From c4468618257be3790270d75ab9a0e35e0c3f7c72 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?simge=20yi=C4=9Fit?= <146586445+simge-yigit@users.noreply.github.com> Date: Thu, 18 Jun 2026 23:55:49 +0300 Subject: [PATCH 1/4] fill MASTG-KNOW-0107-Detection Mechanisms --- .../android/MASVS-PLATFORM/MASTG-KNOW-0107.md | 39 ++++++++++++++++++- 1 file changed, 37 insertions(+), 2 deletions(-) diff --git a/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md b/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md index eaa6ef70576..c90297cd812 100644 --- a/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md +++ b/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md @@ -2,6 +2,41 @@ title: Screenshots and Screen Recording Detection platform: android masvs_category: MASVS-PLATFORM -status: placeholder -note: This topic explains how screenshot and screen recording detection works on Android. --- +Android applications can detect when their screen contents are captured through various mechanisms. These mechanisms notify the application when a capture operation, such as a screenshot or screen recording, takes place. Depending on how the capture is performed, different APIs and detection methods are used. + +The platform provides specific callbacks that notify the application when a screenshot is taken or a screen recording starts. Besides this, applications can also indirectly detect the screen capture process by monitoring system resources such as MediaStore or active displays. However, each of these mechanisms covers only specific capture methods. In other words, there is no single mechanism that can detect all the ways screen content can be captured on its own. + +## Screenshot Detection + +### Screen Capture Callback + +With Android 14 (API level 34), a specific mechanism was introduced that notifies the application when the user takes a screenshot of a visible activity of the application. To use this feature, the application must declare the android.permission.DETECT_SCREEN_CAPTURE install-time permission and register an [Activity.ScreenCaptureCallback](https://developer.android.com/reference/android/app/Activity.ScreenCaptureCallback "android.app.Activity.ScreenCaptureCallback"). + +The callback operates on a per-activity basis. Therefore, the callback is usually registered by calling registerScreenCaptureCallback() within onStart(), and unregistered by calling unregisterScreenCaptureCallback() within onStop(). When the user takes a screenshot while the activity where the callback is registered is visible, the system triggers the onScreenCaptured() method. + +This mechanism only reports that a screenshot was taken; it does not provide the captured image itself to the application. Therefore, the application must determine from its own state what content was being displayed at the moment the screenshot was taken. + +ScreenCaptureCallback only reports screenshots taken by the user using the device's standard screenshot mechanism (for example, a hardware key combination). It does not report screenshots taken via adb or screenshots generated with other tools that capture the current screen content. Additionally, since the callback operates on a per-activity basis, only screenshots taken while the registered activity is visible can be detected. + +### Monitoring the Media Store + +An application can indirectly detect that a screenshot has been taken by monitoring new images added to shared storage. For this, a [ContentObserver](https://developer.android.com/reference/android/database/ContentObserver "android.database.ContentObserver") is registered to the [MediaStore](https://developer.android.com/reference/android/provider/MediaStore "android.provider.MediaStore") image collection, or a [FileObserver](https://developer.android.com/reference/android/os/FileObserver "android.os.FileObserver") is registered to the directory where screenshots are saved. When a new image file is created while the application is running, it becomes aware of this change and tries to determine whether it is a screenshot by examining the display name or relative path of the file. This determination is generally made through heuristic methods based on the presence of phrases like "Screenshot" in the file name or directory path. + +For this approach to work, media reading permissions such as READ_MEDIA_IMAGES are required. Furthermore, only screenshots saved to storage can be detected; captures that are not written to disk cannot be detected with this method. Since the detection process relies on file name and directory structure, the accuracy of the heuristic methods used may vary depending on how the device manufacturer names screenshots and in which directory they store them. + +## Screen Recording Detection + +### Screen Recording Callback + +With Android 15 (API level 35), a specific mechanism was introduced that allows the application to detect that it is included in a screen recording. To use this feature, the application must declare the android.permission.DETECT_SCREEN_RECORDING install-time permission. Afterwards, a callback is registered with [WindowManager](https://developer.android.com/reference/android/view/WindowManager "android.view.WindowManager").addScreenRecordingCallback() and removed with WindowManager.removeScreenRecordingCallback() when no longer needed. +The callback reports the current screen recording state via a Consumer. The state value indicates