Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Preserve the original source first. Keep the phone, account, conversation and message in the state in which you found them, and treat screenshots as a supplementary record of what appeared on a screen at a particular moment. Do not delete, edit, crop, annotate, forward or repost the only copy. Record the surrounding context and every handoff, then contact local law enforcement or the assigned investigator for collection instructions.
If a child is in immediate danger, call local emergency services. Do not confront a suspected abuser, attempt to investigate an account yourself or circulate suspected child sexual abuse material (CSAM). If illegal images may be involved, do not download, copy, upload or forward them; report through the appropriate authority and follow its instructions.
What a screenshot can—and cannot—establish
A screenshot is a visual rendering of a screen at the time it was captured. It can show visible text, a profile label, a timestamp displayed by an app, an image and nearby conversation. It usually does not preserve the underlying message record, account-registration data, server logs, edit history, deleted material, attachment metadata, device metadata or the full conversation. A visible name or avatar also does not by itself prove who controlled the account.
For those reasons, no screenshot method is automatically authentic or admissible. Investigators, prosecutors and courts evaluate the item with other evidence: the original device or account, provider records, witness testimony, surrounding communications and a documented handling history.
#1 Best Overall
Evidence forms at a glance
| Item | What it preserves | Important limitation |
|---|---|---|
| Screenshot | What was visible on a screen, including selected context | May omit native data, metadata, deleted content and server-side records |
| Native message or export supplied by the platform | Structured communication data and, depending on the platform, identifiers and timestamps | Format and fields vary; exports can still omit deleted or inaccessible data |
| Original phone or computer | Local app state, notifications, files and device context | Improper handling can alter or destroy data |
| Provider-held records obtained by investigators | Account, access and message records held by the service | Requires the appropriate legal process and may not exist or remain available |
| Handling log | Who possessed an item, when, what was done and where it was stored | Documents provenance; it does not repair an altered source |
How do I preserve screenshots as evidence?
Use the following civilian-safe sequence for material that is already visible to you. It is a conservative preservation practice, not a substitute for an agency’s evidence procedure.
- Address immediate safety. If a child may be at risk now, call emergency services or law enforcement. Do not warn or confront the suspected abuser if doing so could increase danger.
- Stop changing the source. Leave the conversation, account and device as you found them. Do not reply, react, delete, unsend, edit, block, accept a new request, change the password or install a capture app merely to obtain evidence.
- Record context while it is fresh. In a separate note, write the platform, profile or account name as displayed, sender and recipient identifiers that are visible, the date and time shown, the time zone if known, the page or message location, and how you reached it. Describe what you saw without guessing who operated an account.
- Capture only if safe or requested. If an investigator asks for screenshots, capture enough surrounding conversation or page context to show sequence, account indicators and displayed dates or times. Keep an untouched original capture. Do not crop, annotate or enhance the only copy. App layouts differ, and metadata may not appear in the image.
- Preserve the device and account. Keep the phone or computer available and charged only as you normally would; do not attempt forensic extraction, password bypass, network isolation or account access. Ask the investigator how they want the device stored and delivered.
- Make a simple handling log. For each transfer or action, note the date and time, person, item or file, action taken, destination and storage location. Keep the note separate from the source file.
- Contact the assigned investigator promptly. Tell them what exists, where it is, whether anything changed inadvertently and who has handled it. Follow their instructions for transfer rather than sending sensitive material through ordinary messaging or cloud links.
What to write in your context note
- Platform or website and the visible account/profile name
- Visible sender, recipient, phone number, handle or profile URL
- Displayed date, time and known time zone
- Conversation or page title and where the relevant item appears in sequence
- Device used and whether you were logged in as yourself
- How you encountered the material and any accidental changes
- Name of the person or agency to whom you reported it and when
These details help an investigator understand provenance; they are not proof that a displayed identity is genuine.
Are screenshots enough, or should I keep the original messages?
