OSINTBlog.
← All articles

Preserving Web Evidence: Captures, Hashes, and Chain of Custody

BY

Preserving Web Evidence: Captures, Hashes, and Chain of Custody

Web content is fragile. A post can be edited, a profile can be set to private, and a whole site can go offline between the morning you find something and the afternoon you try to show it to a client. If you cannot show what you saw, when you saw it, and that it has not changed since, your finding is only a memory. This guide covers the practical habits that turn what you see on a screen into evidence that can be checked, shared and, if it comes to it, defended.

What "defensible" actually means

A capture is defensible when someone who was not there can answer four questions from your records alone:

  1. What was captured? The content itself, in a form that shows it fully and in context.
  2. Where did it come from? The exact URL, not a description such as "his Facebook page".
  3. When was it captured? A precise date and time, with the time zone stated.
  4. Has it changed since? A way to show that the file you produce today is the same file you saved on the day.

Add a fifth question that lawyers and reviewers ask sooner or later: who handled it? That is chain of custody, and it matters most when your work may end up in a dispute, an HR process, a regulatory matter or a courtroom.

The rules on admissibility vary by jurisdiction, and this article is not legal advice. In the United States, for example, electronic evidence still has to be authenticated, and the Federal Rules of Evidence allow certain electronic records to be self-authenticated through a certification that describes how they were collected, including matching hash values. If your work is likely to be used in litigation, talk to the instructing lawyer before you start collecting, not after.

Screenshots versus full-page captures

The quick screenshot is the most common form of web evidence and the weakest. It shows only what fit in the visible window, it usually carries no URL, and it is trivially easy to edit. Keep it as a visual reference, never as the only record.

Full-page captures

A full-page capture records the entire rendered page from top to bottom. Most current browsers can do this without extensions. Firefox offers a "Save full page" option in its built-in screenshot tool. In Chrome and Edge, the developer tools include a "Capture full size screenshot" command. They show the whole context: comments, footers and the sidebar that identifies the account.

Be aware of the limits. Pages that load content as you scroll (infinite feeds, lazy-loaded images) may render only partly. Scroll through the page slowly first so that everything loads, then capture. Check the result before you move on.

Saving the page itself

An image of a page is not the page. Wherever you can, also save the underlying content:

A practical default for most investigations is: a full-page capture as a PNG or PDF, the saved HTML or a SingleFile archive, and the original media files. For high-stakes matters, add a WARC recording.

Recording the URL and access time

Every capture needs a record of where and when. Copy the URL from the address bar, not from a link you clicked or a search result. Redirects and shortened links can change the address. If the page has a canonical or permanent link (many social platforms offer a "copy link" option for individual posts), record that as well.

Record time in UTC, using an unambiguous format such as ISO 8601: 2026-03-14T15:42:10Z. Local time breaks down as soon as reviewers sit in different time zones or daylight saving time changes.

Separate three different times, because people regularly confuse them:

Third-party archives: Wayback Machine and archive.today

Public web archives give you something your own capture cannot: an independent copy, held by someone other than you, with its own timestamp. That independence is valuable when someone later suggests you fabricated or altered a page.

Wayback Machine "Save Page Now"

The Internet Archive's Wayback Machine at web.archive.org lets anyone request an immediate capture through its Save Page Now feature. The resulting archived URL includes a timestamp, and anyone can open it. It is also where to look for earlier versions of a page.

Its limits are worth understanding:

archive.today

archive.today (also reachable at domains such as archive.ph) takes a snapshot of a page and stores both a rendered image and a text version. It sometimes captures pages the Wayback Machine cannot, but it is run by an operator who is not publicly identified, its policies are not documented in the way an institutional archive's are, and it is sometimes unreachable from certain networks. Treat it as a useful secondary copy, not as your primary evidence.

The rule for both services is the same: an archive capture supplements your own preserved copy. It never replaces it.