whether the application's screen is visible in an active screen recording and is transmitted as WindowManager.SCREEN_RECORDING_STATE_VISIBLE or WindowManager.SCREEN_RECORDING_STATE_NOT_VISIBLE. + +This callback is triggered when the application's screen is included in the screen recording or exits the recording. Additionally, when addScreenRecordingCallback() is called, the current recording state is also returned as the initial value. Since the callback only operates on state changes, a new event is not generated for a screen recording that had already started before the callback was registered. In this case, the application only receives the state information returned initially. + +This mechanism can only detect screen recordings performed using the [MediaProjection](https://developer.android.com/reference/android/media/projection/MediaProjection "android.media.projection.MediaProjection") API. Therefore, screen recordings taken by another application via MediaProjection can also be detected. Conversely, capture methods that do not use the MediaProjection infrastructure, such as screen recordings started with adb, are not reported by this callback. + +### Monitoring Active Displays + +An application can indirectly detect operations like screen mirroring, casting, or screen recording by monitoring the active displays on the device via the [DisplayManager](https://developer.android.com/reference/android/hardware/display/DisplayManager "android.hardware.display.DisplayManager"). The presence of an additional display apart from the built-in screen might indicate that the screen content is being routed to another destination. This display could be, for example, a virtual display created by screen mirroring or MediaProjection. +However, this method alone does not prove that a screen recording is taking place. It merely reports that an additional display is present; it cannot determine for what purpose this display was created or by which application it is being used. From e7b532f0e0dd835cedf86f22860b68482871e2cb Mon Sep 17 00:00:00 2001 From: Carlos Holguera Date: Thu, 24 Sep 2026 20:42:41 +0200 Subject: [PATCH 2/4] Apply batched suggestions from code review Co-authored-by: David W. --- .../android/MASVS-PLATFORM/MASTG-KNOW-0107.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md b/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md index c90297cd812..e1d96cbd90b 100644 --- a/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md +++ b/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md @@ -11,32 +11,32 @@ The platform provides specific callbacks that notify the application when a scre ### Screen Capture Callback -With Android 14 (API level 34), a specific mechanism was introduced that notifies the application when the user takes a screenshot of a visible activity of the application. To use this feature, the application must declare the android.permission.DETECT_SCREEN_CAPTURE install-time permission and register an [Activity.ScreenCaptureCallback](https://developer.android.com/reference/android/app/Activity.ScreenCaptureCallback "android.app.Activity.ScreenCaptureCallback"). +With Android 14 (API level 34), a specific mechanism was introduced that notifies the application when the user takes a screenshot of a visible activity of the application. To use this feature, the application must declare the `android.permission.DETECT_SCREEN_CAPTURE` install-time permission and register an [Activity.ScreenCaptureCallback](https://developer.android.com/reference/android/app/Activity.ScreenCaptureCallback). -The callback operates on a per-activity basis. Therefore, the callback is usually registered by calling registerScreenCaptureCallback() within onStart(), and unregistered by calling unregisterScreenCaptureCallback() within onStop(). When the user takes a screenshot while the activity where the callback is registered is visible, the system triggers the onScreenCaptured() method. +The callback operates on a per-activity basis. Therefore, the callback is usually registered by calling `registerScreenCaptureCallback()` within `onStart(),` and unregistered by calling `unregisterScreenCaptureCallback()` within `onStop()`. When the user takes a screenshot while the activity where the callback is registered is visible, the system triggers the `onScreenCaptured()` method. This mechanism only reports that a screenshot was taken; it does not provide the captured image itself to the application. Therefore, the application must determine from its own state what content was being displayed at the moment the screenshot was taken. -ScreenCaptureCallback only reports screenshots taken by the user using the device's standard screenshot mechanism (for example, a hardware key combination). It does not report screenshots taken via adb or screenshots generated with other tools that capture the current screen content. Additionally, since the callback operates on a per-activity basis, only screenshots taken while the registered activity is visible can be detected. +`ScreenCaptureCallback` only reports screenshots taken by the user using the device's standard screenshot mechanism (for example, a hardware key combination). It does not report screenshots taken via adb or screenshots generated with other tools that capture the current screen content. Additionally, since the callback operates on a per-activity basis, only screenshots taken while the registered activity is visible