Synthetic Evidence in Black PR: How to Verify Screenshots, PDFs, Messages and Audio

A reputational attack no longer needs a genuine leak to cause damage. A fabricated screenshot, altered PDF, invented email thread or cloned voice recording can reach journalists, clients and employees before an organisation has time to check what happened. The strongest response is not an immediate denial or a confident claim that artificial intelligence was involved. It is a disciplined verification process that separates the origin of a file, the integrity of the copy and the truth of the allegation. This distinction matters because a genuine file can be presented with a false caption, while a technically altered file may still contain some accurate information. The aim is to establish what can be proved, what remains uncertain and what evidence would resolve the uncertainty. The following approach is designed for communications, marketing, legal and security teams that need practical answers without turning every incident into a laboratory investigation.

Start with Provenance, Context and Evidence Preservation

Synthetic evidence is any digital material created or materially changed to imitate a trustworthy record. In black PR, the material is used to damage a person, brand or organisation through hostile publicity, anonymous distribution or coordinated amplification. The deception may be sophisticated, such as a cloned executive voice or a carefully reconstructed email. It may also be simple: a real screenshot cropped to remove a qualifying sentence, a genuine document with one figure replaced, an authentic voice note cut into a different order or an old conversation presented as current. Verification therefore begins with a broader question than “Was AI used?” The first question is “What exactly is being claimed, and which part of the material is supposed to prove it?” This prevents investigators from spending hours on visual defects while overlooking a misleading caption, an incorrect date or a missing page that changes the meaning.

The first operational step is preservation. Save the original post, page address, account name, publication time, visible engagement figures and any accompanying text. Request the original file in the form in which the sender received it, not a screenshot of a screenshot or an audio clip played through another device. Store an untouched copy and work only with duplicates. Record the file name, size and a cryptographic hash if your team has a simple evidence tool or support from IT. A hash can show that a copy has not changed since it was recorded, but it cannot prove that the underlying scene, conversation or statement is true. Preserve related material as well, including earlier versions, direct messages, download links and replies from the distributor. Deleted posts can become important because the deletion time, replacement wording or migration to another account may reveal coordination.

Do not rely on a single detector, metadata field or visual anomaly. NIST’s current work on deepfake evaluation highlights the gap between controlled testing and real-world conditions, where compression, resizing, re-recording and deliberate anti-forensic changes can weaken detection. A sensible assessment combines four areas: provenance, file integrity, internal consistency and independent corroboration. Provenance asks where the material came from and how it travelled. Integrity asks whether the available copy changed after acquisition. Internal consistency examines whether the visual, linguistic and technical details fit together. Corroboration checks the allegation against records that were created independently, such as server logs, calendars, published documents, transaction records or witness accounts. The more serious the potential harm, the less acceptable it is to replace this combined assessment with a percentage from an online tool.

Build a Verification Record Before Judging the Content

Create a simple incident record from the moment the material is received. It should state who found it, when it was found, where it appeared, who supplied each file and what actions were taken. Keep the original time zone as well as your local time, because apparent contradictions often come from automatic time conversion. Note whether a file was downloaded directly, forwarded by email, exported from a chat, captured from a screen or copied from a public post. Each transfer can change metadata or introduce compression. A clear record protects the organisation from its own mistakes: one employee may rename a file, another may convert it for easier viewing and a third may unknowingly analyse the converted copy as though it were original. Good documentation makes later expert review faster and allows communications staff to explain the basis of a public statement without revealing sensitive forensic details.

Ask the source precise, neutral questions. Which device created the material? Which application was open? What was the exact date, time and time zone? Was the content cropped, redacted, enhanced, translated, transcribed or exported? Does a complete conversation, longer recording or original document exist? Who else received it directly? A genuine source may still have incomplete answers, and an evasive answer does not by itself prove fabrication. However, the pattern of responses can change the risk assessment. A person who claims to have taken a screenshot should normally be able to identify the account, the route to the conversation and the approximate circumstances. A person who supplies a corporate PDF should be able to explain how it was obtained and why no original email, download address or document reference is available.

