How to find out who leaked a video

Published 6 October 2026. About 6 minutes to read.

If you want to know how to find out who leaked a video, work in this order. Save the evidence. Read the clip. List who had access. Check the logs. Then weigh the clues together. This guide shows each step, and where each one falls short.

Step 1: What should you save first?

Save the leaked file before anything else. Posts get deleted and links stop working.

Download the clip at the best quality you can get, and keep the original file untouched. Work only on copies.
Save the link, the account that posted it, and the date and time you saw it.
Take screenshots of the page, the comments and the share counts.
Write down who found it, and when. Keep the notes in one place.

If this is a live incident, the checklist for the first 24 hours after a leak covers the wider response.

Step 2: What clues are in the clip itself?

Watch it several times, with the sound on and off. Look for these things.

Visible names or times. A name, an email address, a date or a clock on screen can point to one copy.
Screen elements. Menus, buttons, a cursor or a player layout can show which tool or device was used.
Device interface. Battery icons, notifications and the shape of the screen can show a phone, a laptop or a TV.
Recording artefacts. Moire patterns, glare, a screen edge or a hand in the shot mean someone filmed a screen. That tells you the leaker did not simply forward a file.
Quality. A sharp clip suggests a file. A soft clip suggests a recording or heavy re-saving.
What was visible only to some people. If a slide, a name or a draft figure appears that only 1 group saw, the leak probably came from that group.

Write each clue down as a plain fact. Do not write what you think it means yet.

Step 3: Who had access, and when?

Make a list of everyone who could have seen the video. We call this the access circle. For each person, note:

when they were given access
how they received it (a link, an email, a shared folder, a meeting)
whether they could download it, or only watch it
who else they might have shown it to

The list is often longer than people expect. Assistants, agents, family members and advisers all count if they could reach it.

Step 4: Did different people get different versions?

If you sent slightly different versions to different people, compare them with the leaked clip. A different cut, a different title card, a draft number or a typo can match the leak to 1 version. If everyone got the identical file, this step gives you nothing, and the circle stays as wide as it was.

Step 5: What do the access logs say?

Where logs exist, read them. Look at who opened the video, when, from which device and network, and how often. Check email logs, file sharing logs and meeting recordings too.

Be careful with what logs can say. They show an account opened a file. They do not show who was sitting at the keyboard. A shared login, a stolen password or a borrowed phone all look the same in a log.

How do marked copies make this direct?

The slow part of every leak hunt is that everyone had the same file. The fix is to make each copy different before you send it.

With per-person copies, each recipient gets their own link and their own marked copy. Their name moves across the picture, and a hidden mark is built into the picture itself. If the clip leaks, you read the visible name, or the hidden mark when the name is covered, and you know whose copy it was. SealCopy is built around this idea, and how SealCopy reads a leaked clip explains the steps. For the technical side, see forensic watermarking explained in plain English.

What are the limits of tracing a leak?

Marked copies narrow the search a lot. They do not answer every question.

Shared logins. If 2 people use 1 account, the mark points to the account, not the person.
Someone filming a screen. The mark may be harder to read. A very poor recording can make it unreadable, and then the honest answer is a level of confidence, not a name.
Hacked accounts. A person's account can be taken over. Then their copy leaked, but they did not.
Heavy re-processing. Cropping, filters, re-encoding many times or mixing clips together can weaken a hidden mark.

A mark shows whose copy leaked. It does not show who leaked it, or why.

What counts as evidence, and what does not?

Strong evidence is several independent clues that agree. For example: the mark matches 1 copy, the log shows that copy was opened from 1 device, and the clip shows an interface from that same device type. Each clue alone is weak. Together they are a case.

Weak signals include a hunch, who had a motive, who was awkward in a meeting, or a single timestamp. These are reasons to look further. They are not reasons to accuse anyone.

The most important rule: never accuse anyone from a single clue. A mark or a log line tells you where to look. Several clues that agree tell you what probably happened.

What should you do before you speak to anyone?

Before any conversation with a person you suspect, involve HR and a lawyer. Rules on employment, privacy and evidence differ by country, and a badly handled conversation can hurt the case and the person. Your lawyer can tell you what to say, who should be in the room, and how to record it.

Talk to the whole access circle in the same calm way at first. Ask what happened. Do not reveal what you know. Keep your notes as you go.

If you know the next leak is a matter of when, not if, set up the trail before it happens. A sport club, a board or a law firm can send each person a marked copy from the start. Then the answer to this guide's question takes minutes, not weeks.