A compact description of a display
EDID is a structured profile exposed through the display connection and operating system. Its base block can describe a manufacturer, product code, numeric serial, manufacture date, physical size, input characteristics and timing capabilities. Extension blocks can carry additional information, including formats and color or HDR capabilities.
DisplayDNA keeps the original OS-exposed bytes, then parses the fields it supports. Keeping the raw profile makes it possible to revisit a finding later without relying only on a readable summary.
Capabilities and active settings answer different questions
A preferred timing in a profile is not the same as the currently active resolution or refresh rate. User settings, scaling, rotation, bandwidth, adapters and the display pipeline can all produce differences. A Retina desktop may use logical coordinates that differ from its physical pixel mode.
That is why the inspector separates parsed EDID capabilities, OS identity and current settings. When raw EDID is absent, the OS can still expose useful geometry and identity metadata.
What a checksum tells you
Each 128-byte block has a checksum. Summing the block’s bytes modulo 256 should produce zero. A failed checksum can reveal corruption, truncation or a profile that was modified without updating its checksum.
A passing checksum is only a byte-level consistency check. It does not authenticate the device or establish complete standards conformance. DisplayDNA’s parser validates selected structures, not every possible EDID, CTA or DisplayID semantic rule.
Why two profiles might differ
- A dock, adapter or cable path may expose a different profile.
- A driver or firmware update can change OS-exposed information.
- A virtual display or override can supply its own EDID.
- Cached records may remain after a display is disconnected.
- Some devices use generic or duplicate serial identifiers.
Differences are useful for troubleshooting. They need source, freshness and context before you draw a conclusion.
Why EDID cannot reliably detect capture hardware
A downstream device may pass through, replace or imitate a display profile. EDID does not provide comprehensive visibility into everything connected along a signal path. A profile that looks normal cannot prove that capture is absent; an unusual profile cannot prove that capture is present.
DisplayDNA does not implement reliable system-wide screenshot, recording or sharing detection. Missing telemetry remains unknown. Anomalies do not establish intent or misconduct.
A practical inspection sequence
- Identify whether the record is live, cached or imported.
- Preserve the original profile and review block checksums.
- Compare identity and supported fields with a known baseline.
- Check active mode and geometry separately from advertised capabilities.
- Read the source, confidence and platform limits of each finding.
Download the beta to inspect your own environment, or use the included synthetic Demo workspace to explore the workflow.
Technical references
Microsoft WMI monitor descriptor methods · Linux DRM userspace interfaces · Apple display configuration callbacks