Recording a video call as evidence: how to do it, and when it is lawful

A video call, a Teams or Zoom meeting, a livestream that is gone an hour later: sometimes these moments need to be kept, because something was said or shown that will matter later. The quickest way is to start the computer's screen recorder. The resulting file can be used as evidence, but on its own provides limited information for verifying its integrity, provenance and timing.

This guide explains the limitations of an ordinary recording, how to make a recording easier to verify, and how the Screen recording module of C.E.R.T.O. does it. With one chapter you should not skip: when recording is lawful, and what the recording does not prove.

The limitations of an ordinary recording

A video saved with the operating system's tool or with a recording program is a file like any other. Three limitations matter when someone challenges it:

• It can be edited without the changes being immediately apparent. Cuts and edits are not necessarily obvious during playback; without hashes and reference data preserved at capture time, detecting them may require further analysis.
• The file's date is not independently attested. Dates recorded by the system may depend on the computer's clock and settings.
• Its provenance is not fully documented. The file may contain some metadata, but does not necessarily provide a complete, verifiable record of the computer, screen, application and audio sources used.

If the recording is challenged, additional evidence of its authenticity and integrity may be needed.

How to make a recording easier to verify

• Cryptographic fingerprints (hashes) of the video and audio, computed straight away: any later change, even of a single byte, alters them.
• A chain linking each stretch of the recording to the previous one, so that a cut or a move in the middle shows.
• A timestamp issued by a third party, attesting that the data existed at that moment.
• The context: the computer, the connected screens, the recorded application, the network, the clock checked against external sources.
• A bundle anyone can verify, including the opposing party, without having to trust whoever produced it.

How the C.E.R.T.O. Screen recording module does it

What gets recorded

You choose a whole screen or the window of a single application — the video call app, the conferencing program, the browser showing the livestream. Audio includes system audio (the other participants' voices, whatever the computer plays) and, if you enable it, the microphone (your own voice). The two sources are combined in the video and also saved separately: three tracks, each with its own fingerprints.

Before you start, a level meter shows whether the microphone is actually picking up your voice. If it only receives constant noise — for instance because no microphone is connected — the program warns you before recording begins, and the report states it.

No time limit, and a chain you can recompute

The video is written to disk in one-second blocks while recording, so there is no time limit: a three-hour meeting is recorded just like a five-minute call. The program monitors free disk space and stops on its own before running out, and says so.

Each block is chained to the previous one with SHA-256: the previous fingerprint and the block's bytes go into the computation of the new one. Each track (video, system audio, microphone) has its own chain. The chain is recomputed from the files; a block removed, added or moved breaks it.

The context, captured at the start

When you press REC the program takes a picture of every connected screen, including those not being recorded, and records a snapshot of the environment: operating system, running processes, the clock checked against several NTP servers, displays. It also documents the workstation's network: local network address, public address and internet provider, gateway, DNS, listening ports, active services.

If you record a window, the bundle reports the identity of the application: name, process, the executable file with its SHA-256 fingerprint, the code signature (Apple or Authenticode) and the version, plus changes to the window during the recording. In a video call, for instance, it shows which program was in use and whether it was the vendor's original.

The C.E.R.T.O. control bar (REC, elapsed time, STOP, CANCEL) is excluded from the capture on macOS and on Windows 10 (version 2004) and later: it does not cover what you are recording, and the report states whether the exclusion succeeded. CANCEL ends the recording without creating a bundle and without charging the slot.

Picture and sound aligned, and measured

When you record a screen, at STOP a “Sync” window appears for a few seconds: a white flash and a click every second, inside the recording. The offset between picture and sound is thus measured on the video itself, compensated in the viewing copy and checked by measuring the copy again. In testing the measured offsets were a few tens of milliseconds (up to a tenth of a second); after correction the residual stayed within about fifteen milliseconds.

A valid test becomes the workstation calibration, also used for window recordings, where the test cannot appear. Without a calibration the copy is not corrected, and the report says so. In every case the original file is never modified: the correction applies only to the copy.

Original and viewing copy

The evidence is the WebM file (VP9 video, Opus audio) exactly as recorded. Next to it there is an MP4 copy (H.264/AAC) that opens in any player, declared as derived and with its own fingerprints. In the video the microphone voice is processed to be more audible (filter, noise gate, automatic gain); while you speak, the system audio in the video is lowered by a few decibels, and the report states by how much. The separate microphone and system audio tracks are instead the untreated originals.

The bundle and the seal

At the end everything is closed in a BagIt bundle, as with every C.E.R.T.O. module: a manifest signed with Ed25519, RFC 3161 timestamps, a CASE/UCO description, a text and PDF report, an interactive dashboard with the video, the audio tracks and their waveforms, and the verify.sh and verify.bat verifiers.

From version 3.3.3 the bundle carries, as standard, a seal with an InfoCert eIDAS qualified timestamp, included in the price. The seal is applied to the bundle's index, which holds, in a chain, the fingerprints of every other file. A qualified timestamp enjoys a presumption of the accuracy of the date and time and of the integrity of the timestamped data (eIDAS Regulation, Art. 41(2)): it covers the date and integrity, not the content of the video. If InfoCert is unavailable, a free timestamping service is used instead. The bundle identifies the service used and states whether the timestamp is qualified.

