Proving You Were Not There: A Documentation Protocol for False Online Attribution

When someone tells a court you control an account you have never touched, the burden quietly lands on you. Platform records, email headers, browser artifacts, and operating system power logs each prove something different, and every one of them is on a timer.

This recently came up for me, and rather than let someone make a false attribution and walk away with it, I got creative in documentation. What follows is the protocol that came out of that, generalized so it works for anyone standing in the same spot, and expanded well past what I originally needed.

Why Proving a Negative Is Structurally Harder Than It Should Be

False attribution of online activity follows a predictable shape. Someone produces a screenshot of an account, a page, or a post. They assert that the person across from them controls it. The screenshot is offered as though it answers the question, when in fact it answers a much narrower one.

A screenshot establishes that a page existed in a particular state at the moment of capture, assuming the capture itself is genuine. It does not establish who created the page, who administers it, who posted to it, or whether the person named has ever logged into it. Those are four separate factual questions, and a screenshot speaks to none of them.

Courts and administrative bodies routinely collapse that distinction in practice, not because the rules require it, but because nobody objects and the accused party rarely arrives with anything but a denial. A denial is testimony. Testimony gets weighed against other testimony. When the record contains a document on one side and a denial on the other, the document tends to win regardless of what it actually proves.

The asymmetry compounds. Producing the accusation costs one screenshot. Answering it requires knowing which platform and device records exist, how to generate them, what they contain, how fast they expire, and how to get them admitted. Most people never learn any of that, which is precisely why the tactic keeps working and why it consumes so much of the accused party’s life.

The Three Questions Worth Answering

Every attribution dispute reduces to three questions, and each one has a different evidentiary answer. Sorting your effort by question rather than by tool is what keeps the work from sprawling.

The first question is whether the account is connected to you at all. This is answered by platform records, meaning transparency panels on the disputed account and self-exports from your own. It is the cheapest question to answer and often the only one you need.

The second question is whether you were at a device capable of the conduct during the window in question. This is answered by operating system logs, browser artifacts, and screen time records. It is the question almost nobody thinks to answer, and it is where the strongest available evidence sits.

The third question is what you were actually doing instead. This is answered by everything else you touch that keeps a log, which in a modern life is a startling amount. It is the question that converts a technical defense into a human one that a judge can hold in mind.

Question One, Layer One: What the Platform Already Publishes

Before spending a dollar, look at what the platform already discloses publicly about the account in question. Every major platform now runs some version of a transparency panel, built originally for election integrity and influence-operation disclosure, and repurposable for exactly this problem.

On Facebook Pages, the Page Transparency section reports the date the Page was created, any prior names it has operated under, whether it has merged with another Page, the countries in which the people who manage it are located, and any advertising it has run. Meta has moved this panel more than once. Guides written even a year ago point to the About tab, and it is now generally reached through the Page name itself, so anyone following older instructions should assume the path changed rather than that the panel is gone.

On personal Facebook profiles, the equivalent panel reports the join date, recent profile updates, prior names, and the account category. On Instagram and Threads the feature is called About This Account and reports the date the account joined, the country where it is based, former usernames, and any advertising it runs. TikTok and X publish comparable creation and name-history data.

The analytical value is in the mismatch. A Page created three years before the events in dispute is not a Page someone spun up to harass a person last month. A Page whose managers are located in a country the accused party has never visited is a Page with an attribution problem the accuser has to explain. Prior name changes establish that the Page has worn other identities, which undercuts any claim that its current branding reflects settled ownership.

Question One, Layer Two: Your Own Export

Every major platform is required by privacy regulation to give users a machine-generated copy of their own account data on request. Most people who request one are curious about advertising profiles. Almost nobody requests one for the reason that matters most in an attribution dispute, which is that the export documents the boundaries of your account.

The Facebook export is the clearest example. Requested through Accounts Center, it includes a category listing the Pages the account administers. It also includes login records with associated dates, times, and network addresses, active session records with device and browser detail, account status history covering activation and deactivation events, and a complete history of name changes on the account.

