[bigfatkitten]

> In this case, we see that investigators were able to detect Perez-Lugones’ screenshot, which likely would have removed some metadata — information about the original document — before he printed it out as a new document.

Or they just looked at his print history, which is routinely logged on corporate networks, with classified networks likely being no different. There’s no magic here.