Defensible web capture: the 10-point checklist

What "defensible" actually means

A web capture is defensible when someone who was not present can check what was captured, when, from where and by what method, and can see that nothing changed afterwards. It is not about how official the file looks. Opposing counsel will rarely argue that a page never existed; they will argue that your copy is incomplete, edited, taken out of context or impossible to date. Defensibility means having an answer to each of those objections before it is raised.

In the United States, Federal Rule of Evidence 901 requires evidence sufficient to support a finding that an item is what its proponent claims it is. European procedural rules differ from country to country, but the practical question is the same everywhere: how much effort does the other side need to cast doubt on your capture, and how quickly can you answer?

Common capture methods and where they break

Most disputes still start with one of the following methods. Each has its place, and each has a known weak point.

• Screenshot: fast and universal, but it carries no reliable date, does not prove the source URL, can be edited in seconds and shows only the visible part of the page.
• Print to PDF: keeps more text, but the browser may drop dynamic content, and the file date comes from the user's own computer clock.
• Web archive snapshots: independent and useful for public pages, but they cannot reach content behind a login, coverage is irregular, and you do not control when a page is archived.
• Notarial record: strong formal weight in many civil-law countries, but slow, priced per page and limited to what the notary can see and describe at that moment.
• Forensic capture tools and services: built for the job, but only as good as their documentation. Ask what is hashed, who issues the timestamp and how a third party can verify the result.

In practice, teams often combine methods: a quick screenshot as a working note, a documented capture as the actual evidence, and an archive snapshot as an independent cross-check. What matters is that the piece you submit can stand on its own. If the only copy of a key post is a screenshot taken on someone's phone, check whether the content is still online today. If it is, capture it properly now instead of defending the screenshot later, when the original may already be gone and nobody can say what it looked like.

The 10-point checklist

Run through this list before you rely on any web capture in a letter before action, a complaint, a takedown notice or an expert report.

• Record the full URL, including parameters, and the date and time of capture in UTC.
• Capture the whole page, not only the visible screen, plus the subpages that give it context.
• Keep the original source files, for example HTML or MHTML, next to the visual rendering.
• Compute a cryptographic hash such as SHA-256 of every file immediately after capture.
• Bind the hashes to a trusted time from an independent source, not the computer clock.
• Document the environment: browser, operating system, network location and whether you were logged in.
• Write down every intervention, such as closing a cookie banner or expanding comments.
• Remove session tokens and personal data that the case does not need.
• Store the package unchanged and log every hand-over, as you would for physical evidence.
• Make sure a third party can verify the package without having to trust you or your vendor.

Logged-in and interactive content

Much of the content that matters in practice sits behind a login: a private Facebook group, a LinkedIn message, a marketplace chat, a customer portal. Archive services cannot reach it, and a notary may not have access to the account. The capture therefore has to be made from the account holder's own session, which raises two questions the other side will ask: was the session genuine, and was anything altered on screen?

The answer is documentation. A capture of a logged-in page should record that it was made in an authenticated session, show the account context and keep a log of what the operator did in the page. Session cookies and access tokens should not end up in the evidence package: they could be misused and add nothing to the proof.

Time and integrity: hashes and timestamps

A hash proves that a file has not changed since the hash was computed. A timestamp proves when that hash existed. Together they answer the two most common objections. Under the eIDAS Regulation, a qualified electronic time stamp issued by a qualified trust service provider enjoys a presumption of the accuracy of the date and time it indicates and of the integrity of the data to which it is bound. The usual technical protocol behind such timestamps is RFC 3161.

A second, independent anchor can be added by recording the hash in the Bitcoin blockchain through OpenTimestamps. It does not replace a qualified timestamp, but it gives an extra proof of existence that does not depend on any single company staying in business.

Documentation the other side will ask for

ISO/IEC 27037 sets out guidelines for the identification, collection, acquisition and preservation of digital evidence. Even where nobody formally requires it, its logic is what experts and opposing counsel use to test a capture. Be ready to show:

• who made the capture, and with which tool and version,
• a step-by-step description of the acquisition, including any interventions,
• hash values and timestamp tokens for every file,
• a chain of custody from capture to submission.

Do it yourself or delegate?

If you capture web content regularly, a self-service tool pays off: the method stays consistent and every capture comes with the same documentation. If the need is urgent and one-off, or the person with access to the account is not technical, handing the job to a specialist who follows a written methodology is often safer than improvising.

GetProofAnchor offers both routes. The web platform and Chrome extension seal captures with a qualified eIDAS timestamp from SK ID Solutions, an SHA-256 hash chain and OpenTimestamps anchoring; the open-source gpa-verify tool checks the Evidence ZIP offline. The Forensic Browser for Windows captures several subpages into one package and can also deliver it as a PAdES PDF that validates in Adobe Reader. Assisted Capture handles urgent cases for you: a single URL for 49 EUR within 90 minutes, or Rush with a guaranteed 60 minutes. None of this guarantees that a court will accept the evidence. It makes the capture easier to explain and harder to attack.

FAQ

Sources

• Regulation (EU) No 910/2014 (eIDAS), Article 41 – qualified electronic time stamps
• ISO/IEC 27037:2012 – Guidelines for identification, collection, acquisition and preservation of digital evidence
• RFC 3161 – Internet X.509 PKI Time-Stamp Protocol (TSP)
• US Federal Rules of Evidence, Rule 901 – Authenticating or identifying evidence
• OpenTimestamps – timestamp proofs anchored in Bitcoin