Read that list again with an attribution dispute in mind. A platform-generated list of the Pages your account administers, which does not contain the Page you are accused of running, is not a denial. It is a record produced by the accused platform itself, in the ordinary course, without your editorial hand anywhere near it.

There is a second reason this matters. The Stored Communications Act restricts what providers may disclose to third parties, and those restrictions have swallowed a great deal of civil discovery. None of it applies here. You are the subscriber, requesting your own records, through the mechanism the provider built for that purpose. The statute that blocks the subpoena route does not touch the export route.

Export contents vary by account type, region, and platform version, and category names change. Confirm what your own archive actually contains before you rely on any specific field, and note the date you generated it, because a category present today may be renamed by the time anyone checks your work.

Request every export the same day. They generate asynchronously, they arrive by email over a window of hours to days, and the download links expire. Save the archives to fixed media, record a hash value for each archive at the moment of download, and do not open and re-save the files in a way that alters them.

The Instant Version: Live Negative Checks

Exports take hours to days. There is a faster class of artifact that costs nothing, returns immediately, and in one respect is stronger than the export it supplements.

Several parts of a platform’s interface will state a negative out loud rather than requiring it to be inferred from an empty list. On Meta, loading the Business Suite address with an account that administers nothing returns a message naming the account and stating that it does not have access to any Pages or Instagram profiles manageable there. The account menu’s profile switcher shows every Page the account can post as, so a switcher listing only the personal profile alongside a prompt to create a Page is the same fact rendered a second way. The Accounts Center holds an Access Your Information tool, distinct from the export, which is browsable in the application immediately and includes a Pages section.

Two properties make this category worth more than its cost suggests.

The first is evidentiary. These messages are generated by the system querying its own association records at the moment of the request. A human wrote the template wording, but no human authored the assertion about the specific account. MRE 801(a) defines a statement as a person’s oral assertion, written assertion, or nonverbal conduct intended as an assertion. Output with no human declarant behind the particular assertion is generally not a statement at all, which means the hearsay analysis never begins and the material comes in through authentication alone. MRE 901(b)(9), evidence describing a process or system and showing that it produces an accurate result, is the natural route.

The second is reproducibility. Nearly everything else in this article is a snapshot of a state that has since passed. A live negative check is a current-state query that can be run again in front of anyone who doubts it, including in a hearing. That moves the material closer to a demonstration than an exhibit, and demonstrations are considerably harder to argue with than pictures.

The One Artifact That Authenticates Itself

Email is different from everything else in this article, and the difference is not widely understood outside security work. Email carries its own cryptographic proof.

When a mail server sends a message on behalf of a domain, it can attach a DomainKeys Identified Mail signature. That signature is computed over the message body and a specified list of headers, then signed with a private key whose public counterpart is published in the sending domain’s DNS records. Any recipient, at any later time, can retrieve the public key and verify that the signature still matches. If a single signed byte has changed, verification fails.

The consequence for attribution disputes is direct. A genuine email produced from your own mailbox can be independently verified as unaltered and as having actually originated from the domain it claims. A fabricated email attributed to you cannot be made to validate, because the person fabricating it does not hold the private key. Someone who forges a message from your address and produces a screenshot of it has produced an artifact with no verifiable properties whatsoever. Ask for the original file and the forgery becomes visible.

Getting at headers is straightforward once you know where to look. In Gmail, open the message, choose Show original from the overflow menu, and use Download Original to save a complete .eml file along with the SPF, DKIM, and DMARC results displayed at the top. In Outlook desktop, open the message and use File then Properties to read the internet headers, or drag the message to the desktop to save it as a .msg file. In Apple Mail, use View then Message then All Headers, or forward as attachment to preserve the original intact. In Thunderbird, use the message source view.

Save the original file, not the header text. The file is the artifact. The header text pasted into a document is a transcription of the artifact, and a transcription can be challenged in ways the file cannot.

Question Two: Browser Artifacts on Devices You Control

Browsers keep far more than a list of visited pages, and the structure of what they keep matters more than the list itself.

