157

I have take some screenshots of chat from Whatsapp web using Windows 8 Snipping Tool. I saved those images in PNG format.

Now I want to prove that those images are the original, not tampered or edited.

Can you please let me know how can I prove that?

Improve this question
6
  • 11
    Despite this old post had asked on "How to ensure the authenticity of a picture?", the answers suggested to check the metadata. But metadata is useless for screenshot images. While this question has been underestimated, I wish to read good answers for this matter. Hence, +1.
    – user109256
    Dec 7, 2015 at 18:31
  • 8
    Your best bet is probably to ask whatsapp if they can provide who ever need the proof directly from their server...
    – DrakaSAN
    Dec 7, 2015 at 20:07
  • 31
    Even if you can prove that the screenshot accurately shows what was on the screen at the time, what's to say that the application displaying what you took a screenshot of is legitimate? I could easily make an application that displays an image, and take a screenshot of that.
    – user
    Dec 8, 2015 at 8:31
  • 10
    Maybe I've missed it, but I'm surprised that metadata has been mentioned a couple times as being missing from a screenshot image, and therefore the metadata cannot be used to verify the image. Metadata in any image can't be used to verify an image - it's possible to modify the metadata too.
    – Steve
    Dec 8, 2015 at 21:35
  • 4
    Posting this as an answer isn't appropriate because it doesn't actually answer the question. But, I wanted to point out that the premise is false anyway. Even if there was a way to prove that the screenshots were legitimate, there is no way to prove that the application and its contents are legitimate. Further, there is no way to prove, solid screenshot or not, that the messages truly originated from the source that the screenshot claims. There's no proof that you didn't intercept the packets and modify the contents to say what you want, etc etc. The whole thing cannot be proven.
    – user72945
    Dec 13, 2015 at 20:43

14 Answers 14

Reset to default
143

You cannot prove that. They were on your PC, fully under your control for some time. You could have tampered with them. Therefore you cannot prove that you did not tamper with them.

If you need to set up a legally safe solution then look for an independent third party and a way to have them store information in such a way that you can only trigger a store or read (e.g., a screenshot on a Citrix server to a write-once location).

Improve this answer
8
  • 16
    Chain of custody
    – Ƭᴇcʜιᴇ007
    Dec 7, 2015 at 14:44
  • 5
    Take the picture with an digital camera ?
    – Freedo
    Dec 8, 2015 at 1:07
  • 119
    @Freedo What stops you from making a fake screenshot, then displaying it on the screen, then taking a picture of your fake screenshot with a digital camera?
    – user253751
    Dec 8, 2015 at 1:25
  • 4
    Precisly. The onluy way to have proof is to have it under the control of a trusted, independant party. See Techie007's chain of command. E.g. I could call some lawyer firm and ask them to take a screenshot. Or to weekly download a webshops terms and conditions. But they should never be under the control of the party who wishes to prove things.
    – Hennes
    Dec 8, 2015 at 7:51
  • 3
    If the manipulation happened after somebody took the screenshot than it can be identified (see mixdev's answer), but if you manipulated the content itself (like using Dev Tools in a browser), there is probably no way to check unless the manipulator made a mistake that can be proved by logic. Taking a photo of the screen makes it even harder to prove original because image analysis tools will have a harder time to analyse it because of the extra noise from the real world.
    – totymedli
    Dec 8, 2015 at 11:16
110

You can never prove authenticity in a screenshot.

It is incredibly simple to change the apparent content of anything posted in a public place & needs no great skill to totally change the meaning into anything you like…

enter image description here

This fake screenshot took about 30 seconds in photoshop.

For those who didn't like my quick mockup the first time, here's another, lined up correctly… I chose to use the current version of the question rather then re-mock the original - the result would be the same either way.

enter image description here

Improve this answer
17
  • 13
    Hey, you could have changed the -2 to +97856...
    – glglgl
    Dec 7, 2015 at 19:36
  • 183
    And you don't even need photoshop... Opening "Developer Tools" in any modern browser allows you to tamper with any of the content.
    – hytromo
    Dec 7, 2015 at 19:38
  • 53
    @hakermania ... proving that even if you could prove the screenshot to be genuine, such information is not useful when you can display anything you want on the screen.
    – 2012rcampion
    Dec 7, 2015 at 20:27
  • 29
    @CharlieRB That's because you can't prove the image is the original. If someone asked how to prove that they copy-pasted a paragraph of unformatted text from another site instead of manually retyping it word-for-word, the only correct answer would be "you can't".
    – Milo P
    Dec 7, 2015 at 22:31
  • 10
    @MiloPrice but this answer doesn't say "you can't" (directly, at least).
    – ping
    Dec 8, 2015 at 0:07
35

Of course there is no sure shot way to find image manipulation attempts. But there are some basic techniques people use to manipulate images.

