What are the limitations of screenshots and photographs?¶

Screen images preserve appearance, not the complete underlying data, system event or identity of the user. Their evidential value depends on provenance, context and corroboration.

A visual record is selective¶

An image may omit metadata, message headers, full URLs, account IDs, deleted content, audit records, earlier versions and surrounding conversation. A photograph can suffer blur, reflections or missing physical context; a screenshot can be cropped, edited or recreated.

The displayed timestamp may be inaccurate, an account may be spoofed or compromised, and cached content may not represent a live provider record. An image therefore supports the narrow proposition that this presentation was captured under the documented circumstances.

Dynamic or disappearing content may make an image especially valuable, but also increases the importance of recording who made it, when, on which device or account and by what method.

Preserve the closest available source¶

Keep the original image file and avoid unnecessary resaving or transfer through services that compress it or remove metadata. Record known edits, crops and annotations; retain an unaltered master separately.

Where authenticity or completeness matters, seek native messages, account exports, provider records or device examination. A screenshot created on the source may itself produce a file or audit event, while an external photograph usually preserves less technical detail.