Chrome stores history in a SQLite database named History inside the user profile directory, with a urls table holding each address, its title, visit count, and last visit time, and a visits table holding one row per individual visit with its own timestamp. Firefox uses places.sqlite with moz_places and moz_historyvisits serving the same roles. Safari uses History.db. Each browser family stores time differently, which trips people up constantly. Chrome counts microseconds from the first day of 1601, Firefox counts microseconds from the first day of 1970, and Safari counts seconds from the first day of 2001. A timestamp read without converting from the correct epoch is not merely wrong, it is wrong by centuries.

The field most people miss is the transition type recorded on each Chrome visit. It distinguishes a page the user typed into the address bar from a page reached by clicking a link, from a reload, from a form submission, from a redirect the user never chose. That distinction separates deliberate navigation from a page that merely loaded an embedded widget. If the accusation is that you actively used a platform, and the only records are automatic subresource loads, the transition type is the field that says so.

Beyond history, browsers retain cookies, local storage, session storage, indexed databases, and service worker registrations, all organized by site. A browser profile that has genuinely been used to operate an account on a platform accumulates durable state for that platform. A profile that has not, does not. The presence or absence of that state is often more informative than the history list, because state is harder to selectively remove than history is.

Question Two, Continued: Proving the Machine Was Asleep

This is the part almost nobody uses, and it is the strongest device-side evidence available to an ordinary person.

Operating systems log their own power state transitions. They do this automatically, for engineering reasons entirely unrelated to litigation, and the records are precise to the second. A machine that entered sleep at 11:41 in the evening and resumed at 6:15 the next morning was not used to post anything at three in the morning, and the machine says so in its own voice.

Windows

The System event log records sleep as Kernel-Power event 42, with a Sleep Reason field distinguishing a lid close or button press from an idle timeout or a low battery. It records resume as Kernel-Power event 107. Better still, the Power-Troubleshooter source writes event 1 on return from a low power state, and that single record contains both the sleep time and the wake time in coordinated universal time along with the wake source, which means one record carries the entire interval. Kernel-General events 12 and 13 mark system start and shutdown.

Two commands produce readable reports without any forensic tooling. Running powercfg /sleepstudy generates an HTML report of sleep transitions over recent days. Running powercfg /batteryreport generates a usage history showing periods of active use and standby on portable machines. Both write to a file you choose and both are ordinary supported features rather than anything exotic.

The Security event log adds the human layer where auditing is enabled. Event 4624 records a logon with a type code distinguishing an interactive session at the keyboard from a network or service logon. Event 4634 records a logoff and 4647 a user-initiated one. Events 4800 and 4801 record the workstation being locked and unlocked, which brackets periods when nobody was at the machine even while it remained powered on.

The richest Windows artifact is the least known. The System Resource Usage Monitor maintains a database at C:\Windows\System32\sru\SRUDB.dat that records, roughly hourly, which applications ran, under which user account, how many bytes each sent and received over the network, which networks the machine was connected to and for how long, and how much foreground versus background processor time each application consumed. Newer builds also record focus time and user input time per application, which is the difference between a program running quietly in the background and a person actively typing into it. Retention runs about thirty to sixty days. The open-source srum-dump utility parses it into a spreadsheet.

Sit with what that means. A record that says the browser sent and received essentially nothing during the hour in question, and that no application registered any user input, is a machine-generated statement that nobody was using that computer. It was not created for you, it was not created about this dispute, and it was written before anyone knew there would be one.

macOS and iOS

On macOS, pmset -g log prints the power management history including every sleep and wake with timestamps and causes. The unified logging system holds much more detail but retains it only for a short window, often days to a couple of weeks, so it is the first thing to capture and the first thing to disappear.

The Apple equivalent of the Windows resource monitor is a database named knowledgeC.db, present on both macOS and iOS. Its ZOBJECT table records intervals of application use with start and end timestamps, along with device lock and unlock state and screen activity. It holds roughly a month. Timestamps are stored as seconds since the first day of 2001 in coordinated universal time, and they follow the device clock, which means a manually changed clock produces records consistent with the changed time rather than the real one. Cross-check against something outside the device before treating any single timestamp as settled.

