Screenshare ethics — Bergsson Forensics

Start with a question, not access to a whole computer

A screenshare is a focused examination of a live computer. Start with a question you can actually test: was this exact mod loaded in this game instance during this match? Write down the session window, the relevant account or instance, and the sources you propose to inspect. A vague instruction to “check everything” makes it difficult for either person to understand where the examination ends.

Explain who is examining the computer, which tools you want to use, what they collect, whether anything leaves the device, who sees the result and how long you intend to retain it. The participant should have time to ask questions before access starts. Explain any community participation rules separately; agreeing to a call is not a blank cheque for further searches. If a new lead requires another area, describe the reason and agree the change first.

Make stopping a real option

Agree a simple stop signal before the call: saying “pause” stops the current action, and saying “stop” ends access and collection. Stop immediately when asked. Do not finish a search, take one last screenshot or keep remote control while negotiating. Explain what has already been retained and discuss its handling after access has ended.

Refusing, withdrawing, feeling anxious or leaving a call is not technical proof of cheating. A community may have a separate participation or moderation rule, but describe a decision under that rule as such. Do not report a refusal as if it were a Prefetch record, a confirmed execution or evidence that a file modified the game.

Keep unrelated personal material out of the investigation

Use the narrowest view that answers the question: the relevant application window, selected records or a filtered export. Do not browse personal messages, photos, unrelated accounts or saved credentials simply because the screen makes them reachable. Avoid collecting passwords, access tokens, session cookies or recovery codes. A request to inspect a game does not justify opening a password manager.

Unexpected exposure is a reason to pause. Stop recording, ask the participant to hide the private area and return to the agreed view. Do not read it aloud or copy it into case notes. If it was inadvertently captured, restrict access and handle that accidental copy under the agreed incident and deletion process rather than circulating it as interesting context.

Explain tools, commands and elevation before using them

Name the tool and its official source, explain the proposed check and show understandable commands before execution. Prefer a narrow, reproducible collection over an opaque script that gathers everything. Discuss downloads, remote control, administrator rights and any extra collection separately. The participant can perform a step themselves when that answers the same question.

Administrator access changes what a tool can read and do. Explain why it is needed and what will be collected; do not request a password or direct the participant to reveal one on screen. Do not disable security software to make an unexplained utility run. If a tool cannot run in the agreed conditions, document the limitation and consider another supported method.

Account for the traces your examination creates

A live SS changes the machine. Starting a viewer can create process and Prefetch records; visiting a download page changes browser history; exporting data writes files. Record the start time, tools and versions, relevant commands, export destinations and any necessary changes. Preserve copies of relevant sources where the agreed scope permits, and keep source identity and hashes with retained exports.

Do not launch a candidate, delete a file, rename it or clear a cache to see what happens on the participant’s computer. Those experiments can destroy context or execute unknown code. Use a separate test environment for behavioural questions. If an accidental change occurs, write it down and explain which observations it may affect; do not silently clean up the traces.

Treat recording as a separate decision

A recording can capture far more than the records needed for a finding. Agree whether recording is necessary, what will be recorded, who can replay it and when it will be removed. Make its status visible and pause before private windows, credentials or unrelated conversations appear. Do not assume screen sharing automatically means agreement to a permanent recording.

For some questions, a small, well-described export and written notes are more useful than a long video. Preserve enough relevant context to review the finding without collecting a tour of the participant’s device. If a clip is needed for review, keep it within the case access rules rather than reposting the full call.

Think before a file leaves the device

Public scanners, AI services, community chats and paste sites are third parties. Uploading a file or log can disclose its contents, paths, usernames and other information. Understand the destination’s handling and ask specifically before any disclosure. Where appropriate, investigate a hash or a redacted relevant excerpt instead of sending the entire file. A hash lookup can still reveal that someone is asking about that hash.