can be detected. ### Monitoring the Media Store -An application can indirectly detect that a screenshot has been taken by monitoring new images added to shared storage. For this, a [ContentObserver](https://developer.android.com/reference/android/database/ContentObserver "android.database.ContentObserver") is registered to the [MediaStore](https://developer.android.com/reference/android/provider/MediaStore "android.provider.MediaStore") image collection, or a [FileObserver](https://developer.android.com/reference/android/os/FileObserver "android.os.FileObserver") is registered to the directory where screenshots are saved. When a new image file is created while the application is running, it becomes aware of this change and tries to determine whether it is a screenshot by examining the display name or relative path of the file. This determination is generally made through heuristic methods based on the presence of phrases like "Screenshot" in the file name or directory path. +An application can indirectly detect that a screenshot has been taken by monitoring new images added to shared storage. For this, a [ContentObserver](https://developer.android.com/reference/android/database/ContentObserver) is registered to the [MediaStore](https://developer.android.com/reference/android/provider/MediaStore) image collection, or a [FileObserver](https://developer.android.com/reference/android/os/FileObserver) is registered to the directory where screenshots are saved. When a new image file is created while the application is running, it becomes aware of this change and tries to determine whether it is a screenshot by examining the display name or relative path of the file. This determination is generally made through heuristic methods based on the presence of phrases like "Screenshot" in the file name or directory path. -For this approach to work, media reading permissions such as READ_MEDIA_IMAGES are required. Furthermore, only screenshots saved to storage can be detected; captures that are not written to disk cannot be detected with this method. Since the detection process relies on file name and directory structure, the accuracy of the heuristic methods used may vary depending on how the device manufacturer names screenshots and in which directory they store them. +For this approach to work, media reading permissions such as `READ_MEDIA_IMAGES` are required. Furthermore, only screenshots saved to storage can be detected; captures that are not written to disk cannot be detected with this method. Since the detection process relies on file name and directory structure, the accuracy of the heuristic methods used may vary depending on how the device manufacturer names screenshots and in which directory they store them. ## Screen Recording Detection ### Screen Recording Callback -With Android 15 (API level 35), a specific mechanism was introduced that allows the application to detect that it is included in a screen recording. To use this feature, the application must declare the android.permission.DETECT_SCREEN_RECORDING install-time permission. Afterwards, a callback is registered with [WindowManager](https://developer.android.com/reference/android/view/WindowManager "android.view.WindowManager").addScreenRecordingCallback() and removed with WindowManager.removeScreenRecordingCallback() when no longer needed. -The callback reports the current screen recording state via a Consumer. The state value indicates whether the application's screen is visible in an active screen recording and is transmitted as WindowManager.SCREEN_RECORDING_STATE_VISIBLE or WindowManager.SCREEN_RECORDING_STATE_NOT_VISIBLE. +With Android 15 (API level 35), a specific mechanism was introduced that allows the application to detect that it is included in a screen recording. To use this feature, the application must declare the `android.permission.DETECT_SCREEN_RECORDING` install-time permission. Afterwards, a callback is registered with [WindowManager](https://developer.android.com/reference/android/view/WindowManager ) `.addScreenRecordingCallback()` and removed with `WindowManager.removeScreenRecordingCallback()` when no longer needed. +The callback reports the current screen recording state via a `Consumer`. The state value indicates whether the application's screen is visible in an active screen recording and is transmitted as `WindowManager.SCREEN_RECORDING_STATE_VISIBLE` or `WindowManager.SCREEN_RECORDING_STATE_NOT_VISIBLE`. This callback is triggered when the application's screen is included in the screen recording or exits the recording. Additionally, when addScreenRecordingCallback() is called, the current recording state is also returned as the initial value. Since the callback only operates on state changes, a new event is not generated for a screen recording that had already started before the callback was registered. In this case, the application only receives the state information returned initially. -This mechanism can only detect screen recordings performed using the [MediaProjection](https://developer.android.com/reference/android/media/projection/MediaProjection "android.media.projection.MediaProjection") API. Therefore, screen recordings taken by another application via MediaProjection can also be detected. Conversely, capture methods that do not use the MediaProjection infrastructure, such as screen recordings started with adb, are not reported by this callback. +This mechanism