?
Solved

screenshot as evidence

Posted on 2014-01-17
9
Medium Priority
?
531 Views
Last Modified: 2014-01-19
How can we detect if a screen shot has been edited?
Must it be of certain format (jpg, png, PDF, ...) ?
0
Comment
Question by:sunhux
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
9 Comments
 
LVL 83

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 400 total points
ID: 39790246
PCs normally create JPgs, Macs create PNGs, I don't know what Linux GUI will create.  You would have to look for something that doesn't match what a known screenshot will show.  It could be very difficult to tell whether it has been edited.  One possible clue could be that the screenshot is not the same size as the screen it is supposed to be showing.  That would indicate that it has been cropped or resized.
0
 
LVL 82

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 1600 total points
ID: 39790253
With a skilled editor you won't see any difference even at high magnification (zoom in).  Date Time stamps can be altered. You need to have the complete chain of evidence .  From the time the screenshot is taken until it is presented as evidence. A forensic search of the hard drive that it was originally saved on can reveal older versions.  Computer graphics do not stand up well in court these days.
0
 

Author Comment

by:sunhux
ID: 39790314
Right, the screen shots are needed as evidence to auditors that
certain accounts have been deleted as of a certain date/time:
my plan was to have the date+time displayed at the bottom
right corner with Windows "Users" management listed, then
take a screen shot but I was asked how do I know the screen
shots have not been altered/rigged?
0
Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

 
LVL 82

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 1600 total points
ID: 39790325
Take the screen shots yourself then sign a declaration is about all you can do.
0
 

Author Comment

by:sunhux
ID: 39790407
Thought a video shot of, say, a crime taking place (say theft in a shop)
could stand in a court, or couldn't it?

Actually those screen shots are not taken by me, rather by my
Wintel colleague from a different group.
0
 

Author Comment

by:sunhux
ID: 39790409
Perhaps could ask my colleague to use his iPhone to take
a very short video of his screen?
0
 

Author Comment

by:sunhux
ID: 39790413
I was tasked to front the auditors
0
 
LVL 82

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 1600 total points
ID: 39791540
Actually those screen shots are not taken by me, rather by my
Wintel colleague from a different group.


Print the screenshot and have him sign it
0
 
LVL 82

Accepted Solution

by:
David Johnson, CD, MVP earned 1600 total points
ID: 39791544
A CCTV used as evidence the video is removed from the scene and a strict chain of custody is enforced.  A video of unknown parentage is unacceptable  i.e. using a green screen I can put anyone anywhere.
0

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Let's recap what we learned from yesterday's Skyport Systems webinar.
The well known Cerber ransomware continues to spread this summer through spear phishing email campaigns targeting enterprises. Learn how it easily bypasses traditional defenses - and what you can do to protect your data.
Microsoft Office Picture Manager has a Picture Shortcuts pane that shows a list with the Recently Browsed folders. While creating my video Micro Tutorial here at Experts Exchange showing How to Install Microsoft Office Picture Manager in Office 2013…
In a recent question (https://www.experts-exchange.com/questions/28997919/Pagination-in-Adobe-Acrobat.html) here at Experts Exchange, a member asked how to add page numbers to a PDF file using Adobe Acrobat XI Pro. This short video Micro Tutorial sh…

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question