Steps
- Confirm the exact local container name and timestamp.
- Capture the smallest screenshot showing the relevant state.
- Pair it with command output from the same workload and redact unrelated identifiers or secrets.
- Store the evidence with its claim and source.
Verify and clean up
A reviewer can connect screenshot, command, name, and time. Delete temporary captures containing unnecessary sensitive data.