What should be recorded about the screen?¶

The screen may show the most immediate evidence of what the device or account was doing when encountered.

Evidential caution: that recording only the obvious message, image or application is enough. The wider screen may show the account, time, network state, battery level, notification status, open windows and other context needed to interpret what is visible.

What this means¶

Include the physical relationship between the screen and the device. An external monitor may be connected to a laptop, desktop, server or docking station. A photograph of the wider setup can show which screen belonged to which system.

What to check or do next¶

• Capture the entire screen first. Then capture closer detail where necessary. Record whether the screen was locked or unlocked, whether the device appeared to be logged in and whether any application, browser tab, message, command window, warning or system prompt was open.
• Preserve visible usernames, account handles, profile images, URLs, document names, conversation titles and timestamps. Record exactly what appeared, including partial identifiers, spelling and punctuation.
• Note any indicators of connectivity, such as Wi-Fi, mobile signal, VPN, Bluetooth, remote desktop or offline status. These may help explain whether the displayed information was live, cached or synchronised.
• Record banners, pop-ups and notifications without opening them unless there is a clear operational reason. Opening or dismissing them may alter the evidence.
• If the screen is blank, record that as well. Note whether it appears powered off, asleep, locked, damaged or simply displaying a dark application.

Evidential limits¶

Do not rely solely on a screenshot taken on the device. It may create a new file or system event and may not capture the physical context. External photography is often the safer first step.