For most people the accessible version of this is far simpler. On iOS, Settings then Screen Time then See All App and Website Activity shows per-application usage broken down by hour for each day in the recent window. A bar chart showing zero minutes of a platform during the hour in dispute is a consumer-facing, screenshot-able record generated by the device. On Android, Digital Wellbeing provides the equivalent, and a Google account’s My Activity page holds timestamped records across products.

The network layer

If your household runs a filtering DNS resolver, and a growing number do, you may hold a complete log of every domain your network attempted to resolve, with timestamps. Services in this category retain query logs for a configurable window and let you export them. The absence of any lookup for a platform’s domains across an entire evening is a network-level statement that no device on that network contacted the platform at all.

Mobile carriers hold data usage records and call detail records for their own subscribers and will produce them to the subscriber on request. Retention for call detail commonly runs a year or longer, though data usage detail is often shorter and coarser. Consumer router logs are usually thin and overwrite quickly, but a router that emails or uploads logs may hold more than expected. Where a matter touches a managed network at an employer or a school, that network’s proxy and authentication logs are far more complete than anything a consumer device produces, and they are held by a neutral third party.

Question Three: Occupancy, the Argument That Actually Persuades

Everything above tells a judge that a machine was idle. That is useful and it is also abstract. What moves a fact-finder is a picture of a person somewhere specific, doing something specific, that is incompatible with the accusation.

A modern life generates a startling number of timestamped records without anyone intending it to. The exercise is to inventory them rather than to think of them one at a time.

Two disciplines make this material work rather than backfire. First, produce the export rather than the app screenshot wherever an export exists, for the same reason the email file beats the picture of the email. Second, be honest with yourself about what each record proves. A phone that did not move proves the phone did not move. A watch recording sleep proves the watch was on a wrist that was still. Neither proves the person could not have been at a different computer. State the limit yourself, in your own filing, before the other side states it for you. Doing so costs you nothing and buys you the credibility that carries the rest.

Everything Here Is on a Timer

The most common reason a non-attribution defense fails is not that the evidence never existed. It is that the evidence expired while somebody thought about it. Retention windows on device artifacts are short, they run whether or not anyone is paying attention, and ordinary use of the device speeds them up.

Turning the Lens Around: Attacking the Artifact Itself

Defensive documentation is half the work. The other half is refusing to let a screenshot pass unexamined, because screenshots are the least reliable form of digital evidence in common use and they are treated as the most reliable.

Start by demanding the native file. A screenshot printed to paper or pasted into a filing has been stripped of everything that would let anyone evaluate it. The original image file carries capture metadata including the device and the time of capture, which frequently does not match the date the producing party claims. Under MRE 1004, if the party against whom the original would be offered had control of it, was on notice that it would be a subject of proof, and fails to produce it, other evidence of its content becomes admissible. Putting that demand on the record early creates the failure that the rule addresses.

Then read the image itself. Screenshots carry an enormous amount of incidental information that forgers rarely think about. The status bar shows a clock, a battery level, a signal indicator, and notification badges. The interface itself has a version, and platforms redesign constantly, so an interface element that did not exist until a later release cannot appear in an image claimed to be older. Fonts, spacing, and rendering differ between the mobile application, the mobile web view, and the desktop site, which means an image claimed to be from one context but rendered like another is worth asking about.

Check whether the content ever existed publicly. Web archives capture a great many pages, and an archived capture either corroborates the screenshot or conspicuously fails to. Post identifiers on major platforms are assigned in rough sequence, so an identifier that sits far outside the range of other posts from the claimed period is an anomaly the producing party has to explain.

What Paid Verification Actually Buys

Paid verification arrived as a status product and is widely discussed as one. That framing obscures the part that matters when someone is attributing conduct to you, which has nothing to do with the badge.

Meta Verified for individuals runs $11.99 monthly on the web and higher through mobile app stores. Meta describes the subscription as including a verified badge, proactive impersonation monitoring, and access to support agents, with a caveat on its own product page that the enhanced support feature may not be available to every subscriber. X grants verification through its Premium tier at $8 monthly on the web, with government identification verification now standard for new verifications. LinkedIn is the outlier. Its identity verification through CLEAR in the United States, Canada, and Mexico, and through Persona elsewhere, is free and cannot be purchased.

