Non-Invasive Screen Attribution System Using DXGI Desktop Duplication and Overlay Watermarking

Digital forensic evidence requires traceability throughout its lifecycle, yet current chain of custody systems collapse once materials leave controlled environments. When evidence passes to defence counsel, partner agencies, or expert witnesses, institutions lose the ability to attribute leaks or unau-thorised redistribution to individual users. High-profile breaches, including leaked court opinions and custody footage, expose this accountability gap. Existing screen watermark methods depend on invasive system alteration that violates forensic integrity standards and creates attack surfaces through API manipulation. This paper introduces a non-invasive attribution framework that identifies evidence viewers without alteration of evidence files or compromise of system security. The design separates read-only content analysis from overlay watermark application and operates solely through authorised operating-system interfaces. Viewer identifiers derive from cryptographically generated visual patterns that remain intact under common image transformations and preserve evidential visibility. A machine-learning ensemble detects these identifiers with high accuracy after crop, compression, and filter attacks. The framework functions within standard forensic workflows under normal user permissions and maintains full compatibility with commercial forensic tools. The results show that forensically sound attribution is achievable without the system intrusion or evidence alteration that hindered earlier methods.