OSINT & Research

Screenshots Are Not Evidence

Screenshots Are Not Evidence

A screenshot proves one thing: that someone, somewhere, at some point, made an image that looked like that. It does not prove the post was real. It does not prove the account belongs to who the file name says it does. It does not prove the timestamp is accurate. It does not prove the page wasn't edited two seconds before the capture. Open any browser's developer tools, double-click on text, type whatever you want, and screenshot. The result is indistinguishable from the original. This matters because screenshots show up in divorces, employment disputes, defamation cases, and harassment claims every week — and they get treated like documentary proof when they are nothing of the kind. What actually holds up:

Archival captures. The Wayback Machine, Archive.today, and Perma.cc create third-party records with their own timestamps. Not perfect, but harder to fake than a PNG on someone's phone. Full-page captures with metadata. Tools like Hunchly, Page Vault, and certified browser capture services preserve the URL, the HTTP response, the hash of the file, and a clean log of when and how the capture happened. Native files, not images. A downloaded PDF, the original video file with its embedded metadata, the email with full headers — these carry far more weight than a picture of them. Chain of custody. Who captured it, when, on what device, and where it has lived since. If that chain has a gap, opposing counsel will find it.

The fix isn't expensive. For most cases, an archival capture and a properly logged download takes under five minutes per item. The cost of skipping it is an exhibit getting thrown out — or worse, a case getting reframed around the question of whether your evidence is real. If you're building a file you might one day hand to a lawyer, assume you'll have to prove every piece of it. Capture accordingly.