The functional difference between free and paid is the escalation ladder. On a free account, an impersonation report enters an automated queue and returns an automated result. On a paid account, the report enters a workflow that terminates in a human being. The intake assistant collects the authentic account address and the disputed account address, confirms both back to the subscriber, and offers to transfer the matter to a specialist. The subscriber supplies a contact address, the case moves to a support inbox with a persistent reference, and a named agent joins the conversation.

That process generates artifacts. A timestamped transcript of the exchange. A support case that persists in the account’s support inbox and can be reopened and recaptured later. A named agent. Where a matter escalates to voice, an inbound call from a company number, which appears independently in the device call log and in carrier records.

What the escalation is, and what it is not

The support interaction is not an adjudication. A platform agent reviewing an impersonation report is making a content moderation decision under community standards, not a finding about who controls an account. If the report succeeds and the account comes down, that outcome reflects a policy determination rather than a factual ruling that binds anyone.

The agent is also not a records custodian. A transcript in which a support representative discusses a case is not a certification from a person qualified to attest to the platform’s business records, and treating it as one invites an objection it will not survive.

What matters most here is a distinction that gets flattened constantly, including in most published guidance on the subject. There is a difference between a platform agent echoing back what a subscriber told them and a platform agent making an affirmative statement drawn from records the subscriber cannot see. The first adds nothing at all. The second is the platform speaking from its own internal association data, which is precisely the record no civil subpoena will produce and no self-export will show, because an export covers only the subscriber’s own account and says nothing about what other accounts exist.

An agent who states that a subscriber is not connected to a specified account is reporting the result of a lookup. That is a materially different thing from a receipt confirmation, and it should not be discounted as though the two were equivalent.

The weakness is form, not content. A statement made on a call exists only in the memory of the person who heard it and in whatever note they wrote afterward. Offered later for the truth of what it asserts, it is hearsay, and no clean exception is waiting for it. That problem is solvable and the solution takes about four minutes.

Why a Refusal Is Worth More Than a Takedown

There is a counterintuitive result buried in this process. A subscriber who reports an account and is told that the report does not meet the impersonation threshold has often obtained something more useful than a removal.

A takedown is the platform doing what the subscriber asked. It can be characterized by an opponent as the subscriber successfully working a reporting system that responds to whoever complains loudest. A declination is the platform refusing what the subscriber asked, and refusals are extremely difficult to characterize as manufactured. Nobody engineers a rejection of their own request.

The declination also carries substantive content, not merely credibility. A determination that an account does not meet the impersonation standard is a statement that the account is not holding itself out as the subscriber. Set that alongside a statement that the subscriber does not control the account, and the platform has described the account as belonging to someone else while pretending to be nobody. That is the position the accused subscriber has been asserting from the beginning, arrived at independently by the entity holding the underlying records.

Copyright Enforcement, the Non-Attribution Tool Nobody Reaches For

If the disputed account is using your work, meaning your writing, your photographs, your graphics, your video, or your brand assets, then copyright gives you something no other mechanism in this article provides. It is the most underused instrument available to a person in this position, and its value has almost nothing to do with getting content removed.

Start with the structural point, because it does the heaviest lifting. A person cannot infringe their own copyright. A copyright complaint places the complainant in the rightsholder role and the reported account in the infringer role, and those two roles cannot be occupied by the same person. When a platform acts on such a complaint, it has processed a claim whose entire premise is that the account and the complainant are different parties. A granted strike is therefore incompatible, on its face, with the complainant operating the account.

That is a different kind of evidence from a denial. It is not the accused party asserting separation. It is the platform administering a process that presupposes separation and reaching a result consistent with it.

The notice is sworn, which is the point

A takedown notice under 17 U.S.C. § 512(c)(3) requires a statement, under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of the exclusive right allegedly infringed. Filing one places your claim of ownership on the record under oath and accepts personal exposure for the assertion.

Consider how that reads against an accusation that you run the page. A person does not swear out perjury-backed notices against their own property, and does not invite liability for a misrepresentation about work they control on both ends. The conduct is inconsistent with the accusation, and conduct is frequently more persuasive to a fact-finder than testimony, because conduct carries a cost that testimony does not.

