is any question of discoverability or privilege in your jurisdiction.
Two claims worth not making, because opposing counsel will be pleased to correct them. No software is approved or certified by a court; courts admit evidence, they do not endorse tools. And a timestamp is evidence of time, not a shortcut past hearsay, relevance, or Rule 403.
When a client connects to you, their entries appear in your portal encrypted to a key only you hold, in order, each with its token, exportable to a single dated PDF with the audit trail attached. There is nothing for your firm to host and nothing for us to read. If you would find that useful in a current matter, you can request access.
Frequently asked questions
Does an RFC 3161 timestamp make a record self-authenticating under Rule 902(13)?
Not on its own. Rule 902(13) requires a certification of a qualified person describing the process, plus the Rule 902(11) notice. A timestamp is strong support for the underlying proposition that the process produces an accurate result, and it is verifiable independently, but the paragraph is satisfied by the certification and the notice, not by the mechanism.
Does a timestamp prove the entry was written on the day it describes?
No, and it is worth being precise about this. The token establishes that the entry existed in that exact form no later than the time on the token. If the token is dated the evening of the event, that rules out later composition, which is usually the contested point. It is a ceiling on the time of authorship, not a photograph of it.
Can opposing counsel verify the timestamps without trusting Documented?
Yes, and that is the design goal. The export carries its audit trail, so the hashes can be recomputed and the authority’s signature checked with ordinary tools. Verification does not run through us, which also means a record made with Documented does not stop being checkable if Documented does.
Is a client’s contemporaneous log admissible?
Authentication and admissibility are separate questions, and the second one is the court’s. Authenticating digital evidence of this kind is ordinarily straightforward under Rule 901. Whether the entries then come in depends on relevance, on a hearsay path such as Rule 803(1) or Rule 803(6), and on Rule 403, all of which turn on the matter in front of you.
References
This page is general information for a professional audience, not legal advice, and Documented is not a law firm. State evidence codes differ from the Federal Rules and are applied by the court.
- Federal Rules of Evidence, Rule 901: Authenticating or Identifying Evidence
- Federal Rules of Evidence, Rule 902: Evidence That Is Self-Authenticating (see (11), (13) and (14), and the 2017 Advisory Committee notes)
- Federal Rules of Evidence, Rule 803: Exceptions to the Rule Against Hearsay (see (1) and (6))
- Federal Rules of Evidence, Rule 1006: Summaries to Prove Content
- RFC 3161: Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)
- Federal Judicial Center: 2017 amendments to the Federal Rules of Evidence (self-authentication)
Related reading
Documented is a private, tamper-evident record a parent keeps of their own parenting time, with an encrypted portal for the attorney they choose to share it with. This page is general information, not legal advice, and Documented is not a law firm.