A screenshot is not evidence. It is a picture of evidence.

During a workplace investigation, one screenshot showed a single message from a supervisor: “Cut her off before Monday.”

Standing alone, it sounds like retaliation, or perhaps an instruction to fire someone. But an examination of the device revealed the message right before it: “Her admin access to the old system is still active.”

A screenshot can look definitive but it is still a selected image; sometimes cropped, separated from its source and stripped of context. Was the message edited? When was it sent, in what time zone? Does the account confirm who sent it?

The underlying device holds the answers that a simple picture cannot provide:
– Surrounding conversations
– Precise metadata and timestamps
– Edit and deletion histories
– Sender and recipient identifiers
– Source databases and attachments

These are the kinds of things we get called in for, and please note: not all of that information will be available in every case. But if the dispute matters, the original device, account and application data should be preserved and examined before anyone assumes the screenshot tells the whole story.

A screenshot tells you what someone chose to show you.
A forensic examination can help determine what was actually there.