can only detect screen recordings performed by the system or third-party apps using the [MediaProjection](https://developer.android.com/reference/android/media/projection/MediaProjection) API. Conversely, capture methods that do not use the `MediaProjection` infrastructure, such as screen recordings started with adb, are not reported by this callback. ### Monitoring Active Displays -An application can indirectly detect operations like screen mirroring, casting, or screen recording by monitoring the active displays on the device via the [DisplayManager](https://developer.android.com/reference/android/hardware/display/DisplayManager "android.hardware.display.DisplayManager"). The presence of an additional display apart from the built-in screen might indicate that the screen content is being routed to another destination. This display could be, for example, a virtual display created by screen mirroring or MediaProjection. +An application can indirectly detect operations like screen mirroring, casting, or screen recording by monitoring the active displays on the device via the [DisplayManager](https://developer.android.com/reference/android/hardware/display/DisplayManager). The presence of an additional display apart from the built-in screen might indicate that the screen content is being routed to another destination. This display could be, for example, a virtual display created by screen mirroring or `MediaProjection`. However, this method alone does not prove that a screen recording is taking place. It merely reports that an additional display is present; it cannot determine for what purpose this display was created or by which application it is being used. From f8f00fbc456a2f9f4dd3ec80158d81695a6c05cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?simge=20yi=C4=9Fit?= <146586445+simge-yigit@users.noreply.github.com> Date: Sun, 27 Sep 2026 14:42:46 +0300 Subject: [PATCH 3/4] Add AccessibilityService bypass note and official references per review --- knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md b/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md index e1d96cbd90b..839c37a7cea 100644 --- a/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md +++ b/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md @@ -11,13 +11,13 @@ The platform provides specific callbacks that notify the application when a scre ### Screen Capture Callback -With Android 14 (API level 34), a specific mechanism was introduced that notifies the application when the user takes a screenshot of a visible activity of the application. To use this feature, the application must declare the `android.permission.DETECT_SCREEN_CAPTURE` install-time permission and register an [Activity.ScreenCaptureCallback](https://developer.android.com/reference/android/app/Activity.ScreenCaptureCallback). +With Android 14 (API level 34), a specific mechanism was introduced that notifies the application when the user takes a screenshot of a visible activity of the application. To use this feature, the application must declare the `android.permission.DETECT_SCREEN_CAPTURE` install-time permission and register an [Activity.ScreenCaptureCallback](https://developer.android.com/reference/android/app/Activity.ScreenCaptureCallback) (see also the [official guide on screenshot detection](https://developer.android.com/about/versions/14/features/screenshot-detection)). The callback operates on a per-activity basis. Therefore, the callback is usually registered by calling `registerScreenCaptureCallback()` within `onStart(),` and unregistered by calling `unregisterScreenCaptureCallback()` within `onStop()`. When the user takes a screenshot while the activity where the callback is registered is visible, the system triggers the `onScreenCaptured()` method. This mechanism only reports that a screenshot was taken; it does not provide the captured image itself to the application. Therefore, the application must determine from its own state what content was being displayed at the moment the screenshot was taken. -`ScreenCaptureCallback` only reports screenshots taken by the user using the device's standard screenshot mechanism (for example, a hardware key combination). It does not report screenshots taken via adb or screenshots generated with other tools that capture the current screen content. Additionally, since the callback operates on a per-activity basis, only screenshots taken while the registered activity is visible can be detected. +`ScreenCaptureCallback` only reports screenshots taken by the user using the device's standard screenshot mechanism (for example, a hardware key combination). It does not report screenshots taken via adb or screenshots generated with other tools that capture the current screen content. Additionally, since the callback operates on a per-activity basis, only screenshots taken while the registered activity is visible can be detected. It also does not detect screenshots taken via [`AccessibilityService.takeScreenshot()`](https://developer.android.com/reference/android/accessibilityservice/AccessibilityService#takeScreenshot(int,%20java.util.concurrent.Executor,%20android.accessibilityservice.AccessibilityService.TakeScreenshotCallback)), which is a method known to be used by third-party screenshot applications. ### Monitoring the Media Store @@ -29,7 +29,7 @@ For this approach to work, media reading permissions such as `READ_MEDIA_IMAGES` ### Screen Recording Callback -With