Capture first, preserve the original files, and make every later copy checkable. Save the complete URL and account details, record the surrounding page or conversation, download the original image, audio, video, or export when possible, calculate a SHA-256 hash, and keep a dated custody log. Then corroborate the identity through a known independent channel and report promptly. A screenshot alone preserves what you could see; it does not preserve platform records or prove that the media is genuine.
If there is an immediate threat, extortion, stalking, or financial loss, stop engaging with the impersonator and contact local law enforcement while you preserve the material. For internet-enabled fraud, submit a complaint to IC3.gov as well as the platform.
As an Amazon Associate I earn from qualifying purchases.
What makes evidence verifiable
Digital evidence has different preservation problems from physical evidence. NIST’s Digital Evidence Preservation: Considerations for Evidence Handlers (NISTIR 8387, 2022) describes those problems for both digital objects and the storage media that contain them. Your goal is not to prove everything with one screenshot or one detector. Build a record that lets another person see what you saw, inspect the unaltered file, check that copies did not change, and compare the claim with independent facts.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Evidence layer | What to save | What it establishes | What it does not establish |
|---|---|---|---|
| Visible context | Sequential screenshots or a screen recording showing the profile, address bar, post or message, timestamps, replies, and warnings | What was displayed to you, and where | The platform’s hidden records, authorship, or media authenticity |
| Original object | Platform download or export of the image, audio, video, document, or call recording | The exact bytes you obtained and any metadata retained by the platform | That the bytes were created by the claimed person |
| Integrity record | SHA-256 hash, capture time, filename, source URL, device, and custody entries | Whether a later copy has the same bytes as the logged file | Who authored the file or whether its content is truthful |
| Independent corroboration | Confirmation through a known phone number, official account, witness, payment record, or platform response | Whether the identity or event is consistent with information outside the suspect account | A guaranteed conclusion when independent channels are compromised too |
There is no published general consumer success rate for screenshots, hashes, provenance credentials, or AI detectors proving impersonation. Evidence strength is specific to the incident and the records available.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
1. Freeze the scene without increasing your risk
- Stop interacting. Do not argue with the account, click links it sends, send money, upload identification, or keep replying merely to obtain more material. Continued interaction can alter a thread and can expose you to malware or manipulation.
- Use a clean device. If possible, capture from a device that is updated and not already controlled by the suspected attacker. Do not install an untrusted recording or “verification” app offered by the account.
- Write down time information. Record the current UTC time, your local time zone, and the time shown by the platform. Note whether a timestamp is the post time, edit time, call time, or the time you viewed it.
- Preserve the starting identifiers. Copy the displayed username, profile URL, account or profile ID, phone number, email address, domain, payment address, and any linked file URL into a plain-text incident log. Save the URL exactly as displayed before the page changes.
For a cloned-voice call, retain the call-log entry, caller ID, voicemail, recording if one already exists, and your contemporaneous notes. Recording a new call may be restricted by consent laws where you live; ask local authorities or a lawyer about the rule before deliberately recording another person.
2. Capture the whole context, not a convenient crop
A cropped image can hide the account that posted it, a warning label, a reply correcting it, or the address bar that identifies a look-alike domain. Make a sequential capture that another person can follow.
- Start on the profile page or message list. Include the browser address bar, the full profile URL, display name, handle, profile image, account ID if visible, and any verification or warning label.
- Move to the suspect post, direct message, listing, or call-details screen without jumping over the surrounding entries. Capture the complete text, attachments, visible date and time, edit indicator, reply chain, view or share counts, and linked files.
- Scroll slowly and record the transition in one screen recording, or take numbered screenshots with overlapping content. Keep the original recording and the individual still images.
- For a web page, save the URL as text as well as in the screenshot. If the platform provides an export, download it after the visual capture so the export and the visible page can be compared.
- Record what you did: browser and version, operating system, device clock, network used, and whether you were logged in. These details help explain why a later viewer might see a different page.
