Metadata in Market Screenshots: The Timestamps, Fonts and Cursors That Identify Researchers

Screenshots travel well in this scene. A payment confirmation, a chat thread, a market dashboard, a vouch from a reputed account. They get posted as proof, cross-posted as evidence, archived as research. Everyone reads the visible layer. Almost no one reads the pixels around it.

The interesting part is not what a screenshot shows. It is what the file carries, and what the image layout quietly confesses about the hands that made it. For anyone doing research on darknet markets, this cuts both ways. The metadata in someone else’s screenshot is a lead. The metadata in yours is an exposure.

EXIF: the obvious layer, and why it still works

Digital images use a metadata standard called EXIF (Exchangeable Image File Format). In most cases, devices like smartphones attach exact timestamps and GPS coordinates to photos taken with the built-in camera, by default. EXIF can also carry device ID numbers, camera settings, and image metrics such as pixel dimensions and resolution, according to avoidthehack.com. Document-level metadata behaves the same way: author names, editing time, and sometimes the local file path where a document was saved, per ThreatNG’s metadata exposure glossary.

On iOS you can strip geolocation through the Photos app: open the image, tap the information tab, tap “adjust” for the location, select “No Location” (avoidthehack). Note what that does and does not do. It removes GPS coordinates. It does not remove the timestamp, the device model, or the software version. It does not cover shared albums, or the copy of the photo Apple may be holding if iCloud sync is on, where the keys to decryption sit with Apple unless Advanced Data Protection is enabled (same source).

So the first pass on an inbound screenshot is mechanical. Pull the EXIF. Look at the capture time, the device, the software version string. A market “proof” screenshot whose EXIF says the file was created two minutes ago on a desktop capture tool tells you less than one captured on a phone at the stated time. That mismatch is a finding.

Partial screenshots deserve suspicion for a related reason. A cropped image hides the frame around it, and the frame is where the identifying information lives: retailer or market name, order number, timestamp, account state. If a screenshot is cropped such that the full confirmation is gone, you cannot verify what it claims to prove. That is not a metadata point so much as a proof-hygiene point, and it shows up constantly in carding-adjacent vouch threads.

Timestamps are a fingerprint, not just a time

Every operating system renders time in its own format. Windows 11 taskbar clocks format differently from macOS menu bar clocks, which format differently from most Android status bars. The separator character, the use of leading zeros, the 12-hour versus 24-hour default, the presence or absence of a timezone label. None of that is cryptographic, and none of it is conclusive. All of it narrows the field.

Worse, the timestamp in a screenshot is not the capture time. It is the clock the machine believed it was showing. A researcher who has set their system clock to a neutral timezone, or who is working through a VM with a frozen clock, produces a screenshot whose visible time and EXIF capture time disagree. That disagreement is a signal about the setup, and an attacker reading it learns something about your operational habits.

The practical rule: the visible timestamp, the EXIF timestamp, and the file modification time should tell one consistent story. If they do not, either the image was edited or the environment is unusual. Both are worth noting.

Fonts, themes and UI chrome

This is where most people stop looking and where a lot of identification actually happens.

Desktop Linux distributions ship different default fonts from macOS and Windows. A screenshot of a browser window on a stock Ubuntu desktop renders text visibly differently from the same page on Windows 11, mostly in hinting and glyph width. Custom themes change scrollbar thickness, tab corner radius, and the colour of window controls. A dark-mode setup with a specific accent colour is a weak identifier on its own, but it becomes strong when combined with the rest.

Browser user interfaces are also versioned. Chrome, Firefox and Brave change tab bar geometry and menu iconography between major releases. A screenshot showing a specific combination of browser chrome, OS theme, and font rendering is effectively a version string. That is exactly the kind of information an adversary uses during reconnaissance, because it tells them which browser build you are running and, by extension, whether you are behind on patches. The ThreatNG glossary calls this out directly: metadata exposure is rarely a direct breach, but it provides the intelligence to facilitate one. An outdated PDF generator or browser version in a screenshot points an attacker at known exploits.

