Window Screenshots

Overview

Evidence: Window Screenshots Description: Capture Screenshot of Application Windows Category: System Platform: Windows Short Name: scr Is Parsed: No - Raw PNG images are saved Sent to Investigation Hub: Yes Collect File(s): No

Background

Screenshots capture the visual state of the desktop at the time of acquisition. This can provide valuable context about what the user was doing, what applications were running, and what content was visible on screen.

Windows maintains multiple desktop windows simultaneously, and each window can be captured individually. This collector enumerates all visible windows and captures their content as PNG images.

Data Collected

Field	Description	Example
FilePath	Path to screenshot image	Screenshots/p1234-t5678-w90.png
ProcessID	Process ID owning the window	1234
ThreadID	Thread ID that created the window	5678
Handle	Window handle	0x12345678

Collection Method

This collector:

• Opens the input desktop

• Enumerates all desktop windows

• Filters out invisible or transparent windows

• Captures each visible window as a PNG image

• Names files with pattern: p{PID}-t{TID}-w{HWND}.png

Usage

Screenshots provide immediate visual context for investigations, revealing user activity, open applications, visible documents, browser tabs, chat conversations, and potential evidence of data exfiltration or unauthorized access. This evidence is particularly valuable for insider threat investigations, data breach response, and documenting user actions at the time of acquisition.

Known Limitations

• Only captures visible windows at acquisition time

• Windows must be on-screen and not minimized

• Screenshot quality depends on window state

• May capture multiple overlapping windows

• Large numbers of windows may take time to capture

Notes

Screenshots are point-in-time evidence and may not reflect previous user activity. Combine with other artifacts like browser history and recent documents for comprehensive analysis.