Is Deepfake Evidence Admissible in Court? What Examiners Need to Prove

Practitioners new to this work expect the fight to be about the algorithm. In practice, cross-examination on media authentication tends to go after the handling instead, because that is where the gaps usually are.

Who had the file, and when. What was done to it between seizure and examination. Whether the examined copy is provably the seized one. What other examinations were run and why those results are not being presented. What the method cannot establish. Whether the examiner can explain the reasoning without reading from a printout.

A technically sound finding wrapped in a poor record is more vulnerable than a modest finding wrapped in a rigorous one.

Requirements vary by jurisdiction, but the substance is consistent across common-law systems and most civil-law procedure.

There is a strong instinct to present findings as confidently as possible. In this domain it is counterproductive.

A tool that reports a single number with no interval and no stated limits hands an opposing expert their argument. They do not need to show the finding is wrong. They need only establish that the method has failure conditions which were not addressed, that the exhibit's quality was not accounted for, or that the number implies a precision the method cannot support.

A finding that says "the measurements indicate manipulation, with this confidence interval, subject to these stated limitations" is far harder to dismantle, because the qualifications an opponent would raise are already in the record.

When the evidence does not discriminate, that must be recorded as an inconclusive finding and must not be summarised as either authentic or fabricated at any later point in the file.

This matters because summaries propagate. An inconclusive technical result described loosely in a case note as "forensics found nothing wrong with it" becomes, three documents later, an assertion of authenticity that no examiner ever made — and that is exactly the kind of drift an opposing expert will trace back and use.

Earlier examinations, discarded results, and the reasoning behind a change of opinion are all potentially disclosable. Systems that overwrite a previous result when an exhibit is re-examined create a problem: the earlier result existed, may be disclosable, and can no longer be produced.

Retaining every examination and treating re-analysis as an addition rather than a replacement resolves this. The question "what else did you run?" should be answerable from the record.

Assembled, a report that holds up contains: exhibit identity and hashes; acquisition circumstances; the complete custody history; each measurement with its result and its stated limitations; the aggregate finding with its confidence interval; an explicit statement of what the finding does not establish; the examiner's decision and reasoning; and a signature binding all of it together.

Sealing the whole record with a content digest allows the report itself to be shown unaltered since generation — which forecloses one more line of challenge before it is raised.