A leaked screenshot creates immediate pressure. Someone wants the post removed. Someone else wants to know who had access. A third person may already be naming a suspected source.
The first thirty minutes should protect the evidence and reduce harm—not turn a partial clue into a conclusion.
Minutes 0–5: preserve what you found
Save the highest-quality version of the screenshot available. Record the URL, account, message, channel and time where it appeared. Capture surrounding context, but avoid editing the original artifact.
If the image arrived by email or messaging, retain the original attachment rather than only taking another screenshot. Repeated saving and recompression can weaken recoverable signal and remove useful metadata.
Write down who obtained the evidence and how. A clear internal record is valuable even when the matter never becomes formal.
Minutes 5–10: contain without erasing
Limit further exposure where you can do so safely. Ask the platform owner to restrict or remove public access, suspend an exposed link or close an unintended share.
Preserve the location and context before removal. Deleting everything immediately may destroy information needed to understand reach, timing or source.
Do not disable every possible user account unless there is a clear containment reason. Broad action can disrupt the service and alert a malicious actor before evidence is secured.
Minutes 10–15: identify the likely source system
Determine which private page the screenshot appears to show. Confirm the Web App, approximate route, content version and period when that view existed.
In ExactMark Evidence Lab, begin with the Web Apps search scope. If several apps contain similar content, search the relevant app first when known. Use the best-quality image and keep a note of any crop, annotation or recompression already applied.
Minutes 15–20: read the complete finding
Do not stop at the first displayed name. Review:
- Confidence score.
- Separation between the leading and alternative candidates.
- Session timing and last-seen information.
- The page recorded for the candidate session.
- Evidence quality and detector notes.
- Whether the screenshot could combine several sources.
An inconclusive result is a valid outcome. It means the submitted evidence does not support a reliable automated attribution.
Minutes 20–25: corroborate
Compare the candidate with application logs, authentication events, role assignments and content availability. Was that viewer able to see the exact version shown? Was their account active at the relevant time? Could a shared device or delegated account explain the session?
A protected Web Session links the screenshot signal to a viewing identity. It does not prove who physically operated the device or establish motive.
Minutes 25–30: choose the response team
Bring in the people appropriate to the information: security, privacy, legal, communications, management or the affected customer. Regulated or personal data may require prompt specialist assessment.
Agree one incident owner, preserve a timeline and limit speculative internal messages. Do not contact the likely source until the evidence and process have been reviewed.
After the first half hour
Continue containment, determine reach, preserve logs and document decisions. If automated attribution is difficult, a specialist review may examine the artifact and surrounding security weaknesses, but no process can create signal that was never present.
The strongest response begins before the leak. Protect the authenticated surface, verify viewer identity, test representative screenshots and decide who will interpret results. In an incident, preparation turns thirty frantic minutes into thirty useful ones.