Should I take screenshots or photographs?¶

Screenshots and photographs can both preserve useful visual evidence, but they do different jobs and may have different evidential effects.

Evidential caution: that a screenshot is always better because it is a direct digital copy. Taking one may create a new file, alter recent activity, trigger a notification or record that the screen was captured.

What this means¶

An external photograph is often the safest first step. It can show the full device, the screen, the surrounding scene, connected cables and the condition in which the system was found.

A screenshot may provide clearer detail and may preserve information that is difficult to photograph. However, consider whether the operating system, application or other user could record or detect it.

What to check or do next¶

• Use the least intrusive method that captures the necessary information. Where the device is live, unlocked or displaying volatile content, photograph first before considering any interaction.
• Capture the whole screen and then relevant close detail. Do not produce only cropped images that remove account, time, application or device context.
• Record who created the image, when, using what device and whether anything changed beforehand. Preserve the original image file where possible rather than relying only on a copy sent through messaging or social media.
• Do not treat either method as a substitute for native records, provider data or specialist acquisition. A photograph or screenshot shows what was visible at that moment, not necessarily the full underlying data or how it was generated.
• If screenshots are supplied by a victim or witness, record how they were created, whether they were edited and how they were transferred.