Hashing: proving the file has not changed

A cryptographic hash is a short fixed-length value calculated from the contents of a file. Change one byte and the hash changes completely, so anyone can recalculate it later and confirm the file is identical. Use SHA-256. Older algorithms such as MD5 and SHA-1 have known weaknesses and should not be your only hash.

You do not need special software. Each major operating system has a built-in way to calculate it:

Hash every file when you save it, and record the value and calculation time in your log. If you first calculate a hash a week after capture, that value describes the file at that later time; it does not establish whether the file changed during the intervening week.

Verify against the recorded baseline: recalculate SHA-256 when checking a stored copy or preparing a transfer, then compare it with the value recorded at capture. A match supports that the bytes match the recorded baseline. A mismatch needs investigation: retain both versions and record the difference rather than replacing the earlier log entry. A hash alone does not establish a capture date.

Technical reference: Microsoft Get-FileHash documentation explains file-content hashing and comparison.

Understand what a hash does not prove. It shows the file is unchanged since hashing. It says nothing about whether the content was genuine when you captured it, whether the page was showing you the same thing it showed everyone else, or whether the person behind the account is who they claim to be. Hashing protects integrity, not truth.

Chain of custody in practice

Chain of custody is a running record of who collected an item, where it has been stored, and every time it has been accessed, copied or transferred. For a solo analyst or a small team, it can be a simple table kept alongside the evidence folder. A useful log entry contains:

Store original captures in a folder that you treat as read-only. Work on copies. When you hand files to a client or a lawyer, give them the hashes too, and note the transfer in the log. If you ever need to redact a capture for a report, keep the unredacted original, hash the redacted version separately and record it as a derived item.

Commercial tools such as Hunchly record pages as you browse and hash them automatically. They save time, but you should still be able to explain what the tool did.

A worked example

Suppose a client asks you to document a series of posts from a public business page that appear to make false claims about a competitor's product. The client expects the posts to be deleted soon.

  1. You open a clean browser profile, not your personal one, and confirm the posts are visible without logging in. You note that in your log, because it affects what any later viewer would see.
  2. For the business page, you scroll to load the relevant posts, then take a full-page capture and save the page with SingleFile. You note the page URL and the time: 2026-05-02T09:14:33Z.
  3. For each of the three posts, you open the individual post link, capture it in full, save the HTML and download the attached image at original size. You record each post's own URL.
  4. You submit each post URL to Save Page Now. Two archive successfully. The third returns only a login prompt, so you record that the archive attempt failed and why.
  5. You hash every saved file and enter the values in your custody log with item IDs, descriptions and method.
  6. Two days later the posts are gone. Your report includes the captures, the archive links for the two that worked, the log, and a short statement explaining how each item was collected. The client's lawyer can verify every file against the recorded hashes.

Notice what you did not do. You did not claim the posts were false; your role was to preserve what was published. You did not contact the page owner or log in to see more than the public could see.

Limits and common mistakes

Ethics and legality

Preserve only what you are authorised to collect and what the task requires. Public visibility does not remove privacy obligations: in many jurisdictions, data protection law still applies to personal data you collect from public pages, and you may need a lawful basis and a retention plan. Do not create accounts under false pretences to reach content you could not otherwise see, do not use someone else's credentials, and do not try to get around access controls. If the matter is sensitive or contentious, agree the scope in writing first. Store evidence securely and delete it when the agreed retention period ends.

Checklist

  1. Confirm scope and authorisation, and ask counsel about format requirements if litigation is possible.
  2. Use a clean browser profile and record whether you were logged in.
  3. Scroll to load all content, then take a full-page capture.
  4. Save the source HTML or a single-file archive, plus original media files.
  5. Record the exact URL from the address bar and the access time in UTC.
  6. Note the platform-reported publication time separately from your access time.
  7. Request an independent capture from the Wayback Machine, and record failures.
  8. Calculate SHA-256 hashes immediately and log them.
  9. Keep originals read-only; work and redact on copies.
  10. Log every transfer, copy and verification in the chain of custody record.

Put the method into practice

Explore the free research tools →