Solved

screenshot as evidence

Posted on 2014-01-17
9
498 Views
Last Modified: 2014-01-19
How can we detect if a screen shot has been edited?
Must it be of certain format (jpg, png, PDF, ...) ?
0
Comment
Question by:sunhux
  • 4
  • 4
9 Comments
 
LVL 83

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 100 total points
ID: 39790246
PCs normally create JPgs, Macs create PNGs, I don't know what Linux GUI will create.  You would have to look for something that doesn't match what a known screenshot will show.  It could be very difficult to tell whether it has been edited.  One possible clue could be that the screenshot is not the same size as the screen it is supposed to be showing.  That would indicate that it has been cropped or resized.
0
 
LVL 78

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 400 total points
ID: 39790253
With a skilled editor you won't see any difference even at high magnification (zoom in).  Date Time stamps can be altered. You need to have the complete chain of evidence .  From the time the screenshot is taken until it is presented as evidence. A forensic search of the hard drive that it was originally saved on can reveal older versions.  Computer graphics do not stand up well in court these days.
0
 

Author Comment

by:sunhux
ID: 39790314
Right, the screen shots are needed as evidence to auditors that
certain accounts have been deleted as of a certain date/time:
my plan was to have the date+time displayed at the bottom
right corner with Windows "Users" management listed, then
take a screen shot but I was asked how do I know the screen
shots have not been altered/rigged?
0
 
LVL 78

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 400 total points
ID: 39790325
Take the screen shots yourself then sign a declaration is about all you can do.
0
Superior storage. Superior surveillance.

WD Purple drives are built for 24/7, always-on, high-definition security systems. With support for up to 8 hard drives and 32 cameras, WD Purple drives are optimized for surveillance.

 

Author Comment

by:sunhux
ID: 39790407
Thought a video shot of, say, a crime taking place (say theft in a shop)
could stand in a court, or couldn't it?

Actually those screen shots are not taken by me, rather by my
Wintel colleague from a different group.
0
 

Author Comment

by:sunhux
ID: 39790409
Perhaps could ask my colleague to use his iPhone to take
a very short video of his screen?
0
 

Author Comment

by:sunhux
ID: 39790413
I was tasked to front the auditors
0
 
LVL 78

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 400 total points
ID: 39791540
Actually those screen shots are not taken by me, rather by my
Wintel colleague from a different group.


Print the screenshot and have him sign it
0
 
LVL 78

Accepted Solution

by:
David Johnson, CD, MVP earned 400 total points
ID: 39791544
A CCTV used as evidence the video is removed from the scene and a strict chain of custody is enforced.  A video of unknown parentage is unacceptable  i.e. using a green screen I can put anyone anywhere.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You may have a outside contractor who comes in once a week or seasonal to do some work in your office but you only want to give him access to the programs and files he needs and keep privet all other documents and programs, can you do this on a loca…
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
In this third video of the Xpdf series, we discuss and demonstrate the PDFtoText utility, which converts PDF files into plain text files. Download and install the software.: You may have already downloaded and installed the Xpdf tools while watching…
Microsoft Office Picture Manager has a Picture Shortcuts pane that shows a list with the Recently Browsed folders. While creating my video Micro Tutorial here at Experts Exchange showing How to Install Microsoft Office Picture Manager in Office 2013…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now