Question

Is it possible to write a service program that would catch an event of someone trying to take a screen capture? Not that of pressing a printscreen button or any other key combination, though, but of the event itself, even if it is done by some external tool?

Answer 1

You can’t realistically, because anyone could write a simple application that can take a screenshot.

The command being, GetDC(NULL) (msdn GetDC).

Hooking this function also wouldn’t work since apps can make use of this for legitimate reasons so you’d have to try and filter out false positives.

Also, you’ve only prevented one class of problem, what if the user emails the file to someone? What if the user copies the text rather than uses a screen shot? What if the user takes a photo using their mobile phone?

If you have sensitive information that must be protected the only real option is to educate users and/or restrict their access. E.g. machines with sensitive information are not connected to a public network, USB drives are disabled and user’s are not allowed to bring anything with a camera or data storage near the machines.

If it’s just to avoid silly mistakes, then you could hook the keyboard and look for the print screen key. This however will not detect applications (such as Snipping Tool).