Compare
ThreadProof vs phone extraction services
The short answer
A forensic examiner takes possession of the device, extracts data at the file-system level, and signs a report about what was found. ThreadProof does something much smaller: it lays out screenshots you captured yourself into a numbered PDF and fingerprints those files. If the other side is likely to dispute that the messages exist at all, an examiner is the right call and ThreadProof is not a substitute.
| ThreadProof | phone extraction and forensic services | |
|---|---|---|
| What is examined | The screenshot files you import | The device and, where possible, its deleted and hidden records |
| Typical cost | $0 to $49 a month | Commonly hundreds to thousands of dollars per device |
| Typical turnaround | Minutes | Days to weeks, and the phone is usually surrendered |
| Who stands behind it | You. The declaration is written and signed by you | An examiner who can be questioned about their method |
| Privacy | Nothing leaves your browser | The whole device image is copied by a third party |
| Deleted messages | Not recoverable. ThreadProof only sees what you screenshotted | Sometimes recoverable, depending on the device and the software |
When phone extraction and forensic services is the better choice
- The existence or authenticity of the messages is genuinely contested.
- You need deleted content, metadata from the device, or an expert who can be deposed.
- A court or a lawyer has told you an examiner is required.
When ThreadProof fits
- Nobody disputes the messages happened; you just need them readable and organised.
- The matter is too small to justify an examiner's fee.
- You need something today.
Questions
- Does the hash make my screenshots forensic evidence?
- No. A SHA-256 fingerprint shows only that the file you keep is byte for byte the file that was exported. It says nothing about what happened on the phone before the screenshot was taken. We are careful about this on every page.
- Can I use both?
- Often that is the sensible order: build the ThreadProof packet first so everyone can read the thread, and commission an examiner only if authenticity is actually put in issue.