Part III · Chapter 5 · Evidence · lesson 3

A screenshot is a claim about one moment, taken by an interested party

11 min

Builds on What would you hand them, right now, for this one?

A screenshot of an admin console. Twelve rows, a column of green ticks, and a heading saying that every account requires a second factor. Somebody on your team took it on a Tuesday and dropped it into a folder called evidence.

Before deciding what it is worth, decide what it is. It is a photograph of a screen, taken by a person with an interest in what the screen said, at a moment they chose, showing the part of the screen they chose to include.

That is not a dismissal. For some controls a screenshot is all that exists, and a lesson that sneers at it is no use to the person holding one. The useful move is to know precisely what it supports and what it leaves open.

Predict

What is the weakest thing about the screenshot above?

The date on it, which the person taking it controlledTwelve rows, when nobody said how many accounts existThat it is an image, so nobody can search or verify itThat a setting could have been changed back an hour later

A screenshot asserts: at some moment, this part of this screen looked like this, according to the person who framed it.

Three things it does not carry.

A date you did not set. Unless the console itself renders one, the only date is the file metadata, which is editable by whoever holds the file.

A scope you did not choose. The frame is a selection. What sits above the fold, on the next page, or under a filter nobody mentioned is not visible as missing.

Duration. It is an instant. Nothing in it distinguishes a setting that held all year from one that held for the minute before the keyboard shortcut.

It is still real evidence of design, at an instant, as framed. That is a narrower claim than most folders of screenshots are assumed to be making.

When it is the best thing available

Some controls genuinely leave no trace you can export.

A physical arrangement in an office. A setting in a supplier's console you have read access to and no API for. A one-off configuration decided three years ago in a product whose audit log has since been retired. In those cases the choice is a screenshot or a sentence, and a screenshot is better than a sentence.

What changes the value of the artefact is what sits around it, and all of it is cheap.

The console showing its own date, inside the frame, rather than a file timestamp beside it.
The whole list, or the filter and the row count visible, so the scope is part of the image rather than part of the explanation.
A series rather than a single image: the same view, the same framing, once a quarter through the period. A sequence says something about duration that no single frame can.
The name of who took it and under what instruction, which converts it from an anonymous file into an assertion somebody made.

None of that makes a screenshot into a record the control produced. It does turn a claim about an unspecified moment into a claim about a stated moment, with a stated scope, made by a named person — and the difference between those two is most of the distance a screenshot can travel.

Why the cropped screenshot is usually honestOptional

The uncomfortable version of this is that the misleading screenshot is almost never a deception. It is a person under time pressure answering a request quickly.

They open the console, they see the thing they know to be true, they capture the part that shows it, and they move on. The twelve rows are twelve rows because the window was that size. The filter was already applied because it was applied last week for an unrelated reason. Nobody made a decision to narrow anything.

Which is why the fix is structural rather than moral. A request that says to include the row count and the filter state produces better artefacts from the same people in the same hurry. A request that says to prove the control works produces exactly what was produced above, and then the conversation about it sounds like an accusation, which makes everybody worse at it.

Check

A screenshot is all you have for one control. What now?

Leave it out, since it is weaker than other evidenceKeep it, say what it shows, and name the two open questionsTake it every week from now on and file the whole setPair it with a note from the person who took it

Worth remembering

A screenshot asserts that at some moment, a chosen part of a screen looked a certain way, as framed by an interested party.
The three absences are a date you did not set, a scope you did not choose, and any claim about duration.
Scope is the absence that goes wrong most often, because cropping happens by accident rather than by intent.
Sometimes a screenshot is the strongest artefact available, and then the job is to state what it shows rather than to avoid it.
Putting the console date, the filter state and the row count inside the frame costs nothing and narrows the open questions.
A series of identical captures through a period says something about duration that no single capture can.