The counter-notice is the one mechanism that unmasks without a subpoena

Everything earlier in this article about the Stored Communications Act describes a wall. Civil litigants cannot get content, rarely get subscriber information, and cannot invoke the preservation provisions. Copyright is the exception Congress wrote into the statute, and almost nobody uses it for this purpose.

When material is removed on a copyright notice, the account holder may file a counter notification to get it restored. To be effective under § 512(g)(3), that counter notification must include the subscriber’s name, address, and telephone number, a statement under penalty of perjury that the material was removed through mistake or misidentification, consent to the jurisdiction of the federal district court where the subscriber is located, and an agreement to accept service of process from the party who filed the original notice. Under § 512(g)(2), the provider must promptly forward a copy of that counter notification to the person who filed the notice, and absent a court action the material goes back up in ten to fourteen business days.

Read that sequence again from the position of someone being falsely accused. The operator of the disputed account faces a choice with no comfortable branch. They identify themselves to you, by name and address and telephone, under penalty of perjury, and consent to being sued by you. Or they abandon the material and stay anonymous. There is no third option, and neither branch requires you to file a motion, retain counsel in California, or persuade a judge of anything.

Strikes accumulate against an account identity

Copyright reporting on major platforms runs through a designated agent process that is separate from ordinary community standards reporting, and it generates its own case reference. Because § 512(i) conditions a provider’s safe harbor on reasonably implementing a policy for terminating repeat infringers, providers track strikes against accounts rather than merely removing individual posts.

The practical consequence is that each granted strike builds a platform-held record tied to that account identity, retrievable later, and independent of anything you generated. Two or three of them establish a pattern that a single removal does not.

One administrative note is worth acting on early. Copyright exists from the moment a work is fixed, but registration is required before an infringement suit can be filed, and timely registration is what makes statutory damages and attorney fees available. For anyone publishing regularly, registering in periodic batches costs very little and converts a theoretical right into an enforceable one long before it is needed.

Formal Process, and Why It Mostly Fails Civil Litigants

The instinct in a contested matter is to subpoena the platform. In civil litigation that instinct is usually wrong, and understanding why saves months.

The Stored Communications Act prohibits providers of electronic communication and remote computing services from disclosing the content of stored communications, and its exceptions run to governmental entities and to disclosure with the subscriber’s consent. Civil litigants are not among them. Courts have repeatedly quashed subpoenas seeking content from providers on that basis, and providers routinely object on the same ground rather than litigate.

What remains available is basic subscriber information, and only sometimes. Major platforms require process valid in their home jurisdiction, which for Meta means California, so an out of state civil litigant frequently needs local counsel to obtain a record that turns out to be a name and a registration date. The preservation mechanism that practitioners reach for, found at 18 U.S.C. § 2703(f), is written for governmental entities and is not a tool a private party can invoke.

The productive alternative is discovery aimed at the opposing party rather than the platform. A request for production requiring that party to run their own data export and produce it reaches everything the platform holds about their account, including administration records and login history, and raises no Stored Communications Act problem because the subscriber is producing their own data. The statute that blocks the subpoena is the same statute that makes this request effective.

The same logic extends to devices. A party who claims to have witnessed conduct at a particular moment has their own power logs, their own screen time records, and their own browser history covering that moment. Those records are discoverable from them directly, and they are subject to the same retention clock, which is a reason to serve the request early.

Getting It Into Evidence in Michigan

This is where Michigan practitioners hit a wall that federal practitioners cleared in 2017.

Federal Rule of Evidence 902(13) permits a record generated by an electronic process or system to be self-authenticated through a certification by a qualified person, without live testimony. Rule 902(14) does the same for data copied from a device or storage medium when authenticated by digital identification, meaning hash comparison. Together they let a party move machine-generated records into evidence on paper.

Michigan has adopted neither. Under the current rules, self-authentication ends at MRE 902(11), which covers certified records of a regularly conducted activity and requires a certification complying with a Michigan statute or a rule prescribed by the Supreme Court, plus written notice to the adverse party before the hearing. There is no Michigan analog to 902(13), and none to 902(14).

