What are the limitations of screenshots and photographs?¶

Screenshots and photographs are valuable first-response records, but they are incomplete representations of digital evidence.

Evidential caution: that an image of a screen proves the underlying event exactly as it appears. It may not show where the data came from, whether it was edited, whether the account was genuine or whether the timestamp was accurate.

What this means¶

An image usually captures only what was visible at one moment. It may omit hidden metadata, deleted content, message headers, full URLs, account IDs, audit records, earlier versions and surrounding conversation.

Screenshots can be cropped, altered or recreated. Photographs can capture reflections, blur, incomplete screens or the wrong device context. Neither automatically proves who controlled the account or device.

Be careful with disappearing or dynamic content. The image may be the only surviving view, but that makes accurate documentation of the circumstances even more important.

Where authenticity or completeness is disputed, specialist examination may be needed to assess the original device, file or account context.

What to check or do next¶

• Record how the image was produced, who produced it, when and from which device or account. Preserve the original file and avoid unnecessary resaving, compression or transfer through services that may alter quality or metadata.
• Use images to support preservation, triage and explanation. Do not rely on them as the only evidence where native records, provider data, account exports, device examination or other corroboration are available.

Evidential limits¶

A screenshot created on the device may also change the evidence by creating a file, notification or activity event. A photograph taken externally is less intrusive but may not capture fine detail.