A screenshot can be a useful starting point for analysis: it captures a view that someone considered significant and helps identify content requiring verification. However, it is not automatically a complete copy of a message, account or website. It is useful to specify what the image itself shows, which information comes solely from the account of the person supplying the material, and which additional sources may help answer the questions.

The image presents a selected view

SWGDE describes screenshots as one method of acquiring online content, alongside preserving it in other available forms. The visible address, acquisition time and continuity of the material presented all matter. A single frame may not include the entire conversation, an earlier post or page elements outside the screen. [1]

Use precise wording when describing a screenshot. ‘The image displays this content’ is a different statement from ‘this person sent the message at this time’. The latter requires additional circumstances to be established. This does not mean that every image is suspect; the aim is to match the conclusion to what can actually be verified.

Image metadata and message data are different things

A date stored in an image file may concern the image rather than the time the depicted message was sent. Likewise, a filename assigned during copying does not identify the author of a conversation. In authenticity examinations, SWGDE points to the need to consider the visible content, the file structure and the available comparison material. A single image may not provide a basis for resolving every question. [2]

Prepare separate descriptions of what is visible and where it came from. Who took the screenshot? On which device? Is it a file you received, a photograph of another screen or an image pasted into a document? If you do not know an answer, leave it undetermined. Missing information should not be replaced by guesswork.

Preserve the file and available context

Provide the file you have in the form in which you received it. Prepare your own markings, arrows and crops on a separate copy. SWGDE distinguishes preserving the unchanged contents of material from establishing its origin and consistency with the claimed event. Describing these issues separately helps prevent a neatly presented attachment from being mistaken for source material. [3]

If you still have authorised access to the source, discuss whether a broader set of material can be preserved. Depending on the case, a conversation export, original message, attachment or saved webpage may be useful. Do not access other people’s accounts or try to bypass access restrictions. Report which sources are available so their use can be agreed in advance.

  • Record the known webpage address or conversation identifier.
  • State whether the images cover the entire relevant thread or only part of it.
  • Describe the order in which files were received and the known dates.
  • Label copies containing your own comments as annotated material.
  • Explain which specific assertion needs to be checked.

A hash value does not confirm the truth of the depicted scene

A hash value allows a file's contents to be compared with a previously calculated value to check for changes. However, NIST notes that the material may have been altered before it was preserved in this way. Remaining unchanged since a particular point therefore does not prove that the image originally depicted a real event in the claimed circumstances. Information about its origin is also needed. [4]

It is useful to distinguish three questions at the outset: what the file depicts, whether it changed after preservation, and whether its content can be linked to a particular person and event. Each may require different material. An answer to one does not automatically resolve the others.

Hypothetical example

A client has a screenshot of a conversation showing the contact name ‘Contractor’. They want to establish who confirmed a price change. The displayed name alone does not explain how the contact is linked to a particular person or the course of earlier arrangements. Additional material may include the other party’s identifier, a fuller conversation thread and original attachments. If these are missing, the analysis should clearly identify this limitation instead of filling in the context.

Sources

Primary documents; accessed: 23 October 2026.

Digital forensics—scope of examinations →