iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Capture the entire scene before you investigate it. Save the full URL, account identifiers, visible times, messages, replies and linked files; download the original media when possible; keep an untouched master; hash every file; record each transfer; corroborate the identity through an independent channel; then report promptly. A screenshot preserves what you could see, but it does not by itself prove who created the media or preserve the platform’s backend records.
Why speed and context matter
AI-generated video, audio, images and text can disappear when an account is deleted, a post is edited or a platform’s retention period expires. The strongest record combines the original digital object with the surrounding context and a documented handling history. NIST’s Digital Evidence Preservation: Considerations for Evidence Handlers (NISTIR 8387, 2022) notes that digital-evidence preservation has problems beyond traditional evidence preservation.
The FTC said on February 15, 2024, that fraudsters are using AI tools to impersonate individuals with “eerie precision” and at a much wider scale. That makes a fast, disciplined capture more useful than trying to decide first whether every frame is synthetic.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
There is no official, general consumer success rate for screenshots, hashes, provenance credentials or AI detectors proving impersonation. Evidence strength is fact-specific. A hash demonstrates that a later copy has the same bytes as the file you hashed; it does not prove that the file is genuine, who made it or what happened outside the frame.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
1. Freeze the scene safely
- Stop arguing with the account and do not click suspicious links, send money, install software or keep interacting merely to collect more material.
- Use a clean device and note the capture time in UTC and your local time zone.
- Write down the account handle exactly as displayed, the profile URL, platform name and any case or message identifier.
- If there is an immediate threat, extortion, stalking or financial loss, prioritize safety and contact local law enforcement while preserving what you can.
Continuing a conversation can alter message order, trigger deletion or expose you to malware. Preserve first; analyze later. If several people are helping, designate one person to maintain the master files and custody log so that copies and edits are not confused with originals.
2. Capture context, not just a cropped image
Make a sequential record that lets another person understand where the material came from.
Use a browser capture
- Open the profile or message list, not just the suspect image.
- Start a screen recording or take sequential screenshots while moving to the suspect post, direct message, call details or attachment.
- Keep the browser address bar visible. Include the full URL, username, profile link, visible date and time, replies, view counts, warning labels and linked files.
- Scroll slowly enough that the sequence is intelligible. Capture the page before and after the suspect item if the surrounding conversation supplies meaning.
- Save the original URL as plain text in your evidence log. Do not rely on a shortened link or a platform’s display name alone.
What a screenshot can and cannot establish
- It can preserve visible wording, layout, account labels, timestamps and the state of a page at capture time.
- It may omit EXIF or other file metadata, server-side edit history, deleted replies, IP logs and the original upload.
- It can be altered after capture, so retain the original capture file and document how it was created.
A screen recording is useful when menus, a disappearing story or a call-detail screen must be shown in sequence. It is still a record of what was displayed, not an export of the platform’s internal records. Capture the device clock or an on-screen time indicator when one is visible, but do not crop away the browser or app controls that identify the source.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Obtain the original digital object
Use the platform’s download or export function whenever it is available. Save the downloaded image, audio, video, document or chat export without opening it in an editor or transcoding it.
Separate the master from working files
- Keep the downloaded file’s original filename and file-system timestamps.
- Make a duplicate for frame extraction, transcription, redaction or annotation.
- Never overwrite the untouched master with an edited or converted version.
- Store the master on write-protected or otherwise access-controlled media, and keep a second copy in a separate location.
A write-protected USB flash drive or external SSD can hold the untouched master and the working copy. Storage hardware protects against accidental changes; it does not authenticate the content or prove that a voice, face or account is real.
Preserve associated files
Save subtitles, thumbnails, captions, attachment names, message exports and any linked documents. Keep the exact spelling of domains, email addresses, telephone numbers, payment instructions and wallet addresses. A link that later redirects may be less useful than the URL string and a capture of the page as it appeared.
If the platform offers an account-data export, retain the export package as delivered, including its folder structure and any explanatory file. Do not discard a low-resolution preview simply because a larger download exists; the preview may show the warning label, caption or timestamp that accompanied the post.
4. Make integrity checkable
For each saved file, create a SHA-256 hash and put the value in a log with the filename and capture or download time. Hash the file again after copying it and record whether the value matches.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Example commands
On macOS or Linux:
sha256sum suspect-video.mp4On Windows PowerShell:
Get-FileHash .suspect-video.mp4 -Algorithm SHA256Record at least:
- filename and file size;
- SHA-256 value;
- capture or download time, including time zone;
- source URL, platform and account identifier;
- device and operating system;
- method of acquisition, such as platform export, browser download or screen recording;
- every person or system that handled the file, with transfer time and purpose.
