Why Must the Defense Obtain Native Digital Files and Metadata?
A screenshot or an exported clip shows what someone chose to keep. The native file and its metadata let the defense check what got left out.
Mr. Heath Enix ‘Heath’ Hyde
Eligible to Practice in Texas
Attorney at Law
Bar Card Number: 00796807
TX License Date: 11/01/1996
Primary Practice Location: Dallas, Texas
Return to the Texas Murder Trial Defense Knowledge Hub
Short answer
A copy can show what someone kept. It can’t show what got cut, or when it was made. So your lawyer asks for the native file by name and has an examiner test it.
Here’s what that looks like side by side.
| What you may receive | What the native file can add |
|---|---|
| A screenshot of a text thread | The full thread, each message time, and the phone’s time zone |
| A 40-second store-camera clip | The full recording, the clock setting, and the minutes before and after |
| A one-page phone extraction summary | The full report, the tool version, and skipped records |
Each row is a gap the defense can ask about.
What counts as a native file, and what is metadata?
A native file is the file as the system that created it saved it. Say a store’s recorder saved the video in its own format. That file is native. Metadata is information stored about a file, such as when someone made it and on what device. A photo’s data might list a capture date and a phone model.
You’ll hear three more terms:
- An export or conversion is a copy in a different format. An officer might convert a clip to MP4 so he can email it.
- A hash value is a digital fingerprint of a file’s exact contents. If the lab’s copy and the defense copy have the same SHA-256 value, they match.
- An extraction report is the forensic tool’s record of what it pulled from a device. It lists the tool, its version, and the extraction date.
Does Texas law require the State to turn over native files?
Not in those words. After a timely request, CCP art. 39.14(a) requires the State to produce and allow electronic duplication of material evidence that it or its contractors possess or control. It doesn’t say “native.” So the request should, for example: “the native export from the gas station recorder, with the player software and the clock settings.”
Say the photo’s stored date is two days before the death. That helps the defense. Art. 39.14(h) makes the State disclose information that tends to negate guilt or reduce punishment, and under art. 39.14(k) the duty doesn’t end at the verdict. Brady v. Maryland (1963) treats hiding material favorable evidence as a due process violation.
Can the State use a copy instead of the original at trial?
Often, yes. So the defense tests the copy instead of assuming a court will exclude it.
| Texas Rule of Evidence | What it says |
|---|---|
| TRE 901(a) | The State must offer evidence sufficient to support a finding that the item is what it claims it is. |
| TRE 901(b)(4) | Contents, internal patterns, and other distinctive traits, with the circumstances, can authenticate an item. |
| TRE 1001(d) | For electronically stored information, any readable output that accurately reflects it counts as an “original.” |
| TRE 1003 | A duplicate is admissible like the original unless the original’s authenticity is in question or admitting it would be unfair. |
| TRE 107 | If the State offers part of a recorded statement or writing, the defense may inquire into other parts on the same subject. |
The word “accurately” in Rule 1001(d) is where the native file earns its keep. Without it, nobody can check whether the output matches the source.
What can metadata reveal that a copy hides?
Metadata often answers timing questions. Those can matter for an alibi or for another person’s movements.
| What the copy shows | What the native file may show |
|---|---|
| A doorbell clip stamped 9:58 p.m. | The clock ran 14 minutes fast, so it was 9:44 p.m. |
| A screenshot of “I’m on my way” | The send time, the account, and any renamed contact |
| A photo dated to the night of the death | A stored capture date two days earlier |
| An extraction summary listing 12 calls | Deleted call entries the summary left out |
Metadata can be wrong or altered too. So the defense checks it against records someone else kept:
- A 911 call log gives a fixed time to compare with device clocks.
- A store receipt shows a purchase at a logged register time.
- Carrier records show network activity from a separate system.
How do hash values and custody records fit in?
A hash value lets an examiner check whether two copies match. It can’t show what happened before anyone hashed the file.
Your lawyer works through four questions:
- When did someone first hash the file? NIST notes that a change made before hashing won’t show up in a later comparison.
- Do the State’s copy and the defense copy have the same hash? NIST says any change to a file produces a different hash.
- What if the hashes don’t match? Don’t call it tampering yet. NIST notes a comparison can fail even when the evidence hasn’t changed. Find out why.
- Who handled the file at each step, and when?
What should the defense ask for?
The thing itself, by name. “All digital evidence” gets whatever is easy to send. “The native export from the Shell station recorder, with the player and the clock settings” gets the file.
What can a family do to protect the digital record?
You may know where the devices are better than the police do. Her phone might still be charging on the kitchen counter, her laptop at a friend’s place on Oak Street. A neighbor’s Ring camera might face the street. Write each one down, with who has it now, and leave any screenshots you’ve already taken alone.
Give that page to the defense lawyer. Nobody can ask for a file no one knows exists.
Frequently asked questions
Can my family send screenshots to the defense lawyer?
Yes. Send them, but leave the phone and the original thread alone. An examiner can test the original. A screenshot is only a picture of it.
Does a missing native file get the evidence thrown out?
Rarely by itself. Texas courts often accept accurate duplicates, so a converted MP4 may still come in. What the missing original gives your lawyer is a reason to question how accurate the copy is.
Did police need a warrant to search the phone?
Say officers took the phone from his pocket when they arrested him. Generally, yes, they needed a warrant, under Riley v. California and CCP art. 18.0215, which lists exceptions. How police got the data is a separate challenge from its format.
Should we clean up a phone or account before handing it over?
No. Say a friend wants to delete a thread to protect him. Altering or destroying a record to keep it from an investigation can be a crime under Penal Code §37.09, and it can erase metadata the defense needs.
Talk with Heath Hyde
If digital evidence is part of a murder investigation or charge, the format can matter as much as what the file seems to show. Call Heath Hyde, P.C. at 903.439.0000 or request a free consultation. You can also read what the State must prove in a Texas murder case and browse the Texas Murder Trial Defense Knowledge Hub.
Legal sources
- Tex. Code Crim. Proc. art. 39.14
- Tex. Code Crim. Proc. art. 18.0215
- Tex. Penal Code §37.09
- Tex. R. Evid. 107, 901, 1001–1003
- Brady v. Maryland, 373 U.S. 83 (1963)
- Riley v. California, 573 U.S. 373 (2014)
- NIST IR 8387 (2022)
This article provides general educational information, not legal advice. Every case depends on its facts, evidence, court, deadlines and governing law. Past results do not guarantee a similar outcome.