Android 15 (API level 35), a specific mechanism was introduced that allows the application to detect that it is included in a screen recording. To use this feature, the application must declare the `android.permission.DETECT_SCREEN_RECORDING` install-time permission. Afterwards, a callback is registered with [WindowManager](https://developer.android.com/reference/android/view/WindowManager ) `.addScreenRecordingCallback()` and removed with `WindowManager.removeScreenRecordingCallback()` when no longer needed. +With Android 15 (API level 35), a specific mechanism was introduced that allows the application to detect that it is included in a screen recording. To use this feature, the application must declare the `android.permission.DETECT_SCREEN_RECORDING` install-time permission. Afterwards, a callback is registered with [WindowManager](https://developer.android.com/reference/android/view/WindowManager)`.addScreenRecordingCallback()` and removed with `WindowManager.removeScreenRecordingCallback()` when no longer needed. The callback reports the current screen recording state via a `Consumer`. The state value indicates whether the application's screen is visible in an active screen recording and is transmitted as `WindowManager.SCREEN_RECORDING_STATE_VISIBLE` or `WindowManager.SCREEN_RECORDING_STATE_NOT_VISIBLE`. This callback is triggered when the application's screen is included in the screen recording or exits the recording. Additionally, when addScreenRecordingCallback() is called, the current recording state is also returned as the initial value. Since the callback only operates on state changes, a new event is not generated for a screen recording that had already started before the callback was registered. In this case, the application only receives the state information returned initially. From 4eb9db44becbf38567267444a1cb6e357ffea4f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?simge=20yi=C4=9Fit?= <146586445+simge-yigit@users.noreply.github.com> Date: Sun, 4 Oct 2026 15:58:09 +0300 Subject: [PATCH 4/4] fixed the formatting issues --- .../android/MASVS-PLATFORM/MASTG-KNOW-0107.md | 25 +++++++++++-------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md b/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md index 839c37a7cea..07028c11cbb 100644 --- a/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md +++ b/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0107.md @@ -3,40 +3,43 @@ title: Screenshots and Screen Recording Detection platform: android masvs_category: MASVS-PLATFORM --- + Android applications can detect when their screen contents are captured through various mechanisms. These mechanisms notify the application when a capture operation, such as a screenshot or screen recording, takes place. Depending on how the capture is performed, different APIs and detection methods are used. -The platform provides specific callbacks that notify the application when a screenshot is taken or a screen recording starts. Besides this, applications can also indirectly detect the screen capture process by monitoring system resources such as MediaStore or active displays. However, each of these mechanisms covers only specific capture methods. In other words, there is no single mechanism that can detect all the ways screen content can be captured on its own. +The platform provides specific callbacks that notify the application when a screenshot is taken or a screen recording starts. Besides this, applications can also indirectly detect the screen capture process by monitoring system resources such as `MediaStore` or active displays. However, each of these mechanisms covers only specific capture methods. In other words, there is no single mechanism that can detect all the ways screen content can be captured on its own. ## Screenshot Detection ### Screen Capture Callback -With Android 14 (API level 34), a specific mechanism was introduced that notifies the application when the user takes a screenshot of a visible activity of the application. To use this feature, the application must declare the `android.permission.DETECT_SCREEN_CAPTURE` install-time permission and register an [Activity.ScreenCaptureCallback](https://developer.android.com/reference/android/app/Activity.ScreenCaptureCallback) (see also the [official guide on screenshot detection](https://developer.android.com/about/versions/14/features/screenshot-detection)). +With Android 14 (API level 34), a specific mechanism was introduced that notifies the application when the user takes a screenshot of a visible activity of the application. To use this feature, the application must declare the [`android.permission.DETECT_SCREEN_CAPTURE`](https://developer.android.com/reference/android/Manifest.permission#DETECT_SCREEN_CAPTURE) install-time permission and register an [`Activity.ScreenCaptureCallback`](https://developer.android.com/reference/android/app/Activity.ScreenCaptureCallback) (see also the [official guide on screenshot detection](https://developer.android.com/about/versions/14/features/screenshot-detection)). -The callback operates on a per-activity basis. Therefore, the callback is usually registered by calling `registerScreenCaptureCallback()` within `onStart(),` and unregistered by calling `unregisterScreenCaptureCallback()` within `onStop()`. When the user takes a screenshot while the activity where the callback is registered is visible, the system triggers the `onScreenCaptured()` method. +The callback operates on a per-activity basis. Therefore, the callback is usually registered by calling [`registerScreenCaptureCallback`](https://developer.android.com/reference/android/app/Activity#registerScreenCaptureCallback(java.util.concurrent.Executor,%20android.app.Activity.ScreenCaptureCallback)) within `onStart`, and unregistered by calling [`unregisterScreenCaptureCallback`](https://developer.android.com/reference/android/app/Activity#unregisterScreenCaptureCallback(android.app.Activity.ScreenCaptureCallback)) within `onStop`. When the user takes a screenshot while the activity where the callback is registered is visible, the system triggers the [`onScreenCaptured`](https://developer.android.com/reference/android/app/Activity.ScreenCaptureCallback#onScreenCaptured()) method. This mechanism only reports that a screenshot was taken; it does not provide the captured image itself to the application. Therefore, the application must determine from its own state what content was being displayed at the moment the screenshot was taken. -`ScreenCaptureCallback` only reports screenshots taken by the user using the device's standard screenshot mechanism (for example, a hardware key combination). It does not report screenshots taken via adb or screenshots generated with other tools that capture the current screen content. Additionally, since the callback operates on a per-activity basis, only screenshots taken while the registered activity is visible can be detected. It also does not detect screenshots taken via [`AccessibilityService.takeScreenshot()`](https://developer.android.com/reference/android/accessibilityservice/AccessibilityService#takeScreenshot(int,%20java.util.concurrent.Executor,%20android.accessibilityservice.AccessibilityService.TakeScreenshotCallback)), which is a method known to be used by third-party screenshot applications. +`ScreenCaptureCallback` only reports screenshots taken by the user using the device's standard screenshot mechanism (for example, a hardware key combination). It does not report screenshots taken via @MASTG-TOOL-0004 or screenshots generated with other tools that capture the current screen content. Additionally, since the callback operates on a per-activity basis, only screenshots taken while the registered activity is visible can be detected. It also does not detect screenshots taken via [`AccessibilityService.takeScreenshot`](https://developer.android.com/reference/android/accessibilityservice/AccessibilityService#takeScreenshot(int,%20java.util.concurrent.Executor,%20android.accessibilityservice.AccessibilityService.TakeScreenshotCallback)), which is a method known to be used by third-party screenshot applications. ### Monitoring the Media Store -An application can indirectly detect that a screenshot has been taken by monitoring new images added to shared storage. For this, a [ContentObserver](https://developer.android.com/reference/android/database/ContentObserver) is registered to the [MediaStore](https://developer.android.com/reference/android/provider/MediaStore) image collection, or a [FileObserver](https://developer.android.com/reference/android/os/FileObserver) is registered to the directory where screenshots are saved. When a new image file is created while the application is running, it becomes aware of this change and tries to determine whether it is a screenshot by examining the display name or relative path of the file. This determination is generally made through heuristic methods based on the presence of phrases like "Screenshot" in the file name or directory path. +An application can indirectly detect that a screenshot has been taken by monitoring new images added to shared storage. For this, a [`ContentObserver`](https://developer.android.com/reference/android/database/ContentObserver) is registered to the [`MediaStore`](https://developer.android.com/reference/android/provider/MediaStore) image collection, or a [`FileObserver`](https://developer.android.com/reference/android/os/FileObserver) is registered to the directory where screenshots are saved. When a new image file is created while the application is running, it becomes aware of this change and tries to determine whether it is a screenshot by examining the display name or relative path of the file. This determination is generally made through heuristic methods based on the presence of phrases like "Screenshot" in the file name or directory path. -For this approach to work, media reading permissions such as `READ_MEDIA_IMAGES` are required. Furthermore, only screenshots saved to storage can be detected; captures that are not written to disk cannot be detected with this method. Since the detection process relies on file name and directory structure, the accuracy of the heuristic methods used may vary depending on how the device manufacturer names screenshots and in which directory they store them. +For this approach to work, media reading permissions such as [`READ_MEDIA_IMAGES`](https://developer.android.com/reference/android/Manifest.permission#READ_MEDIA_IMAGES) are required. Furthermore, only screenshots saved to storage can be detected; captures that are not written to disk cannot be detected with this method. Since the detection process relies on file name and directory structure, the accuracy of the heuristic methods used may vary depending on how the device manufacturer names screenshots and in which directory they