For researchers, the inverse is useful. When you are assessing a screenshot from an unknown source, compare the visible UI against known build fingerprints. A “market screenshot” showing a browser layout from a version that did not exist at the claimed capture date is fabricated.

Cursors and pointer position

The mouse cursor is a small thing that leaks more than it should.

Operating systems use different default cursors. Screen recorders and screenshot tools sometimes render the pointer at a position that does not match the visible UI state, which is a tell for compositing. More interesting: the cursor position within the frame is chosen by the person who took the screenshot. It hovers over the account name, the balance, the order ID, the exact button they wanted you to see. Reading cursor placement tells you what the author considered the important part of the frame, and sometimes it reveals what they meant to highlight but missed.

Some capture tools draw a cursor overlay at the last recorded position rather than the live one. If two screenshots from the same claimed session show an identical cursor coordinate on different pages, that is a compositing artefact, not two real captures.

What this means for a researcher reading a screenshot

Treat every inbound image as a document with a provenance problem. A workable sequence:

• Extract EXIF. Record capture time, device, software, dimensions. Do not trust it, but do compare it against the visible claims.
• Check whether the file has been re-encoded. Messenger apps strip or rewrite EXIF, so a clean file may simply mean it passed through a platform. Absence of metadata is not evidence of cleanliness.
• Inspect the frame. Full confirmation or cropped? No transaction hash is a hard fail for any crypto claim, because a real transfer has a public hash anyone can check on a blockchain explorer.
• Reverse image search. Template screenshots get reused across listings, forums and Telegram channels. The same “proof” appearing in two places, or every vouch coming from accounts created within the last week, points at a single operator.
• Read the UI chrome. Build fingerprint, OS theme, font rendering. Cross-reference against the claimed capture context.

None of these steps is decisive alone. Compiled, they form an attribution profile.

What this means for you, taking the screenshot

If you handle anything sensitive, the screenshot is an outbound artefact. Exhaustive sanitisation is hard, and it gets harder the moment the image leaves your machine. Messaging platforms rewrite or strip some fields, but not reliably, and the platform sees the original on ingest. That last point matters: metadata can be harvested by anyone with the means and know-how to do so, including the platform the image was shared on.

The safer pattern is to never capture what you do not need in the first place:

• Disable geolocation tagging before any sensitive capture, and verify with an EXIF reader that it is actually gone.
• Keep research sessions in a browser profile that is completely separate from the one you use for personal accounts, ideally on a hardened browser such as Brave or LibreWolf.
• Run research from a no-log VPN from a jurisdiction that does not retain connection logs.
• Use a dedicated sock puppet identity with its own email alias and, if accounts are involved, a zero-knowledge password manager. Never bind those accounts to a real phone number.
• Recognise that a single reused username ties identities together across platforms. Username enumeration tools like WhatsMyName.app and Sherlock scan hundreds of sites in seconds looking for exactly that reuse.
• Assume that stripping EXIF is only the first step. The visual fingerprint of your environment is the second problem, and it is not removable by software.

Beyond EXIF, the cursor, the fonts and the timestamps together form a behavioural signature. A researcher who posts screenshots regularly with a consistent theme, font set and cursor habit produces a corpus that can be fingerprinted across posts, forums and time. That is a much harder problem than a dropped GPS tag.

A blunt verdict

Metadata in screenshots is a real signal, but it is not a magic trick. Phones leak the most, because they attach GPS, timestamp, device ID and camera settings by default. Desktops leak less EXIF and more UI fingerprint. Messaging apps strip some of both and introduce their own re-encoding artefacts.

If you are reading screenshots, read them as composites: pixel content plus frame plus metadata plus file history. If you are producing them, minimise what enters the frame and assume everything that does enters the record permanently. Screenshots are not ephemeral. They are documents with witnesses.

Research and educational context only. This article does not endorse or link to any illegal marketplace, and nothing here should be read as operational advice for unlawful activity.