For example, people use photoshop clone tool to duplicate patterns/colors. It may be difficult to detect by manual observation but there are some tools to do that.

Clone tool detection

Have a look. The tool has a number of features to detect image manipulation. http://29a.ch/photo-forensics/#thumbnail-analysis

Improve this answer
6
  • 19
    This does not apply, however, to some types of images and many types of manipulations. Altering the content of an uncompressed or lossless image with clean lines, UI elements, or text simply cannot be detected.
    – J...
    Dec 8, 2015 at 13:13
  • 1
    @J...: Unless you use a program that advertises in the file metadata. I've caught a lot of "screenshots" that were saved with Photoshop. Of course it's not foolproof as it's super easy to strip it.
    – apscience
    Dec 9, 2015 at 2:59
  • 10
    @gladoscc you have to save your screenshot with something. I normally paste into the GIMP so I can crop, but that's also what I'd use to fake it. If I wanted a fake to look less fake in the metadata I'd open it in MSpaint and do a "save as".
    – Chris H
    Dec 9, 2015 at 10:49
  • 1
    @mixdev, yeah ELA is also something I've found out, I posted some comments here on the subject: photo.stackexchange.com/questions/26170/…
    – fduff
    Dec 9, 2015 at 12:06
  • 2
    Or screenshot the photoshop :)
    – Tim B
    Dec 10, 2015 at 12:10
31

Proving that using technical measures is hard. What you can do is document the way you took the screenshots.

One possibility is having a witness present while taking the screen shots. After taking the screenshots, you could print them out with the filenames, date, and time they were taken. Then the witness and you sign those prints.

A digital version of that is screen recording while taking the screenshots. Ideally with audio commentary. At the end you can timestamp and digitally sign all the resulting screenshots and the screen recording.

Improve this answer
8
  • 12
    Sometimes the best solution is not a technical solution. This is one of those cases. Have a lawyer or a police officer present when you take the screenshot.
    – Amedee Van Gasse
    Dec 10, 2015 at 8:30
  • 4
    +1 For having a witness, but it's not enough. You should use their (or a 3rd party) computer/phone and network connection (or VPN) to get the thing you're taking a screenshot of. This avoids tampering with the network, hardware, or application. For example, I could install GreaseMonkey on my browser, use it to alter a web page, bring a witness over, and take a screenshot. If they're using their own computer I could have them do it on my network and modify the content at my network router. Then take a checksum of the resulting image and sign off on that.
    – Schwern
    Dec 10, 2015 at 10:01
  • 1
    @Schwern Of course sometimes we want to use the screenshot to demonstrate something directly concerned with the own computer, e.g., "Look, after I left my laptop alone in the hotel for an hour, the foobar.dll has an unusual file size and everytime I open a browser funny kittens appear"
    – Hagen von Eitzen
    Dec 10, 2015 at 21:47
  • 1
    @HagenvonEitzen In that case, all the witness can do is verify the screenshot has not been altered. They can say nothing about the validity of the content.
    – Schwern
    Dec 10, 2015 at 22:15
  • 3
    @HagenvonEitzen something like that would be reproducible and thus wouldn't need proof of a valid screenshot, you could always show it again on your machine. The real concern I should think for this is content that may be removed in response to raising concerns about it. For example illegal content on a webpage, that, once reported might be removed before proceedings
    – Centimane
    Dec 11, 2015 at 12:51
13

Remote browser with public key signed inputs / outputs

http://www.icanprove.de is most general method I've seen so far.

It provides a remote browser (Firefox based) that records your input, and produces public key signed PDFs that contain the inputs you've made and the screenshot. So you can even login into pages and prove things afterwards.

The remote browser is slow, so if the information is removed quickly after you see it, you won't be able to prove anything.