Keep the original messages, account and device whenever possible. A screenshot should supplement—not replace—the source. Preserve the complete conversation around the relevant statement when an investigator requests it, because isolated lines can hide replies, edits, dates or coercive context.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteDo not create a “clean” copy
Cropping, drawing arrows, changing contrast, adding captions or converting the only file can make it harder to establish what was originally captured. If an agency wants a working copy, retain the untouched original and clearly label any derivative as a copy. Do not overwrite the source with an edited version.
Native data and provider records
Investigators may seek a platform export or records directly from the provider through appropriate legal process. The 2023 edition of 18 U.S.C. § 2258A says that a completed provider submission of a report to NCMEC’s CyberTipline is treated as a request to preserve the contents provided for 90 days under that subsection. It also addresses reasonably accessible commingled visual depictions, data or digital files that may provide context, with secure handling and access limited to what is necessary. This is a provider-submission rule, not a guarantee for every public tip, account report or piece of content, and it does not replace separate authority under 18 U.S.C. § 2703. Current law and the case-specific process should be confirmed with investigators or counsel.
What should I do with the phone or account before police see it?
For a witness or caregiver
- Do not browse through unrelated accounts or devices looking for more material.
- Do not log into another person’s account, guess a password or bypass a lock.
- Do not install forensic software, reset the device or change its settings to “protect” evidence.
- Keep the device and any removable media in your possession unless an investigator instructs a handoff.
- Tell investigators if the device is shared, automatically synchronizes, has a damaged screen or may be remotely wiped.
Mobile-device handling can change data or cause loss. NIST’s Guidelines on Mobile Device Forensics (SP 800-101 Rev. 1, 2014) describes preservation as securely maintaining custody without altering or changing data on devices and removable media and warns that improper handling can result in data loss. It is older technical guidance, so agency procedures and trained examiners take precedence.
For an investigator or authorized examiner
Use your agency’s current mobile-device and digital-evidence procedures. Document acquisition, examiner identity, tools and settings, device condition, time source, storage destination and every transfer. Preserve native communications where feasible and create formal reports for substantive case information. DOJ Justice Manual § 9-5.004 directs federal prosecution-team members to preserve substantive electronic communications created or received during an investigation, including communications with lay witnesses, in native electronic format when feasible. That is federal prosecution-team guidance, not a civilian instruction.
How can investigators show where an online message came from?
Investigators build provenance from multiple sources rather than relying on a screenshot alone. They may compare the device view with native app data, account identifiers, provider-held records, subscriber information, access logs, witness accounts and the chronology recorded in reports. A screenshot can help show what a witness saw, but it cannot by itself establish account ownership, authorship or server-side timing.
Chain of custody
NIST’s evidence-management guidance says handlers should prevent compromise, contamination and degradation and track chain of custody. The National Academy of Sciences report Strengthening Forensic Science in the United States: A Path Forward (2009), quoted by NIST, states: “In order for qualified forensic science experts to testify competently about forensic evidence, they must first find the evidence in a usable state and properly preserve it.”
A useful civilian log is simple: “On [date and time], [person] viewed or received [device/file], took [action], and stored or transferred it to [location/person].” Do not backfill entries from memory without identifying that you are doing so.
Capturing a conversation when an investigator asks
- Ask the investigator what device, account and portion of the conversation they need.
- Open only the requested conversation or page; avoid searching unrelated material.
- Capture the relevant message plus sufficient surrounding sequence to make its position understandable.
- Include displayed account and date/time indicators when they are visible, without assuming they prove identity.
- Save the original capture in the format produced by the device. Do not edit the file.
- Write down the capture time, device, app or browser and any limitation, such as a missing timestamp or content that would not load.
- Transfer it using the investigator’s approved method and log the handoff.
If the screen contains suspected CSAM, stop. Do not take a new screenshot, download the image or upload it to any service. Preserve the device and report through authorities, following their directions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Storage, copies and external drives
Use the storage method an investigator or agency specifies. California POST guidance describes digital forensics as preserving evidence in its most original form and defines external drives as storage commonly used for backups. An external drive can be an authorized examiner’s working medium, but it is not by itself a chain-of-custody solution and is not necessary for every family. Do not buy equipment or make a forensic copy unless an authorized professional instructs you under agency policy.