Screen captures are context evidence. They can omit EXIF data, server-side timestamps, moderation logs, IP records, and deleted replies. Do not present a screenshot as a complete copy of the platform’s database.
3. Obtain and protect the original digital object
Download or export before editing
Use the platform’s own download, export, voicemail-save, or data-request function when available. Save the result without opening it in an editor or transcoding it. Keep the original filename and the file-system timestamps. If the platform offers several quality settings, save the highest available version and note the setting.
For a voice message or call recording, preserve the original audio container. For video, keep the downloaded file rather than relying only on a screen recording. For images, retain the original file even if the visible post is a recompressed copy. If a link points to a document or archive, download it as a separate file and record the link that produced it.
Make a working copy
Never annotate, crop, transcode, extract frames, run speech-to-text, or remove metadata from the master. Copy it to a separate working directory for analysis and label that copy clearly. Store the untouched master on write-protected media or on storage with access controls that prevent accidental modification. Keep a second copy in a separate physical or cloud location, protected by a strong account password and multifactor authentication.
A write-protected USB flash drive or external SSD can hold the master and a separate working copy. Storage hardware protects against accidental changes; it does not authenticate who created the content or prove that an impersonator’s claim is true.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
4. Hash every file and keep a custody log
A cryptographic hash is a compact fingerprint of a file’s bytes. If a later copy produces the same SHA-256 value, the bytes match the logged file. A matching hash is an integrity check, not proof of authorship, provenance, or truth.
Calculate the hash
| System | Command | Result to record |
|---|---|---|
| macOS or Linux | shasum -a 256 suspect-video.mp4 |
The 64-character SHA-256 value printed beside the filename |
| Linux with coreutils | sha256sum suspect-video.mp4 |
The SHA-256 value and filename |
| Windows PowerShell | Get-FileHash .suspect-video.mp4 -Algorithm SHA256 |
The Hash value and path |
Run the command on the untouched master. After copying the file to another location, hash the copy and record whether it matches. Hash again after any transfer that matters to the case. Do not overwrite the master when a tool asks to save an edited version.
Fields for a custody record
- Incident number you assign, filename, extension, size, and file-system timestamps.
- SHA-256 hash and the exact command or tool used.
- Capture or download time in UTC and your local time zone.
- Source URL, platform, account handle, profile ID, and the method of acquisition.
- Device model, operating system, browser or application, and whether you were logged in.
- Every transfer, copy, conversion, or analysis: date, person or system, purpose, destination, and resulting hash.
- Where the master and working copy are stored and who can access them.
Use an append-only text file or a printed log that you sign and date. If another person receives a copy, give them the hash and ask them to return the hash they calculate, rather than sending an untracked replacement.
5. Preserve communications and identifying details
Keep the exact wording of requests and threats, not just a summary. Save message headers or export files when the service supplies them. Retain:
- Usernames, display names, profile IDs, profile links, email addresses, telephone numbers, and domains.
- Payment instructions, bank details, cryptocurrency wallet addresses, gift-card codes, and transaction IDs.
- Dates, times, time zones, call duration, caller ID, voicemail metadata, and the sequence of messages.
- Photos, videos, audio, documents, shortened links, QR codes, and any files the account sent.
- Names of people who saw the material and the independent contact method used to confirm or reject the impersonation.
The FBI’s June 5, 2023 public service announcement advises victims to retain all information about the incident, including usernames, email addresses, websites or platform names, photos, and videos. Preserve that information even if you expect the account to be deleted.
6. Check authenticity without overclaiming
Use an independent channel
Contact the supposed person through a phone number, email address, or account you already trusted before the incident. Do not use contact details supplied by the suspect account. Ask a narrow question that does not disclose sensitive information, and preserve the response. If the person is a colleague or public official, confirm through the organization’s established directory or another known colleague.
