What should be preserved alongside a messaging screenshot?¶

A screenshot may be the first evidence available, but it should rarely be the only thing preserved.

Evidential caution: that saving the visible image preserves everything investigators may later need.

What this means¶

Consider whether a screen recording can preserve scrolling context and navigation to the account profile. Do this carefully. Opening messages, scrolling through disappearing content or reconnecting a device may change the evidence.

Where relevant, preserve associated material such as exported chats, original attachments, link destinations, notification records and account details.

Document every action taken. The aim is to retain both the visible evidence and enough provenance to explain where it came from and what it represents.

What to check or do next¶

• Start with the original screenshot file. Avoid relying only on a printed copy, a photograph of the screen or an image pasted into a report. Copying, cropping and re-saving can remove file information and reduce quality.
• Preserve the wider screen context where possible. This may include the application name, conversation title, username, telephone number, profile details, group information, message status, dates, time zone and surrounding messages.
• Capture stable identifiers. Display names and profile pictures can change. Telephone numbers, usernames, account IDs, message IDs, channel IDs and group identifiers may be more useful for later comparison or provider requests.
• Preserve the source device where proportionate and lawful. The device may contain the native conversation, attachments, notifications, local databases, linked-device information and deleted remnants.
• Ask whether the other participant still holds the conversation. Recipient-side evidence may preserve content that has disappeared from the original account.

Evidential limits¶

Record who created the screenshot, when it was created, which device and application were used and how it was supplied. If the exact capture time is uncertain, record that uncertainty rather than guessing.