Reference · PDF version 1
What’s in an EvidentlySo PDF
This page explains each part of a PDF generated by EvidentlySo, PDF version 1. For newer PDFs, see version 2.
The cover
The cover lists whose phone the messages were saved from, the conversations included, the dates covered, any part days, the number of messages and pictures, the flags, the Transcript ID, the time zone used, and when and by which version of EvidentlySo the PDF was generated.
Dates and times
Times are the phone’s recorded times, shown to the second in the time zone listed on the cover. Each time includes the zone abbreviation, such as MDT or MST, so daylight saving changes are clear.
Whole days and part days
The phone’s owner chooses the dates. They can include whole days, or start or end at a particular message. When a day is only partly included, the top of that day in the PDF shows the time it starts or ends, for example “Mar 2, 2026 · part of day, from 6:10:12 PM MST”. When the last day is the day the snapshot was saved, it shows “until the snapshot at” that time.
Messages outside those times on that day are not in the PDF. Dates that weren’t chosen are not in the PDF at all, and a gap between chosen dates is marked where it falls.
Message numbers
Each PDF has a Transcript ID (such as T5830) and each message has a number (such as MSG-412). Cite a message with both, for example “T5830 MSG-412”. Numbers belong to this PDF; another PDF of the same phone may number messages differently.
Names and numbers
Names come from the phone’s contacts when the PDF was generated. If a contact has no saved name, only the number is shown.
Pictures
Pictures appear where they were sent, as smaller page copies. Each footnote gives the date and time the picture was taken and the original’s fingerprint. Large PDFs are split into volumes, such as “Volume 1 of 4”.
Flags
A flag is a short grey label under a message that points out something about it, such as a picture that couldn’t be opened. A flag describes what the snapshots show; it doesn’t say why. The Appendix of each version 1 PDF explains every flag in it.
Fingerprints and checking
Each PDF names the snapshots it came from. Their fingerprints (SHA-256) are in the log attached inside the PDF. The fingerprints let anyone with the snapshots confirm each is the exact, unchanged file the export names as a source. They don’t show the snapshots are complete. For example, messages deleted from the phone before a snapshot was made won’t be in any of them.
How checking a PDF works · Verify a PDF
What a PDF doesn’t include
- Conversations and dates that weren’t chosen, and the times outside a part day.
- Messages deleted from the phone before the snapshot was saved.
- Messages the phone didn’t make available to the app, such as some encrypted chat (RCS) messages.
- Messages from other apps, such as WhatsApp or Signal.
A snapshot is a copy saved by an app, not a forensic image of the phone.
The attached log
Each PDF carries a file called export-log.json, a record of how the PDF was generated, for software that checks it. Open it from your PDF viewer’s attachments panel.