A screenshot is an image file. Anyone can make one say anything, which is why evidence that might be disputed needs something beyond the content itself: a record of when it was taken, by what, and that it has not changed since.
When provenance matters
| Situation | How much it matters |
|---|---|
| A routine abuse report to a cooperative host | Little. They will look themselves while it is up. |
| A report to a registrar who pushes back | Considerably. Your capture may be the only record. |
| A dispute proceeding | Decisive. Undated screenshots carry very little weight. |
| Anything that may become a legal matter | Decisive, and by then it is too late to add. |
What to do
- Hash every artefact on capture. A SHA-256 of each file, recorded in a manifest, establishes that the set has not changed since.
- Record the method, not just the result. The exact commands, the tool versions, the vantage point. Somebody else should be able to repeat it.
- Use a timestamp you did not generate. The CT log entry for the certificate is dated by the log, independently of you, and is permanent.
- Keep the raw responses. A saved HTTP response with its headers is stronger than a rendered screenshot, because it is closer to what the server actually sent.
- Store it somewhere append-only. Evidence in a folder anybody can edit is evidence anybody can be accused of editing.
evidence/suspicious-lookalike.example/20260915T142233Z/
page.html sha256:...
headers.txt sha256:...
dns.txt sha256:...
cert.txt sha256:...
rdap.json sha256:...
ct.json sha256:...
screenshot.png sha256:...
MANIFEST.txt all of the above, plus:
captured by, from where,
commands run, tool versionsThis is proportionate, not ceremonial
The whole manifest is one script and adds a few seconds. It is not a legal process and it does not need to be — it is the difference between “here is what we saw and how we saw it” and “here is a picture”, and the first one gets acted on by people who receive a hundred of the second every day.