Almost everyone’s first instinct is to screenshot — and that instinct is right in the moment, because a screenshot is fast and it captures something that might vanish.
The mistake is stopping there.
A screenshot is a photo of your screen: it can be cropped or edited, and it throws away the data underneath that proves a message is genuine.
This page is the consumer-friendly version of why that matters and what to do instead.
What a screenshot actually captures
A screenshot records pixels at a moment in time.
What it does notcarry is the metadata sitting behind the message: the precise send time, the sender’s account identifiers, message IDs, and device details.
That hidden layer is exactly what someone would use to confirm a message is authentic — and it is gone the instant you crop a screenshot and delete the original.
What “forensic” adds
A forensic copy preserves the original item and the data around it, made and documented in a way that does not alter the source.
NIST’s mobile-forensics guidance is organized around capturing and protecting that authoritative data, and SWGDE’s best practices cover handling it so it stays defensible.
The point is not that screenshots are useless — it is that they are the top of the evidence, not the whole thing.
What to capture, as a non-expert
- Export the conversation or email with full headers, not just a picture of it.
- Save the original photo, file, or attachment — do not re-send or re-save it.
- Screenshot for context, then preserve the original before it can disappear.
- Do not edit, crop, or rename the originals; keep them read-only.
When it needs to hold up
If your situation might reach a court, the gap between a screenshot and a defensible copy is the gap between “it got thrown out” and “it got admitted.”
A credentialed examiner can make a forensic copy and document the handling; Federal Rule of Evidence 902 even lets properly certified electronic records authenticate themselves.
See how SleuthX turns preserved evidence into exhibits and how evidence becomes a court exhibit.
