How should messaging screenshots be presented evidentially?¶

Screenshots are common in messaging investigations because they are quick and easy to share.

Evidential caution: that a screenshot is a complete and self-authenticating record of the conversation.

What this means¶

Present the screenshot with its source, provider, date obtained, device or account context and person who produced it.

Show enough context to identify the account, conversation, participants, message order and timestamps.

Avoid cropping away identifiers, status icons or surrounding messages unless the complete original is retained.

A screenshot may omit edits, deleted messages, hidden content, metadata, message IDs, linked-device context and earlier or later parts of the conversation.

It may also display locally saved contact names rather than service-account identities.

Where the screenshot is important, seek the native conversation, export, device or provider records for corroboration.

In reports and exhibits, distinguish the visual record from conclusions about account identity, device use and personal attribution.

What to check or do next¶

• Preserve the original file where possible, not only a version pasted into a document.
• Record whether the screenshot was captured by a witness, investigator, platform export or another process.
• Do not imply that the screenshot proves authorship simply because a name appears above the message.
• Preserve the source and collection method so another investigator can test the same conclusion.
• Preserve the source and collection method so another investigator can test the same conclusion.

Evidential limits¶

Where uncertainty remains, identify what further evidence would be needed and why it would matter.