Before posting a learning example, remove identifying details and unrelated content while preserving the technical context needed to understand it. Never publish tokens, passwords, private conversations or an unredacted case archive. If a case cannot be shared responsibly, describe a synthetic example instead. Keep the original restricted if it has a justified retention purpose.

Report the supported chain, including its gaps

Keep file presence, acquisition, execution, game loading and use of a prohibited feature separate. Each is a different claim. An unfamiliar name, unsigned module or old execution trace is a lead to investigate, not a shortcut to a verdict. Check the exact instance, file identity, timestamps and surviving coverage. Consider ordinary overlays, updates and other explanations that fit the same observations.

Write what you observed first, then the inference it supports, why you make it and what remains unknown. Preserve relevant contradictory evidence. Confidence should follow the quality of the chain, not the number of screenshots or tools that display the same source. If the evidence cannot resolve session use, say so plainly. A badge on this site is a learning result, not authority to override those limits.

Make the decision reviewable

Keep enough relevant source context for another examiner to reproduce the reasoning: record identifiers, paths, tool versions, time interpretation and steps. A screenshot of a verdict without its basis is difficult to challenge or verify. Explain important coverage gaps and distinguish source observations from parser labels.

Give the participant a clear route to query factual errors or request review. Where possible, a reviewer who did not make the original finding should assess disputed interpretations. Share the relevant basis under appropriate access controls without exposing someone else’s private material. Correct an attribution or conclusion when better evidence warrants it and retain a clear record of that correction.

Pause when meaningful agreement is missing

If the participant cannot understand the proposed access, appears distressed or is not in a position to make the decision, pause the examination. For younger participants, follow an appropriate safeguarding or supervision process before any access. Do not collect identity documents in public chat or search unrelated content to estimate someone’s age.

Use calm, concrete explanations and offer time to consult an appropriate trusted person. Avoid threats, humiliation, surprise demands and pressure to reveal personal information. If the situation cannot support an understood and appropriate examination, stop and refer it through the community’s proper process.

Decide access and deletion before collecting

Before collecting, define the case storage location, people with access and a retention or review date. Store relevant material in a restricted case area. Avoid personal-device copies, shared public links and duplicate moderator archives. Separate a redacted review copy from any restricted original, and keep a simple record of what was collected and disclosed.

At closure, apply the agreed retention plan, remove unnecessary duplicates and explain the applicable request route for retained personal material. A justified review period is different from keeping everything indefinitely. The community must assess its actual legal obligations and circumstances; this practical standard does not establish a legal basis or guarantee compliance for every investigation.

Finish the access as carefully as you started it

End remote control and confirm the sharing session is disconnected. Explain what tools ran, what files were exported, what was retained and which questions remain unresolved. Do not leave unattended access behind. If temporary examination material needs removal, agree and document that action without deleting original evidence or unrelated files.

Give the participant the next steps and review route. Keep the final report proportionate to the question you agreed to examine. A good SS ends with a clear account of the work and its limits, including a clear statement when the available evidence did not settle the issue.

A scope agreement to adapt

Fill in the details and discuss them in plain language. This wording supports a conversation; it is not a substitute for understanding, a legal basis or a complete consent form.

We are checking [specific question] for [session and time window]. We propose to inspect [relevant sources] using [tools and actions]. We will retain [selected material] in [restricted case location], accessible to [reviewers], until [retention or review date]. Recording is [separately agreed choice]. No unrelated messages or credentials are requested. Say “pause” to pause or “stop” to end access. New areas, uploads, remote control or elevation will be discussed first. The review contact is [contact]. Do you understand the scope and want to proceed?

Before you finish

Did access stay within the understood scope?
Are examination effects and timing recorded?
Does each conclusion match the sources, including their limits?
Is retained material relevant, restricted and covered by a retention plan?
Does the participant understand the outcome and review route?
Is remote access disconnected?

Try the SS ethics quiz →

12 scenarios · 10 correct to pass · Practice or exam mode

A scope agreement to adapt

Before you finish

Further reading