Keep access limited, avoid automatic photo-library synchronization for sensitive material, and do not share links in group chats or social media. Tell investigators if a file was automatically backed up or viewed by another person.
Common mistakes and what to do instead
| Problem | Why it matters | Safer response |
|---|---|---|
| You cropped or annotated the image | Original context and file history may be lost | Keep the edited copy separate, disclose the change and preserve the device/source |
| You forwarded the message to yourself | Forwarding can change headers, timestamps or sequence | Tell the investigator exactly what happened; do not forward more |
| The account disappeared | Deletion or suspension may remove access | Record when you last saw it and contact law enforcement promptly for preservation steps |
| The phone is shared or may be remotely wiped | New activity can alter data | Tell investigators and follow their handling instructions; do not improvise isolation |
| A screenshot shows a username but no verified identity | Display names are not proof of account control | Describe it as displayed and let investigators seek corroborating records |
| A page will not load | Repeated attempts can change state or trigger security controls | Record the error and time; stop and ask investigators what to do |
Troubleshooting preservation problems
The app hides dates or surrounding messages
Do not use a third-party scraper or alter the app. Capture what is legitimately visible if requested, note which fields are absent, and retain the device so an examiner can assess native data.
The screenshot is blurry or unreadable
Keep the original file and explain the limitation. Do not sharpen or upsample the only copy. An investigator may obtain a native export or provider record.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
You accidentally deleted or changed something
Stop interacting, write down exactly what changed and when, and tell law enforcement. Do not attempt recovery utilities or password workarounds on your own.
You received a cloud link or disappearing message
Do not repeatedly open it or ask the sender to resend it. Record the link, account and time as displayed, preserve the receiving device and ask investigators about lawful preservation requests.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Or skip the browser setup:
For a lawful, non-sensitive webpage—such as a public profile page or a page documenting where a report was found—ScreenshotNeo can return a screenshot with one request. Do not send suspected CSAM, private messages or other material you are not authorized to disclose to a third-party capture service; use law-enforcement instructions for sensitive evidence.
ScreenshotNeo accepts the cookie or consent banner like a visitor and removes more than 60 known consent platforms, newsletter popups and chat widgets before capture. Only clean shots are billed: bot checks or CAPTCHAs, blank pages, timeouts, failed loads and cache hits cost nothing, and response headers identify the page verdict and whether it was billed. Its MCP server provides take_screenshot, get_page_info and capture_pdf tools for Claude, Cursor and other MCP clients. Every plan includes the features; 1,000 shots per month are free with no card, and paid plans start at $5 for 3,000 shots.
cURL
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);See the ScreenshotNeo documentation for request options. A capture can be full-page, limited to a CSS-selected element, rendered in dark mode or a device preset, delayed until a selector or network idle, and saved as PNG, JPEG, WebP or PDF. Those options are useful for ordinary public documentation, not a reason to upload illegal or private evidence.
Sign up for ScreenshotNeo to get 1,000 screenshots a month free with no card; paid plans start at $5 for 3,000.
Best Value
Questions investigators may ask you
- When did you first see the message, and on which device?
- Were you logged into your own account or viewing someone else’s device?
- Did you reply, forward, save, delete, crop or annotate anything?
- Who else handled the device or file?
- Was the account private, public, shared or later unavailable?
- What time zone and clock settings did the device display?
Answer accurately, including mistakes and uncertainty. A disclosed limitation is more useful than an unexplained gap.
Frequently Asked Questions
Should I print screenshots for police?
Ask the assigned investigator. Keep the original digital files and device available; printing is only a convenience copy and does not replace the source.
Can I ask the platform to preserve a message?
Report through the platform and law enforcement as directed. Provider preservation rules and legal process differ, and a public report is not a general guarantee that content will be retained.
Is a screenshot legal evidence by itself?
Whether it can be used, and what weight it receives, depends on the jurisdiction and the complete facts. Investigators and courts assess authenticity, context and handling rather than applying an automatic rule.
What if the child sent the message to me?
Do not ask the child to recreate, forward or delete it. Preserve the receiving device and account, document what was visible and contact professionals for trauma-informed instructions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