store them. ## Screen Recording Detection ### Screen Recording Callback -With Android 15 (API level 35), a specific mechanism was introduced that allows the application to detect that it is included in a screen recording. To use this feature, the application must declare the `android.permission.DETECT_SCREEN_RECORDING` install-time permission. Afterwards, a callback is registered with [WindowManager](https://developer.android.com/reference/android/view/WindowManager)`.addScreenRecordingCallback()` and removed with `WindowManager.removeScreenRecordingCallback()` when no longer needed. -The callback reports the current screen recording state via a `Consumer`. The state value indicates whether the application's screen is visible in an active screen recording and is transmitted as `WindowManager.SCREEN_RECORDING_STATE_VISIBLE` or `WindowManager.SCREEN_RECORDING_STATE_NOT_VISIBLE`. +With Android 15 (API level 35), a specific mechanism was introduced that allows the application to detect that it is included in a screen recording (see also the [official guide on screen recording detection](https://developer.android.com/about/versions/15/features#screen-recording-detection)). To use this feature, the application must declare the [`android.permission.DETECT_SCREEN_RECORDING`](https://developer.android.com/reference/android/Manifest.permission#DETECT_SCREEN_RECORDING) install-time permission. Afterwards, a callback is registered with [`WindowManager.addScreenRecordingCallback`](https://developer.android.com/reference/android/view/WindowManager#addScreenRecordingCallback(java.util.concurrent.Executor,%20java.util.function.Consumer%3Cjava.lang.Integer%3E)) and removed with [`WindowManager.removeScreenRecordingCallback`](https://developer.android.com/reference/android/view/WindowManager#removeScreenRecordingCallback(java.util.function.Consumer%3Cjava.lang.Integer%3E)) when no longer needed. + +The callback reports the current screen recording state via a `Consumer`. The state value indicates whether the application's screen is visible in an active screen recording and is transmitted as [`WindowManager.SCREEN_RECORDING_STATE_VISIBLE`](https://developer.android.com/reference/android/view/WindowManager#SCREEN_RECORDING_STATE_VISIBLE) or [`WindowManager.SCREEN_RECORDING_STATE_NOT_VISIBLE`](https://developer.android.com/reference/android/view/WindowManager#SCREEN_RECORDING_STATE_NOT_VISIBLE). -This callback is triggered when the application's screen is included in the screen recording or exits the recording. Additionally, when addScreenRecordingCallback() is called, the current recording state is also returned as the initial value. Since the callback only operates on state changes, a new event is not generated for a screen recording that had already started before the callback was registered. In this case, the application only receives the state information returned initially. +This callback is triggered when the application's screen is included in the screen recording or exits the recording. Additionally, when `addScreenRecordingCallback` is called, the current recording state is also returned as the initial value. Since the callback only operates on state changes, a new event is not generated for a screen recording that had already started before the callback was registered. In this case, the application only receives the state information returned initially. -This mechanism can only detect screen recordings performed by the system or third-party apps using the [MediaProjection](https://developer.android.com/reference/android/media/projection/MediaProjection) API. Conversely, capture methods that do not use the `MediaProjection` infrastructure, such as screen recordings started with adb, are not reported by this callback. +This mechanism can only detect screen recordings performed by the system or third-party apps using the [`MediaProjection`](https://developer.android.com/reference/android/media/projection/MediaProjection) API. Conversely, capture methods that do not use the `MediaProjection` infrastructure, such as screen recordings started with @MASTG-TOOL-0004, are not reported by this callback. ### Monitoring Active Displays -An application can indirectly detect operations like screen mirroring, casting, or screen recording by monitoring the active displays on the device via the [DisplayManager](https://developer.android.com/reference/android/hardware/display/DisplayManager). The presence of an additional display apart from the built-in screen might indicate that the screen content is being routed to another destination. This display could be, for example, a virtual display created by screen mirroring or `MediaProjection`. +An application can indirectly detect operations like screen mirroring, casting, or screen recording by monitoring the active displays on the device via the [`DisplayManager`](https://developer.android.com/reference/android/hardware/display/DisplayManager). The presence of an additional display apart from the built-in screen might indicate that the screen content is being routed to another destination. This display could be, for example, a virtual display created by screen mirroring or `MediaProjection`. + However, this method alone does not prove that a screen recording is taking place. It merely reports that an additional display is present; it cannot determine for what purpose this display was created or by which application it is being used.