What should be recorded about the screen?¶

Record the complete display as found, then capture readable details that identify the account, application, content, time and connection state without navigating.

Begin with the whole display¶

A close image of one message can omit the window, device and account that gave it meaning. Capture the physical setup and full screen before recording individual areas. Where an external monitor is used, show how it connects to the laptop, desktop, dock or other system.

Note whether the screen is locked, unlocked, blank, asleep or damaged. Record visible applications, browser tabs, conversations, command windows, prompts and warnings. Include usernames, profile images, URLs, document names, timestamps and partial identifiers exactly as displayed.

Connection icons for Wi-Fi, mobile service, VPN, Bluetooth or remote desktop may help distinguish live, cached and remotely presented content. Battery level and system time also provide context.

Leave transient elements untouched¶

Photograph notifications, banners and pop-ups before considering any response. Opening or dismissing them may mark content as read, launch another application or remove information that cannot be recreated.

External photography is often the safer first record because an on-device screenshot can create a file and system event. Whatever method is used, record its time, operator and any change made to obtain it. A screen record establishes appearance; it does not preserve the underlying data or prove who caused the displayed activity.