How to Review a Suspected Cheater's Demo (CS2 and CS 1.6)

A scan shows what is on a PC. A demo shows how someone plays. The two together are the strongest case an admin can have, and a careful demo review also protects good players who just had a great round. This guide explains how to review a demo fairly.

Get the demo

• CS2: on community servers with GOTV/SourceTV enabled, the server records demos. Players can also record their own view with record name and stop with stop in the console.
• CS 1.6: servers can record with HLTV; a player can record their own view with record name. Ask the reported player's team-mates or opponents for theirs too.

Keep the original file and note the date, map and server. If the case ends in a ban, it may be appealed later.

Playback controls

• CS2: playdemo name starts the demo; Shift+F2 opens the demo controls (pause, speed, skip rounds); demo_timescale 0.25 plays at quarter speed.
• CS 1.6: viewdemo name opens the demo with a control panel for speed and pausing; playdemo name plays it without controls.

Watch every round from the suspect's own view first, then the important rounds again slowly.

What an aimbot looks like

• The crosshair snaps onto heads, often from far away, and stops dead on them, with no overshoot and no correction.
• Kills on targets the player was not looking at, especially several in a row.
• Spray that stays perfectly on target while the player moves the mouse in ways that should not do that.
• With a triggerbot: shots fire the instant the crosshair touches an enemy, every time, with no delay.

What a wallhack looks like

• The crosshair follows enemies through walls and smoke before they appear, round after round.
• Pre-firing unusual spots that only the enemy's real position explains.
• Ignoring sounds and fakes that would fool a normal player, because they already know where everyone is.
• Checking corners nobody is in very little, and the occupied ones every time.

Mistakes to avoid

• Judging one clip. Good players have lucky flicks and good reads. Look for a pattern across many rounds and several maps.
• Forgetting sound and information. Footsteps, the radar, team-mates' calls and common angles explain many "impossible" pre-aims.
• Only watching at full speed. Aim snaps and tracking through walls are much clearer at quarter speed.
• Reviewing alone. Ask a second admin to watch without telling them what you saw. If you both note the same moments, you have a case.

Combine it with a scan

Ask the player for an AACGUARD scan and, before the next match, a pre-match check. A demo that looks like an aimbot plus a recent loader in the scan is a clear case. A demo that looks strange plus a clean scan, a clean history and Live running all match long means you should keep watching before you decide. Our guide Writing a scan policy helps you put the steps into your server rules.