A matching hash means the later copy has the same bytes as the hashed copy. It does not establish authorship, truth, editing history before capture or that the media is AI-generated.
Keep a simple custody log
File: suspect-video.mp4
SHA-256: <hash value>
Source URL: <copied URL>
Account: <exact handle or ID>
Acquired: 2026-10-16 14:22:07 UTC
Method: platform download
Device/OS: <device and OS>
Handled by: <person or system> — <time and action>
Copy check: matching hashStore the log separately from the working copy and make it clear which file is the master. If you must redact material for sharing, export a new derivative file and leave the master unchanged. Keep detector reports, transcripts and annotated stills in a clearly labeled derivatives folder, and hash those files separately if you provide them to someone else.
5. Preserve communications and identifiers
Retain the exact wording of requests and all identifiers connected to the incident. The FBI’s June 5, 2023 public service announcement advises victims to retain all information about the incident, including usernames, email addresses, websites or platform names, photos and videos.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches- usernames, display names and profile IDs;
- profile links, domains, telephone numbers and email addresses;
- message headers, timestamps, replies and call details;
- payment instructions, bank details, wallet addresses and transaction IDs;
- the names of people or organizations the account claimed to represent;
- any warning banner, verification label or platform notice.
Keep complete message exports where the service provides them. Do not rely on a paraphrase when the exact wording can be saved. Preserve the order of messages and note which messages were sent by you, by the account and by any third party. If a message shows a phone number or payment address only once, capture it in context and copy it into the log exactly, including punctuation.
6. If the impersonation arrived as a cloned-voice call
Save the audio or voicemail in the format supplied by the phone or messaging service. Also preserve the call log, caller ID as displayed, telephone number, date and time, duration, voicemail transcript, text messages that referred to the call and any payment request. A screen recording of the call-detail screen can establish how the number appeared to you, while the audio file preserves what was heard.
Do not call back through a number supplied in the suspicious message. Ask the supposed speaker through an independent, known channel whether they made the call, and retain that response. If another person heard the call, record that person’s name and a short account of what they observed without altering the original audio. Provide both the untouched audio and any transcript or enhancement as a separate derivative.
7. Corroborate without overclaiming
Compare the account and contact details with known official channels. Contact the supposed speaker or organization through a phone number, domain or account you already trust—not through the suspect conversation. Preserve the response and the channel used to obtain it.
Recommended Free Tools
Useful warning signs
The FBI IC3 public service announcement dated July 20, 2026 lists possible clues including small URL or spelling differences, distorted hands or facial features, irregular shadows, unrealistic accessories, call lag, lip-sync or synchronization problems and unnatural movements. These clues should prioritize verification; they are not a stand-alone verdict. The same announcement warns that AI content can be difficult to identify. The FBI advises verifying surprising videos or images through reputable news sources or known official channels.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Why one detector is not enough
NIST SP 800-63A-4 requires identity-proofing providers to analyze submitted media for manipulation, use authenticated protected channels, document tests against forged and genuine media and add manual review to automated analysis. Those requirements apply to identity-proofing providers, not ordinary consumers, but they illustrate why the original file and its surrounding context matter more than a single detector score. A detector result can be saved as a lead; it should not replace the file, the URL, the account record or independent confirmation.
8. Report quickly and request preservation
Platform report
Use the platform’s safety, impersonation or fraud channel. Attach the profile URL, post or message URL, account identifiers, timestamps and a concise description of the false identity or request. Ask whether the platform can preserve server-side records. A screenshot does not preserve those records automatically.
Write a short timeline before submitting: when you first saw the account, what it claimed, what contact or payment it requested, what you captured and when the account or post changed. Keep the confirmation number, submitted text and any follow-up email with the evidence log.
Internet-enabled fraud
File a complaint with the FBI’s Internet Crime Complaint Center at IC3.gov when the incident involves internet-enabled fraud. The July 20, 2026 IC3 guidance asks for identifying information about the person or company, communication methods, websites, fake social-profile names and telephone numbers. Include transaction records and wallet or payment addresses when money was requested or sent.
Immediate danger or loss
Contact local law enforcement for an immediate threat, extortion, stalking or financial loss. Bring the master media, custody log, screenshots, URLs, account identifiers, transaction records and a short timeline. Do not delay an emergency report while trying to prove whether the media is synthetic.
Intimate synthetic images
For intimate or sexually explicit synthetic images, FTC Take It Down Act guidance covers social, messaging, image/video-sharing and gaming platforms. It describes civil penalties of $53,088 per violation for noncompliant platforms; eligibility and deadlines depend on the facts and the platform. Report the content through the relevant platform process and retain the URLs and notices.