Compare the suspect account’s handle, domain spelling, phone number, payment destination, and profile history with the known official channel. A one-character change in a URL or an unfamiliar payment address is significant, but a matching name is not proof of identity.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Treat visual and audio clues as leads
The FBI IC3 public service announcement dated July 20, 2026 lists possible warning signs: slight differences in URLs or spelling, distorted hands or facial features, irregular shadows, unrealistic accessories, call lag, lip-sync or synchronization problems, and unnatural movements. The same notice says AI-generated content has advanced to the point that it is often difficult to identify. Use these clues to decide what to corroborate; do not use one clue or one detector result as a verdict.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
NIST SP 800-63A-4 requires identity-proofing providers to analyze submitted media for manipulation, use authenticated protected channels, document tests against forged and genuine media, and supplement automated analysis with manual review. Those requirements apply to identity-proofing providers, not ordinary consumers, but they explain why the original file and surrounding context matter more than a single automated score.
“If you see a surprising video or image online, verify its authenticity through reputable news sources or known official channels.” — FBI IC3, July 20, 2026
7. Report quickly and request preservation
Platform report
Use the platform’s impersonation or safety channel. Attach the suspect URL, account identifiers, timestamps, and a concise description of what is false and what harm is occurring. Keep the submission receipt, case number, and every reply. Ask whether the platform can preserve server-side records, including account-registration data, access logs, original uploads, and message metadata. A screenshot does not preserve those records automatically.
Internet-enabled fraud
File an IC3 complaint at IC3.gov when the incident involves online fraud, extortion, payment instructions, or a compromised account. The FBI’s July 20, 2026 guidance asks reporters to include identifying information about the person or company, communication methods, websites, fake social-profile names, and telephone numbers. Attach or describe the evidence according to the portal’s instructions, and keep the complaint number with your custody log.
Immediate danger or loss
Contact local law enforcement immediately for threats of violence, stalking, extortion, blackmail, a missing person, or financial loss. Bring the untouched master, a working copy, your timeline, hash list, URLs, account identifiers, payment records, and platform case numbers. Do not hand over your only copy; ask how the agency wants digital files transferred and record the transfer.
Intimate or sexually explicit synthetic images
FTC guidance about the Take It Down Act covers social, messaging, image- and video-sharing, and gaming platforms. It describes civil penalties of $53,088 per violation for noncompliant platforms. Eligibility and deadlines depend on the facts and the platform, so preserve the material, use the platform’s designated process, and obtain legal or victim-support advice about the correct filing route.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
The FTC warned on February 15, 2024 that fraudsters are using AI tools to impersonate individuals with eerie precision and at a much wider scale. Do not wait for a detector to reach certainty before reporting a credible threat.
Choosing a capture method
| Method | Fidelity | Context | Integrity work | Best use |
|---|---|---|---|---|
| Platform download or export | Highest available for the supplied object | Often limited; pair with a page capture | Hash the untouched file and log acquisition | Master image, audio, video, document, or message export |
| Sequential screenshots | Visible pixels only | Can include URL, profile, timestamps, replies, and warnings | Hash the image files and preserve numbering | Fast context before deletion or account lockout |
| Screen recording | Visible motion and navigation | Shows how the page and thread were reached | Keep the original recording; do not trim the master | Long threads, scrolling pages, or changing content |
| Web capture service | Depends on the service and page access | Can automate full-page context and repeated captures | Save the returned file, response details, URL, and hash | Public pages where repeatable, unattended capture is useful |
For a private message, account dashboard, or call recording, a service that cannot authenticate to the platform will not replace your own capture. Always preserve the original object and identifiers yourself.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Common failure modes and fixes
The account disappears while you are capturing
Keep the screenshots, recording, copied URL, handle, timestamps, and any downloaded files. Ask the platform and law enforcement to preserve server-side records, and include the exact time window in your report. A deleted page does not invalidate a properly logged capture, but it makes independent corroboration more important.
The download is a small preview or a transformed file
Check for a platform export, original-resolution download, attachment view, or data-access request. Save the preview as a separate file rather than replacing the first download. Record which option produced each file and hash each one.
The hash changes after copying
Compare filenames, file sizes, and transfer tools. Confirm that the destination was not transcoding, compressing, or syncing an online preview. Recopy the untouched master, hash both sides immediately, and document the failed attempt rather than deleting the discrepant copy.