Where the recording stays

The C.E.R.T.O. server receives only fingerprints, metadata and the text of the report. No video, no audio, no image of any kind, not even a single frame. The bundle exists only on the computer of whoever recorded it: there is no download button in the client area, and that is deliberate.

The recorded fingerprints are enough to verify a bundle when it is produced — including through the public search, by pasting the video fingerprint — but not to rebuild it. So the bundle must be looked after: copy it to a second medium right after recording.

When to use it: some cases

• Video calls on FaceTime, WhatsApp, Teams, Zoom, Meet: a verbal agreement, a threat, a statement the other person might later deny.
• Online meetings and conferences: a general meeting held by videoconference, a work meeting, an interview, a lesson, a webinar where things that matter were said.
• Livestreams that disappear: a social livestream that is not saved, a story that expires after twenty-four hours, content you can only see once.
• Applications with no web version: a program installed on the computer, business software, the desktop app of a chat, where there is no page to acquire.
• Procedures to document: an error that only shows up under certain conditions, an online purchase that fails, a sequence of steps in a private area.

If the content is a web page that is still online, the Web pages module is a better fit, as it also keeps the page code and traffic. For a single picture of the screen, the Screenshot module is enough; the procedure is in the guide on screenshots as evidence.

Is recording lawful? Consent and other people's data

The rules depend on where you are, and they differ a great deal between countries: some allow a participant to record a conversation without telling the others, others require everyone's consent. Before recording, check the law that applies to you.

In Italy, case law generally considers it lawful for someone who takes part in a conversation to record it, even without the others knowing. The Joint Criminal Divisions of the Court of Cassation (judgment no. 36747 of 2003) classified the recording of a conversation made by one of those present as documentary evidence, not as interception; the same principle has been applied to telephone conversations. Two limits follow:

• you only record a conversation you take part in: secretly recording a call or meeting between other people, in which you play no part, is a different matter and may be a criminal offence;
• the recording serves to protect a right: using it in court or handing it to your lawyer is different from spreading it. Subject to the conditions set out in the provision, Article 617-septies of the Italian Criminal Code criminalises the dissemination of fraudulently obtained recordings for the purpose of damaging another person's reputation or image. The provision excludes punishment where dissemination results directly and immediately from their use in administrative or judicial proceedings, or in exercising the right of defence or the right to report news. These exceptions do not authorise unrestricted disclosure. The offence is prosecuted only upon complaint by the injured party.

The recording contains the other participants' personal data: voice, image, sometimes a name in the window title. Where the EU General Data Protection Regulation (GDPR) applies, using the recording for legal defence requires an appropriate legal basis and must be necessary and proportionate. If it contains special categories of personal data, a condition under Article 9 must also apply, such as necessity for establishing, exercising or defending legal claims. The data collected, access to them and the retention period must be limited.

A specific case may have its own features (a workplace, a relationship with a professional, official secrecy). If in doubt, talk to your lawyer before recording.

What the recording does not prove

The C.E.R.T.O. report states it, and it is worth knowing beforehand:

• the video shows what appeared on the screen; it does not prove the identity of the people on the other side, nor the authenticity of what was seen or heard. That the other person really was who they claimed to be must be shown by other means;
• system audio is global: it includes the sound of any application, not just the one recorded. Before starting, close anything that might make a sound;
• when recording a window, the video does not show the rest of the screen;
• the MP4 copy is derived: the evidence is the WebM file;
• the report shows the workstation user name in clear.

What it costs

A recording costs 1 slot, flat, whatever its length. From version 3.3.3 the InfoCert seal on the bundle is included: there are no paid options. Slot packages are on the pricing page.

Frequently asked questions

Can I record a WhatsApp or FaceTime video call as evidence?

Generally yes if you take part in the call and the law where you are allows it: in Italy, case law generally considers a recording made by one of the participants lawful, to protect one's own rights. With the C.E.R.T.O. Screen recording module you record the app window or the whole screen, with system audio and microphone, and the file goes into a bundle with fingerprints, a block chain and a timestamp. If in doubt about your case, talk to your lawyer before recording.

Is there a time limit?

No. The video is written to disk in one-second blocks, so a meeting lasting hours is recorded like a short call. The program monitors free disk space and stops on its own before running out, and the report says so. The cost remains 1 slot.

Does the recording prove who was on the other side?

No. It documents what was captured from the screen and audio sources. Hashes allow integrity to be checked against the sealed data; the timestamp attests that those data existed at the time of timestamping. The other person's identity, the authenticity of the content and the exact time of the conversation require additional evidence.

Can I download the recording from the client area?

No, and that is deliberate: the server receives only fingerprints, metadata and the report text, never the video, audio or images. The bundle exists only on your computer, so copy it to a second medium right after recording. The recorded fingerprints let you verify the bundle when you produce it, not rebuild it.