Choosing a preservation method
| Method | Fidelity | Context | Integrity work | Best use |
|---|---|---|---|---|
| Platform download or export | Highest available for the original object | Usually limited unless paired with page captures | Hash the file and log acquisition | Master image, audio, video or chat export |
| Sequential screenshots | Preserves visible rendering, not hidden metadata | Strong when URL, account, times and replies are visible | Keep original files and hash them | Posts, profiles, warnings and surrounding thread |
| Screen recording | Preserves a visual sequence | Useful for disappearing content and call details | Hash the recording; document device and method | Menus, stories, navigation and interactions |
| Detector result | Not an original or preservation method | Little context by itself | Save the report as a derivative and record the tool | Lead for further corroboration only |
Use more than one method when the material is important: an original download for fidelity, a contextual capture for provenance and independent corroboration for identity. The best choice depends on fidelity, context, integrity, independence and urgency. When a post is disappearing, a fast screen recording may be more valuable initially than waiting for a perfect export; add the original download if it becomes available later.
Common failures and fixes
The post vanished before you downloaded it
Preserve the screenshots, screen recording, copied URL, account identifiers and messages you already have. Tell the platform and investigators the exact capture time and ask the platform to preserve server-side records. Do not claim that a missing original still exists.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
The platform download is a re-encoded file
Keep it as the platform-provided file, record the download method and retain the contextual capture. Note that a downloaded derivative may not contain the bytes originally uploaded.
Someone edited or renamed the file
Do not overwrite the master. Label the edited item as a derivative, hash it separately and document who changed it, when and why.
The hash values do not match after copying
Stop using the destination as evidence of an exact copy. Re-copy from the untouched master, check the filename and storage process, and record both hash values and the failed transfer.
The account demands money or sends a link
Stop interacting, do not pay and do not open the link. Save the request, payment address and message headers from a clean device, then report the incident.
A detector says “real” or “fake” with high confidence
Save the detector output as a derivative, not as the verdict. Seek independent confirmation through a known channel and provide the original media and context to the platform or investigators.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Or skip the browser setup
For a public page that must be captured consistently, ScreenshotNeo can return a screenshot from one request. It accepts cookie or consent banners before capture and removes more than 60 known consent platforms, newsletter popups and chat widgets; each step can be disabled. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads and cache hits are not billed, and the response identifies the result with X-Page-Verdict and X-Billed headers. Treat the returned image as contextual evidence: download it, hash it and keep the URL and capture time in your log.
See the ScreenshotNeo documentation for request options and authentication. The endpoint can capture PNG, JPEG or WebP.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11cURL
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' }); const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo also provides an MCP server with take_screenshot, get_page_info and capture_pdf tools for Claude, Cursor and other MCP clients. One thousand screenshots per month are free with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
FAQ
Frequently Asked Questions
Are screenshots enough to prove an AI impersonation?
Usually not by themselves. Screenshots preserve visible context such as the URL, account label, wording and timestamp, but may omit the original file, metadata and platform records. Pair them with an original download or export, a hash and independent corroboration.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
How do I save a deepfake before it is deleted?
Capture the profile and surrounding thread immediately, save the full URL and identifiers, make a screen recording if the content is moving or disappearing, and download the platform-provided file or export. Keep an untouched master and a separate working copy.
How can I preserve a cloned-voice call for police?
Save the voicemail or audio file, call log, displayed number, date, time, duration, transcript, related messages and payment request. Do not rely on the suspicious caller for confirmation; verify through a known channel and provide the untouched audio plus clearly labeled derivatives.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Does a SHA-256 hash prove that the media is fake or genuine?
No. It proves that a later copy has the same bytes as the file that was hashed. It does not prove authorship, truth, prior editing or whether AI created the media.
Should I use an AI detector before reporting?
You may save a detector result as a lead, but do not wait for it or treat it as a verdict. AI content can be difficult to identify, so preserve the original and context and seek confirmation through a known official channel.
Should I tell the person being impersonated before reporting?
Use a contact method you already know to be genuine, such as a verified phone number or established organizational address. Do not use the suspect account to ask for confirmation.
Can I publish the captured material to warn others?
Share the minimum necessary with the platform, investigators and affected people. Public reposting can expose private information, amplify harassment or violate laws even when your original capture is legitimate.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What should I bring if an investigator asks for the evidence?
Provide the untouched master, a separate working copy, the hash log, custody entries, contextual captures, URLs, account identifiers and a concise timeline. Explain which files are derivatives.
The Bottom Line
Bottom line: Preserve before you debate authenticity. Capture the complete page and conversation, obtain the original file, protect an untouched master, hash it, log every handoff, corroborate through a trusted channel and report promptly. Screenshots, storage devices and detector scores can support the record, but none independently proves who created the media or what the platform retains.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