For this to work perfectly the output has to contain one screenshot for every single pixel that changes on the screen, e.g. during scrolling or JavaScript animations. Maybe a video format would be more suitable in those cases than PDF as it encodes frames differentially.

And of course, you give your plaintext passwords to that service and to the evidence verifiers. A possibility is to change your password for a dummy one temporarily, but that means yet more overhead.

Wayback machine services

See also

I had asked a similar question for browsers at: https://softwarerecs.stackexchange.com/q/18651/3474

Improve this answer
12

There are two issues, prove that you took the picture (not fake), and prove that the picture you took is the picture I received. The first is as noted by others of course impossible as screenshots are trivial to fake as the content is computer generated anyway. The second is much easier with solutions from comprehensive signature solutions (pgp detached signatures have been around for around twenty years), to basic fingerprint (sha is a good choice). Also worth considering are trusted copies (think archive.org or something similar).

Improve this answer
3
  • 1
    +1 for 'trusted copies' (and all that that implies)
    – Hennes
    Dec 8, 2015 at 7:52
  • 1
    And 3) that you took the picture from the source you claim it to be (and not some mockup)
    – Hans Kesting
    Dec 9, 2015 at 10:55
  • prove that the picture you took is the picture I received - it won't prove that. It will prove the picture you received was not changed during transport from them to you, and can prove that nobody else sent it as a forged-sender, but it can never prove the picture they sent you is the picture they took - separately from the truth/fake status of the picture they took.
    – TessellatingHeckler
    Dec 11, 2015 at 19:56
9

First of all, you can't.

If you want to prove that you received message X from Y, ideally you would receive it in front of a notary, on their computer. Lacking a notary, an independent witness may help.

This doesn't preclude that the person at the other side, that you believe to be Y, in fact isn't. So you better have them in front of you and the notary, too.

You can prove that the image existed before a given date (send a hash of the image to a CA signing service, or otherwise publish it in a way that preserves timestamp and you can't later tamper), and that it existed after a given date (like including the headline of today's newspaper).

You cannot trust that what the computer showed was what was sent through the Whatsapp service, not even the logs stored in the suspect's phone. They could all be tampered by the suspect.

Maybe even what you thought to have received is not what the guy at the other side sent. Perhaps it was modified by a trojan in your computer (or WhatsApp servers). Even the telco could theoretically hijack a whatsapp account. It would be a bad idea for a hired killer to accept works by whatsapp. He could believe to be instructed to kill lord Capulet, while the hirer wanted to kill the Montague!

Improve this answer
2
  • 6
    If you want to prove that you received message X from Y, ideally you would receive it in front of a notary, on their computer. This might prove you received message X. It doesn't prove it came from Y (man-in-the-middle is an example of why not).
    – Steve
    Dec 8, 2015 at 21:36
  • @Steve It could be deducted from the more detailed explanation on tampering below, but you are right. I have now edited it to make it clearer.
    – Ángel
    Dec 8, 2015 at 21:41
7

There's no way to verify the authenticity of a screenshot.

Unlike real photographs, screenshots do not have any metadata such as EXIF, nor can they be fingerprinted by the noise in the photo. Screenshots are just a handful of pixels grabbed from the screen at a specific point in time plus a timestamp, and as such can be edited at will.

If the screenshot just so happens to be in JPEG format and you believe something was added or modified in a part of the image, you could (slowly and patiently) discern the features of the image that have less artifacts from the rest of the image due to the lossy effects of doubly compressing the image.

If you have reason to doubt the authenticity of a screenshot, assume that it has been altered unless there is additional evidence to support the screenshot. Do not use screenshots as legal evidence that something occurred in a person's computer.

Improve this answer
5

Maybe not a screenshot, but maybe a video would be more difficult to fake. The exact steps could be different but you could record a video on the following lines:

  1. start with all windows closed
  2. show the network config to show what proxies you are using
  3. open the command prompt and type the hosts file to show that you are not tampering

  4. in the command prompt ping the hostname that you are going to open so we can see the resolved ip.

  5. open the browser

  6. open the browser network settings so we can see the proxy settings
  7. open a reference site
  8. open the site which you want to actually record
  9. navigate till all the contents you want record are done
  10. end the video.