A detector says real or fake
Preserve the detector name, version or date, input file, settings, and output as a separate working artifact. Do not alter the master to satisfy the detector. Seek independent confirmation through a known channel, witnesses, platform records, or payment evidence.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe browser shows a consent banner, popup, or chat widget over the evidence
First capture the page as it appears, including the obstruction, because it is part of the scene. If you control the page or are capturing a public URL for a report, you can use a screenshot API that removes common overlays before capture; save the returned file and its request details alongside your manual context capture.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
You already edited the only copy
Stop editing it further. Export the edited file as a new filename, calculate its hash, and write down the edits. Search device backups, downloads, messaging attachments, cloud version history, or the platform’s export for an earlier untouched copy. Never describe the edited file as the original.
Or skip the browser setup
ScreenshotNeo can capture a public URL with one request. It accepts consent banners before capture and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each cleanup step can be disabled. Only clean shots are billed: bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits cost nothing, and the response identifies the result with X-Page-Verdict and X-Billed headers. Use it for repeatable page context, not as a substitute for a platform export or a hash of the original media.
Documentation: ScreenshotNeo API and options.
cURL
curl -G 'https://api.screenshotneo.com/v1/shot' -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com/suspect-page -o evidence-page.webpPython
import requests
r = requests.get('https://api.screenshotneo.com/v1/shot', params={'access_key': 'YOUR_API_KEY', 'url': 'https://example.com/suspect-page'}, timeout=90)
r.raise_for_status()
open('evidence-page.webp', 'wb').write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://example.com/suspect-page' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const fs = await import('node:fs/promises');
await fs.writeFile('evidence-page.webp', Buffer.from(await res.arrayBuffer()));ScreenshotNeo also supports full-page capture with lazy images loaded, CSS-selector element capture, dark mode, device and viewport settings, retina scale, custom CSS or JavaScript, clicks, selector or network-idle waits, blocked requests and resource types, custom headers, cookies, user agents and Authorization, geolocation and timezone, transparent backgrounds, resizing, chosen cache TTLs, signed links, asynchronous jobs with signed webhooks, bulk capture of up to 100 URLs per call, a usage API, and an OpenAPI specification. Those controls can help you reproduce a public page, but log the exact options used and retain the returned file unchanged.
An MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients, so an AI agent can collect page context while you supervise the evidence log. ScreenshotNeo’s Free plan includes 1,000 shots per month with no card; paid plans start at $5 for 3,000 shots, and every feature is available on every plan. Create a free ScreenshotNeo account before you need a repeatable capture.
After you report
- Keep the master, working copy, screenshots, logs, reports, and responses together under the incident number.
- Do not publish intimate or identifying material merely to prove the case; share it through the platform, IC3, law enforcement, or legal counsel’s secure channel.
- Monitor the known official account and payment channels for further impersonation, but do not engage with the suspect account.
- Update the custody log whenever a file is opened, copied, transferred, or analyzed, and recalculate hashes after transfers.
- Ask investigators what format and delivery method they require before sending large files.
Preservation is strongest when another person can reproduce the path from your log: where the material appeared, what you captured, which untouched file you downloaded, how its hash was calculated, and who handled it afterward.
Frequently Asked Questions
Should I confront the person behind the account?
No. Preserve the account and report it instead. Direct contact can expose you to links, threats, or further manipulation and can change the conversation you are trying to document.
Can a deleted post still be investigated?
Often the platform may retain server-side records after a post is no longer visible. Give investigators the exact URL, handle, timestamps, screenshots, downloaded files, and platform case number, and ask the platform to preserve its records.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What if I only have a phone screenshot?
Keep the original screenshot file, record when and how it was made, and add a screen recording or second capture showing the profile, URL, and surrounding messages if they remain available. Treat it as context rather than a complete platform record.
Is a SHA-256 hash a digital signature?
No. It is an integrity value that can show whether bytes changed after you logged them. It does not identify the author, certify the source, or prove that the media is genuine.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
