C.E.R.T.O.
C.E.R.T.O.
Records what happens on screen — a video call, an online meeting, an application — with its audio, and turns it into evidence: every second chained to the previous one, the workstation documented, the bundle sealed.
C.E.R.T.O.'s Screen recording module records what happens on the computer — a whole screen or the window of a single application — with system audio and microphone, and turns it into digital evidence. It covers what the other modules cannot reach: a video call on FaceTime, WhatsApp, Teams, Zoom or Meet, an online meeting or assembly, a live stream that will disappear, an application with no web version, content you can only see once. The video is written to disk one second at a time, each block chained to the previous one, and the bundle documents the workstation and closes everything with a signature and a qualified eIDAS seal. Available from version 3.3.3.
A call, a meeting, a live stream are not pages to archive: they exist while they happen. Here you record the moment.
FaceTime, WhatsApp, Teams, Zoom, Meet: an agreement made by word of mouth, a promise, a threat, an insult. You record the call window, with the other party's voice (system audio) and your own (microphone).
A condominium or shareholders' meeting by video conference, a board, a negotiation: when the minutes are disputed, what was said and shown remains, in the order it happened.
A live stream on Instagram, TikTok, YouTube or Twitch with defamatory statements, counterfeit goods shown for sale, content that will not stay available once it ends.
A messaging program or management software installed on the computer, a voice chat such as Discord, an online game: whatever has no address to give to the Web pages module is recorded from its window, with the application's identity in the bundle.
Software that miscalculates, a portal that rejects a submission minutes before a deadline, a service that does not respond: the sequence of actions and results, with start and end times, for a supplier or for a court.
A job interview, a class, an exam held by video conference, when what happened there may become the subject of a dispute.
A presentation shown in a call and never sent, a document scrolled on screen, timed content: what will never arrive as a file is kept as it appeared.
A technical expert who must show how they consulted a portal or carried out a procedure on their own computer can record the session: the bundle documents what was done, when and from which workstation.
If the evidence is an online page, the right module is Web pages; if it is a still image of the screen, Screenshot; if it is a chat, WhatsApp and Telegram acquire the messages one by one.
The video does not sit in memory until the end: it goes to disk while recording, and each block carries the fingerprint of the one before.
Every one-second block is chained to the previous one with SHA-256, stream by stream, with the time of each (logs/chunk-chain.jsonl). The chain can be recomputed from the files: a block removed, added or moved breaks it.
You record as long as needed. The program monitors free space, warns in good time and, if it would not be enough to close the bundle, stops by itself before running out: the stop is declared in the report, not a file cut off halfway.
The evidence is the WebM video (VP9/Opus) as recorded, and it is never modified. Next to it there is an MP4 copy (H.264/AAC) that opens anywhere, declared as derived, with its own fingerprints.
C.E.R.T.O.'s small control bar — REC, elapsed time, STOP — is excluded from the capture: it stays on the operator's screen and does not cover what is being recorded.
In a recording, lip movement can run ahead of or behind the voice. Here the gap is measured on the video itself.
When recording a screen, at STOP a window appears for a few seconds with a white flash and a click every second, inside the recording. Comparing flashes and clicks gives the gap, which is compensated in the MP4 copy and then verified by measuring the copy again.
In testing: on a Mac the audio arrived 37-45 ms after the picture, on Windows 68-102 ms before it. After correction, the residual gap in the copy was between −13 and +2 ms.
The test cannot appear inside another application's window. So the workstation calibration is used — the last valid test done on that computer — and the applied shift is verified. Without calibration the copy is not corrected, and the report says so.
In every case the original WebM is left untouched: the correction applies only to the viewing copy.
Besides the video, the bundle keeps the voices separate and a snapshot of the workstation at start-up.
In the video, system audio and microphone are together; they are also saved separately, each with its own fingerprints, to tell who is speaking. In the video the microphone voice is processed to be clearly audible; the separate microphone track is the untreated original.
Before REC a level meter shows whether the microphone is picking up the voice. If it only picks up constant noise — for example because no microphone is connected — the operator is warned before starting, and the report declares it.
At start-up every connected screen is photographed, and the system, running processes, time from several NTP servers and the workstation's network are recorded: local network IP, public IP and connectivity provider, gateway, DNS, listening ports, active services.
When a window is recorded, the bundle states which program showed it: name, process, executable with its SHA-256 fingerprint, code signature (Apple or Authenticode) and version, plus changes to the window title during the recording.
A video call contains the faces and voices of people who are not our clients. None of it reaches the server.
The server receives the fingerprints, the metadata and the report text. No video, no audio, no image of any kind: not even a frame.
The bundle exists only on the computer of whoever recorded it. There is no download button in the client area, and that is not a defect. It is wise to back it up straight away: the fingerprints serve to verify it, not to rebuild it.
Whoever receives the bundle can look up its fingerprint on the Find an acquisition page and find the recording, with its date and report code, without the video ever having been with us.
The report states it first. Better to know it before producing the bundle than to hear it in court.
The video shows what appeared on screen. It does not prove who was really on the other side, nor that what is seen or heard is authentic: a name may be false, a video may arrive already manipulated.
It includes the sound of any application, not only the recorded one. Before starting, it is best to close other applications that make sounds.
When recording an application window, the video does not show the rest of the screen. If the context matters too, record the whole screen.
The reports of this module show the user name of the computer used for the recording; folder paths are not shown.
Further reading: recording a video call as evidence, and when it is lawful · the qualified InfoCert seal of the bundle · the chain of custody of digital evidence · how the opposing party verifies the bundle · what it costs: 1 slot.
Video calls, cost, duration, audio, formats and retention: the most common questions about screen recording.
A real case where this module is needed: read the story.
Register for free and download C.E.R.T.O. Desktop for Windows and macOS from your client area.