What things people may think of faking you can add some controls for it. Maybe a remote recording system, possibly operated by a third party, possibly a law enforcement agency or a law firm, can work here. Maybe you can open a skype session with them, share your screen and do all these things, and use the video that is recorded by them.

Maybe someone can come up with a 'secure' screen recording system. A screen recording system that 'shakes' the screen in every frame to make linear editing cumbersome and error prone, and stores metadata about the the video to make some level of verification possible.

Improve this answer
4

You can't prove that.

If you did tamper with the image, there are mistakes you could make that might make the tampering obvious. For example (at least on Windows 7), Snipping Tool doesn't write any extra metadata to the image file, and always saves as 32-bit RGBA image data (but maybe that's based on screen image depth). If your purported screenshot has a "Software" tag of "Paint.NET v3.36", then you've definitely tampered with it.

Likewise, tampering could introduce artefacts or inconsistencies in the image itself. For example, if WhatsApp uses a certain font in their user interface and you use a different font; or if you use a slightly different color than what they would actually use; or if they watermark the screen with a QR code of a digitally-signed tag encoding the current date and time, and you destroy or corrupt that watermark. However, a lot of that depends on knowing the details of the WhatsApp application... and once you know the details (so that you can reference them in a "proof"), you can generally in principle make sure that a tampered image conforms to them as well.

WhatsApp might provide a QR code or other barcode of a digital signature over the data you actually want to prove, either easily visible or as a hidden watermark somewhere (in which latter case it might be corrupted by a JPEG screenshot, but should be preserved in PNG). That data might be a recognizable thumbnail of an image, or the text of an associated chat session, or the identity of the person who sent the message. However, I doubt that WhatsApp actually does such a thing.

Improve this answer
2
  • "If your purported screenshot has a 'Software' tag of 'Paint.NET v3.36', then you've definitely tampered with it." That's not true either.
    – Lightness Races in Orbit
    Dec 10, 2015 at 14:49
  • I meant "tampered" in the sense "you didn't take it with Snipping Tool, and immediately save it". Of course it's possible to take a screenshot by some other method, paste it into Paint.NET, and save it without actually making any deliberate changes.
    – david
    Dec 10, 2015 at 15:13
3

There is no fully secure way to authenticate your screenshot. However you can use a third-party application that sends instantly the read-write date and time of files in the screenshot folder (if it is saved locally) and send them as fast as possible to your authenticator (maybe a friend, your superior or someone that wants to verify its authenticity). This way, the authenticator can see the time that took from the time to create the screenshot file to the time that he received the file information. If it's small, it's authentic.

If you choose to use other methods to authenticate and it involves sending the file, you might want to use stegonography. It's a technique to hide information inside an image. If the image gets altered in the process of sending to someone that might not be fully trusted, the message will be corrupted and, therefore, not authentic.

Improve this answer
2
  • 1
    Nothing stops you from preparing script in advance that would replace part of screenshot with whatever content you want in less than a second, so "time before arrival" is absolutely useless metric for checking if screenshot was tampered with or not.
    – Oleg V. Volkov
    Dec 10, 2015 at 8:14
  • You don't even need a fast script. The script itself can modify the timestamp of the files.
    – orkoden
    Dec 10, 2015 at 13:04
2

Your question is not really about how to ensure the authenticity of the screenshots you took - it is about how you can prove that your Whatsapp conversation was real and happened as you said. The other answers already made the point (and quite good, I must say) that you cannot really ensure a screenshot was not modified before it was saved.

Whatsapp Web is just a web app that let you use your browser instead of your phone - however, everything is passing through your phone as you type and send/receive stuff in your browser. Therefore, you can access the original logs for all your conversations in the actual app within your phone.

  • If you need those screenshots because they show a conversation that, for whatever reason, is not stored in your phone anymore, then you might find a solution here.
  • If the conversation you are looking for is in your phone, you can export it into a .txt file using the instructions here.
Improve this answer
1

You cannot as it could have been edited at anytime and resaved. What you could do, is have an imaging particle analysis done to verify if it was tampered. You would have to use a company that is known for doing this for evidence. Best bet, besides have it analyzed, it to get a court to subpoena the records of your whatsapp conversation.

Improve this answer
0

The only way to do this, theoretically, is to take the screenshot in the presence of a notary, then save it as an image file and calculate a hash value of that file. After that – make the notary document that this hash value corresponds to the original screenshot.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .