Evidence behind a login: how to capture private groups, profiles and portals

Why private content is a different evidence problem

A public web page can be checked by anyone: the other side, the judge or an expert can open the URL, look at an archive or capture it again. Content behind a login cannot. A defamatory post in a closed Facebook group, a message on a private profile, a price in a supplier portal or a thread in a members-only forum is visible only to people with access, and the group admin or the author can delete it in seconds.

That makes your record the only record. If it is a screenshot, the other side only has to say it was edited, cropped or taken out of context, and there is nothing independent to compare it with. The more private the content, the more the quality of your capture decides whether it is usable at all.

First rule: capture only what you are entitled to see

Capturing content you can legitimately see as a member or as the account holder is ordinary evidence collection. Getting access you do not have is not. Under Directive 2013/40/EU, EU member states must criminalise intentional access to an information system without right, at least where a security measure is infringed, and national laws go further.

• Use your own account and access you already have, as a member, customer or recipient.
• Do not create fake profiles, borrow someone's password or ask a third party to log in for you.
• Do not bypass a paywall, a privacy setting or a technical restriction to reach the content.
• Capture what is relevant to your case, and avoid harvesting other members' personal data you do not need.

Whether private content can be used in proceedings depends on national law and on the case, for example in employment or family matters. If in doubt, capture now, because the content may disappear, and ask a lawyer before you file it. The data protection principle of data minimisation in Article 5(1)(c) GDPR is a good guide for what to keep.

What a defensible capture of a logged-in page contains

The Council of Europe Guidelines on electronic evidence stress integrity, metadata and a description of how the evidence was collected. For private content, capture the context that proves where it was and who could see it:

• The full post or thread, with author, date as shown, and replies expanded, not just the one line that hurts.
• The name of the group, page or portal and its visibility setting (closed, private, members only) and member count if shown.
• The navigation path: group page, then post, so it is clear the content sits where you say it does.
• The full page source (HTML) and a network record, not only pixels.
• The account you used, so you can explain how you had access.
• A reliable date and time of the capture, sealed so that later edits are detectable.
• A short note of who captured what, when and with which tool; it will become your witness statement if the capture is challenged.

Why a server capture cannot do it

A server-side capture is retrieved by our infrastructure from the public internet. That is its strength for public pages: it shows what the page served to an outside visitor, independently of your device. It is also why it cannot see what is behind your login. Our server capture refuses login-walled pages and recommends the browser extension instead.

For private content the capture therefore has to happen inside a session that has access: your own browser, a dedicated forensic browser, or an operator's account that can see the content. Each option has a different level of assurance, which you should state honestly.

Option 1: the browser extension, for a single post now

The GetProofAnchor browser extension captures the page in your own browser, including logged-in pages, and uploads it. The server seals it on receipt with an eIDAS qualified timestamp.

• Available on every paid plan, including the 9 EUR pack (10.89 EUR incl. VAT) with 3 proofs.
• Cookie values, authorisation headers and session tokens are masked in the stored files; the visible page text is not changed.
• Captures from the extension are private by default; the evidence ZIP downloads to your computer once the timestamp is in.
• Honest limit: the page is captured on your device and sealed on receipt. The timestamp proves the time of receipt and that nothing changed since, not that an independent party observed the content.

Good for: one urgent post in a closed group, a private message thread you are part of, or a portal page you need today.

Option 2: Forensic Browser, for whole threads and repeated work

Forensic Browser is a Windows desktop application. You browse normally, logged in as yourself, and capture with one click; a whole session of many pages goes into one sealed package with one qualified timestamp.

• Group page, post, comments and the author's profile in one package, with screenshots, complete HTML, HAR, DNS and TLS records.
• Video and audio from social networks: the platform's original file where it is served, otherwise a labelled playback recording.
• Documented methodology in the report: browser, operating system, viewport and any interventions.
• Output as a PDF with an embedded timestamp that validates in Adobe Acrobat Reader, or a ZIP for experts.

Good for: lawyers, investigators and HR teams who regularly document private groups or portals. Licences from 290 EUR per year excl. VAT (350.90 EUR incl. VAT), 200 proofs a year.

Option 3: Assisted Capture, when you want it done for you

With Assisted Capture you send us the URLs and an operator captures them manually. For content visible only to logged-in users, the operator works from our own accounts, so it fits a closed group or members area that our operator's account can actually see.

• Single URL 49 EUR excl. VAT (59.29 EUR incl. VAT), delivered within 90 minutes of payment.
• Rush, up to 5 URLs, 249 EUR excl. VAT (301.29 EUR incl. VAT), with a guaranteed 60 minutes; if we miss it, 50 % is refunded.
• Videos on social networks are preserved with sound as well.

Limit: an operator cannot see what only your account can see, such as your private messages or a group that will not admit us. For that, use the extension or Forensic Browser in your own account. If a URL cannot be captured, you get a full refund.

After the capture: keep it clean

• Do not reply, react or join arguments in the group before you have captured; your own activity becomes part of the record.
• Keep the original evidence package untouched; work with copies.
• Check it yourself: the package can be verified offline with the open-source gpa-verify or uploaded at getproofanchor.com/verify.
• Report the content to the platform only after capturing it; reports often lead to removal.
• Give your lawyer the package plus your note on how you had access.

No capture method guarantees how a court will weigh evidence. A sealed, documented capture with its context makes it much harder to dismiss as a doctored screenshot. Under Article 41(2) eIDAS a qualified timestamp is presumed accurate as to its date and time and the integrity of the data it covers, and Article 41(3) requires its recognition across the EU; the presumption covers time and integrity, not the truth of what the post says.

FAQ

Sources

• Directive 2013/40/EU on attacks against information systems, Article 3 (illegal access)
• Regulation (EU) 2016/679 (GDPR), Article 5(1)(c) data minimisation
• Council of Europe: Guidelines on electronic evidence in civil and administrative proceedings
• Regulation (EU) No 910/2014 (eIDAS), Article 41