Build a timeline that includes both the alleged event and the distribution of the evidence. Compare claimed meeting times with calendars, building access, travel records and known public appearances. Compare a supposed email with mailbox records, ticketing systems or replies held by other recipients. Compare a document date with the date on which the named policy, logo, office address or job title actually changed. The outcome should not be forced into a simple “real” or “fake” label when the evidence does not support one. Use clear internal categories such as confirmed, probably authentic, inconclusive, probably manipulated or fabricated, and record the reasons for the rating. An inconclusive result is useful when it identifies the missing item that would change the assessment, such as the original email, the complete audio file or confirmation from the issuing organisation.

How to Check Screenshots, PDFs and Digital Correspondence

A screenshot is a picture of an interface, not a verified record of the system behind it. It can be edited in ordinary image software or rebuilt from scratch with convincing fonts, avatars and timestamps. Begin with the visible structure: spacing, line wrapping, icon placement, status-bar details, dark or light mode, date separators, reaction counters and reply formatting. Compare these features with the same version of the application on the same operating system, because designs differ between desktop, mobile and web editions and may change after updates. Treat mismatches as leads rather than proof. A resized screenshot may distort text, accessibility settings can change font size, and regional settings can alter time and date formats. The stronger request is a continuous screen recording that starts from the account profile, opens the relevant thread and shows surrounding messages, while still preserving the original screenshot separately.

Inspect the image file rather than only what appears on screen. Dimensions, crop boundaries, colour profiles, creation data and editing history may provide useful context, although metadata can be altered or removed by messaging services and image editors. Check whether the same picture, avatar, document fragment or background appears elsewhere online in an older context. Content Credentials based on the C2PA standard can provide tamper-evident information about origin and edits when a supported file carries them. They are valuable provenance evidence, but they do not certify that every statement depicted is true, and incomplete credentials do not automatically make a file false. By 2026, this type of provenance information is an important additional signal, not a replacement for source checks, contextual research and forensic examination.

For a PDF, first ask the named issuer to provide the document through an independent, known contact or official document archive. If the file contains a digital signature, validate it in a current PDF reader and check the signer, certificate status, signing time and whether the document changed after signing. A typed name, scanned signature image or decorative certificate badge is not the same as a cryptographic signature. Review document properties such as creation and modification dates, author, producer and PDF version, but remember that these fields are editable. Look for mixed page sizes, inconsistent margins, sudden changes in font rendering, misaligned baselines, altered totals, broken internal links or text that does not match the organisation’s current terminology. Scanning, optical character recognition and legitimate editing can create similar irregularities, so the most persuasive test is comparison with an independently obtained original or a trusted copy with the same reference number.

Practical Warning Signs in Messages and Documents

An email screenshot shows appearance, not delivery history. Request the original message or a full export with headers. The visible “From” line can be imitated, while full headers show the route through mail servers and the results of authentication checks. DKIM uses a cryptographic signature linked to a domain, SPF checks whether the sending server is authorised for that domain, and DMARC evaluates alignment and the domain owner’s policy. Passing checks can support the claim that a message travelled through authorised infrastructure and that signed parts were not changed in transit. It does not prove which individual pressed Send, whether an account was compromised or whether the message is being quoted honestly. Failed checks also require care because forwarding services, mailing lists and configuration errors can affect results.

For chat correspondence, obtain the longest available export and preserve the surrounding conversation. Check account identifiers, user names, profile changes, quoted replies, attachment names, edit labels, deletion markers and time gaps. A contact name stored on one phone is weak identification because it can be changed locally. Compare the alleged conversation with the other participant’s device, corporate archive or notification history where lawful and available. If a message refers to an attachment, ask for the attachment itself rather than accepting a thumbnail. If a voice note is central to the allegation, save the original audio attachment instead of recording playback from the speaker. Conversation fragments should also be checked for selective omission: removing one earlier instruction, joke, refusal or correction can reverse the apparent meaning without altering a single visible message.

Language and business context can reveal problems that technical checks miss. Compare vocabulary, punctuation, greeting style, sentence length and recurring errors with verified writing from the alleged author, but avoid amateur claims of certainty based on style alone. Look for incorrect department names, obsolete addresses, impossible approval chains, outdated legal wording, wrong currency formats or confidential information that the supposed sender would not possess. Test important claims through a separate trusted channel. A finance director can confirm whether an instruction was issued; an HR lead can confirm whether a policy existed; a supplier can confirm whether a letter was sent. Do not reply to suspicious addresses, use telephone numbers contained in the questioned document or open unexpected links merely to test them. Verification should not create a second security incident.

How to Assess Audio and Manage the Reputational Response

Audio deserves special caution because a familiar voice can create immediate emotional certainty. Modern voice cloning can imitate accent, pitch and speaking rhythm from relatively small samples, while ordinary editing can remove pauses, rearrange phrases or combine words from different recordings. Begin by obtaining the original file, the source device and the longest version available. Record how the file was captured: a telephone call, voice note, meeting recorder, video track, voicemail export or recording of loudspeaker playback. Each route leaves different limitations. Re-encoding an audio file, uploading it through a messaging service or recording playback can remove useful information and introduce artefacts that resemble manipulation. A short viral clip should therefore be treated as a lead, not as self-authenticating proof.

Careful listening may identify abrupt changes in room tone, background noise, reverberation, breath patterns, pacing or emotional emphasis. Edits can produce unnatural transitions, repeated noise textures or changes in microphone distance. Synthetic speech may contain unusually smooth pronunciation, unstable emphasis, odd handling of names or numbers and small changes in vocal identity across a sentence. None of these signs is decisive. Poor connections, noise reduction, automatic gain control and lossy compression can produce similar effects, while high-quality cloned speech may sound natural. Automated audio detectors face the same practical problem as image detectors: a score depends on the model, training data and condition of the submitted file. Use detector results to decide whether specialist review is justified, not to support a categorical public accusation.

Corroborate the spoken content before focusing exclusively on the voice. Does the speaker mention an event that had not yet occurred? Is the claimed location consistent with travel, access or call records? Do other participants remember the conversation? Does the wording match a real agenda, contract or internal decision? Collect verified comparison recordings of the alleged speaker from similar conditions when possible; a studio interview is a poor comparison for a compressed phone call. A qualified audio examiner can inspect file structure, encoding history, waveform continuity, background sound and speaker characteristics, while clearly stating limitations. The communications team should receive a plain-language assessment that distinguishes evidence of editing, evidence of synthesis, evidence supporting authenticity and unresolved issues. Those are different findings and should not be compressed into a single dramatic label.

When to Involve Specialists and Communicate Publicly

Specialist support is appropriate when the allegation may trigger litigation, regulatory attention, significant financial loss, dismissal, market disclosure or sustained national coverage. It is also necessary when the original file is unavailable, indicators conflict, an insider breach is suspected or the material has passed through several conversions. Engage legal counsel, digital forensic specialists, information security and communications staff under one incident lead. Give examiners the preserved originals, acquisition notes and relevant comparison material, not only a presentation containing selected screenshots. Define the questions in advance: whether the file was altered, whether its source can be identified, whether a signature is valid, whether the voice is consistent with a named person and what cannot be determined. A narrow, answerable question produces a more credible report than a request to “prove it is fake”.

Public communication should match the strength of the evidence. Avoid declaring material fabricated merely because it looks suspicious or because an automated tool returned a high score. A defensible holding statement can say that the organisation is reviewing the origin and integrity of the material, has preserved the available files and will correct verified inaccuracies. When facts are established, address the central false claim with specific records and dates rather than repeating every allegation. Explain whether the distributed item was fabricated, altered, incomplete or presented without context, because these are not interchangeable. Keep an update log and correct your own statement if new evidence changes the assessment. Calm precision protects credibility better than outrage, personal attacks or threats that may amplify the hostile story.

Preparation reduces both investigation time and reputational loss. Maintain a register of official policies, public statements and high-risk documents with version dates and responsible owners. Use properly configured domain email authentication, controlled document approval, digital signatures where suitable and secure archives for important correspondence. For original media, consider capture and publishing workflows that preserve Content Credentials or comparable provenance records. Train executives and communications teams to preserve files before forwarding or editing them, and establish a contact route for urgent verification requests from journalists and partners. In the European Union, AI Act transparency obligations concerning certain AI-generated or manipulated content apply from 2 August 2026, but labels and technical markers will not prevent every unlabelled or deliberately stripped item. A resilient organisation therefore combines provenance, independent records, expert review and measured communication rather than expecting one tool or one regulation to settle every case.