The rules that do work

MRE 901 is broader than it first appears. Subrule (b)(1) admits testimony from a witness with knowledge, which for your own export or your own log extraction means you, describing what you requested, from which account or machine, on what date, and what arrived. Subrule (b)(4) reaches distinctive characteristics and internal patterns taken together with the circumstances, which is where file structure, internal timestamps, and consistency across independently generated records do their work. Subrule (b)(9) admits evidence describing a process or system and showing that it produces an accurate result, which is the natural home for an operating system’s automatic power logging or a platform’s automated export function.

MRE 803(7) is the rule most people in this situation have never heard of and the one that matters most. It permits evidence that a matter is not included in a record of a regularly conducted activity, offered to prove that the matter did not occur, provided a record was regularly kept for a matter of that kind and the opponent does not show that the circumstances indicate a lack of trustworthiness. That is the doctrinal home for absence evidence. It is why the empty row in a login history is not merely suggestive but substantively admissible, and it is why establishing that the system routinely records the thing in question is a necessary step rather than a flourish.

MRE 1006 permits a summary, chart, or calculation to prove the content of voluminous records that cannot conveniently be examined in court, provided the underlying material is made available to the other side. Log data is exactly the kind of voluminous material this rule contemplates. A one-page timeline chart drawn from thousands of log rows is far more usable to a court than the rows themselves, and the rule is what makes the chart admissible rather than merely convenient.

MRE 1001(d) is worth knowing because it removes an argument before it starts. For electronically stored information, an original means any printout or other output readable by sight, provided it accurately reflects the information. A printed extract of a log is not a second-class copy under Michigan’s rules.

One further detail rewards attention. MRE 901(b)(6) provides an authentication path for telephone conversations, but as written it addresses a call made to a number assigned at the time to a particular person or business, with the business branch further requiring that the call related to business reasonably transacted by telephone. An inbound callback from a support line does not fit that language cleanly. The practical consequence is that where a matter can be advanced by a call you place to a published support number, placing it yourself gives you a named authentication route that waiting for a callback does not.

Preservation Discipline, Which Is Where Most of This Is Lost

Collection technique determines whether any of the foregoing survives contact with an opponent. The standards are not complicated and they are almost never followed.

Compute a cryptographic hash of every file at the moment you acquire it, record the value alongside the date, time, and method, and never alter the file afterward. Keep a contemporaneous collection log written as you go rather than reconstructed later, noting what you collected, from which device, using what command or menu path, and under what account. Store originals separately from working copies and do your analysis only on the copies.

Where you can, have someone else present or have the collection performed by someone other than yourself, because a party who collects their own evidence invites a question that a neutral collector does not. Where you cannot, document the limitation openly instead of hoping nobody asks.

Above all, stop using the device. This is the instruction people ignore most and regret most. Every boot writes hundreds of records. Every session pushes older entries closer to the edge of their retention window. The evidence that would have exonerated you thirty days ago is frequently gone by the time anyone thinks to look for it, and it was not destroyed by anyone acting in bad faith. It simply aged out while the matter was pending.

What Fixing This Would Actually Require

Four changes would close most of the gap, and none of them is exotic.

Until then, the practical answer is the unglamorous one. Export everything from your own accounts on a schedule, before anyone accuses you of anything. Pull your power logs the day a dispute surfaces, not the week of the hearing. Keep original files rather than pictures of them. Understand that the paid tier buys access to a person rather than a verdict. And know, before you spend money on a subpoena, that the statute will hand it back to you.

I built this protocol because I needed it, on a deadline, with someone else’s version of my online conduct already in front of a court. The documentation held. What I could not get, at any price, was the one piece of paper that would have made the whole exercise unnecessary. That absence is the actual story, and it is not going to fix itself.

The point of all of this is not to win an argument about a screenshot. It is to make the false attribution expensive enough to abandon. A person who fabricates attribution is running on the assumption that the accused has no way to answer and no stomach for the attempt. The answer exists, it is mostly free, and it is sitting on devices already in the house. Collect it once, collect it early, and take back the hours that would otherwise disappear into proving something that never happened.