The Invisible Witness: Why Context and Metadata Matter as Much as the Message

You have a message you believe is important. You print a screenshot and bring it to your attorney.

Your attorney's first questions may not be about what it says. They may be: When exactly was this sent? From whom? Is there anything around it? Where did this image come from?

If the other side claims the message is fake, those questions matter even more. The content is only part of the picture. The details around it, the "invisible witness," are the rest.

What Is Metadata?

Think of a message like a letter in an envelope.

**The content** is the letter: what was said.

**The metadata** is the envelope: when, from whom, and in what order.

Different sources preserve different metadata. A phone's internal database can hold a lot. A WhatsApp chat export, by contrast, is a plain text file that records the date and time, the sender name as it appears in the chat, and the message text, plus any attachments you chose to include. ScanMyChat works with what the export contains. It doesn't read phone databases or hidden device data.

Three Things Worth Documenting

1. The timestamp (the "when")

A screenshot may just say "Yesterday." The export records a date and time for each message.

**Why it matters:** It helps you and your attorney build a timeline: when a message was sent relative to a custody exchange, for example. Timestamps reflect device settings and time zones, so review them carefully. ScanMyChat flags lines that appear out of chronological order as a **Potential anomaly** for review.

2. The sender (the "who")

Screenshots and exports both show the sender as a name, often the contact name saved on the exporting phone. That label alone doesn't establish who sent a message. Tying a message to a person usually takes more: testimony, phone records, the content itself, or other corroboration. Your attorney can advise on what is needed.

3. The hash value (integrity since hashing)

A hash is a fixed-length fingerprint of a file. ScanMyChat calculates a SHA-256 Source hash of your export file and a Report hash of the generated PDF, recorded in the Integrity Manifest.

If even one character in the file changes, the hash changes.

**Why it matters:** You can show that the export and the report are the same files you hashed on a given date. A hash does *not* prove who wrote the messages, that they are true, or what happened before you exported them.

""Metadata adds context. It doesn't replace testimony or corroboration.""

A quick distinction: organizing and documenting metadata is formatting. Showing a message is genuine is authentication. Whether the court will consider it is admissibility. These are separate steps, and the rules differ by jurisdiction, so ask an attorney what yours requires.

Metadata Structure Visualization

Why Local Processing Matters

Chat exports can contain very personal information: names, photos, locations mentioned in conversation. Many online converters ask you to upload all of it to their servers.

ScanMyChat runs locally in your browser.

Your export is processed on your own device.

Hashes and the Transcript are generated locally.

Your chat isn't uploaded to our servers.

The Chain-of-custody worksheet included in the Evidence Package helps you record when and how you exported the chat, and who has handled the files since.

Let the Record Speak

When a message is disputed, clear context helps: a complete, chronological Transcript, documented hashes, and a record of how the file was handled. It gives your attorney a solid foundation to work from.

Organize and document your chat export.

---

Disclaimer: This article explains technical concepts and is not legal advice. How metadata and hashes are treated as evidence depends on your jurisdiction and the presiding judge. Always consult a legal professional.

The Invisible Witness: Why Context and Metadata Matter for Text Evidence