Web Evidence Capture Software: 10 Questions Before You Buy

Start with the job, not the feature list

Before you compare vendors, write down what you actually need to capture. The right tool for a one-off urgent case is rarely the right tool for an investigations team that captures every day. Four typical jobs:

A single urgent page: a defamatory post, a scam listing or a competitor's claim that may vanish within hours.
Repeated captures for one matter: product pages, profiles or listings collected over weeks.
Logged-in or interactive content: closed groups, marketplace accounts, content behind a paywall.
Change over time: terms, prices or statements that need to be recorded on a schedule.

Keep that list next to you. The ten questions below show how a tool handles each job and where its evidence is weakest. They apply to every vendor on your shortlist, from established names such as Page Vault, Pagefreezer or WebPreserver to newer EU tools, including ours.

1. Who performs the capture, and does the record say so?

There are three models. A server capture is performed by the vendor's infrastructure, not by your device. A browser extension or a forensic desktop browser records what your own browser shows. An assisted service has an operator capture the page for you. All three are legitimate, but they prove different things.

Ask the vendor to state plainly what the seal proves for each model. For a capture made on your own device and then uploaded, the honest answer is: the package was sealed on receipt, and the seal proves its integrity and the time of receipt, not that an independent party observed the content. If a vendor claims more, ask how.

2. What exactly is captured?

A screenshot or a PDF is a picture of the page. Disputes are usually decided by the context around it. A strong package contains several independent artefacts, each with its own hash:

a full-page screenshot and the raw HTML
an MHTML snapshot or a comparable archive of the rendered page
a HAR file with the network traffic, with cookie values and tokens masked
a video of the page loading and scrolling
the TLS certificate chain and DNS results for the domain
capture metadata: URL, time, browser, viewport and settings

Ask for a sample package and open it. If all you get is an image and a PDF, the other side only has to attack one file.

3. How is integrity sealed, and by whom?

Hashes prove nothing on their own unless they are fixed in time by someone other than the person who holds the files. In the EU the standard instrument for this is a qualified electronic timestamp under the eIDAS Regulation, issued by a qualified trust service provider on the EU trusted lists. Under Article 41(2) it enjoys the presumption of the accuracy of the date and time it indicates and of the integrity of the data to which they are bound. Under Article 41(3) a qualified timestamp issued in one member state is recognised as qualified in all member states.

Note what the presumption covers: time and integrity, not the truth of what the page says. Ask which provider issues the timestamp, whether it meets the requirements of Article 42 for a qualified timestamp, and whether it covers every artefact or only a report. Blockchain anchoring can be a useful additional layer, but on its own it is not a qualified timestamp.

4. Can anyone verify it without the vendor?

Evidence that can only be checked on the vendor's own website depends on the vendor still being around, and on the court trusting it. Ask for:

an independent verification tool, ideally open source, that works offline
the timestamp token and certificate chain inside the package
a snapshot of the relevant trusted list, so a verifier can check the provider's status without trusting the vendor

Then test it: change one byte in a sealed file and check that verification fails.

5. Are capture interventions disclosed?

Real pages fight back: cookie banners, sticky headers, pop-ups, lazy-loaded images. Every tool has to intervene somehow, by clicking a consent button, hiding an overlay or scrolling. That is acceptable as long as it is recorded. Ask whether every intervention ends up in the sealed metadata and in the report, and whether any third-party service, for example an AI model, sees the page during capture. ISO/IEC 27037 gives general guidance on identifying, collecting, acquiring and preserving digital evidence; a vendor should be able to describe its methodology with reference to it, without claiming certification it does not have.

6. Multi-page sessions and logged-in content

Many cases are not one URL. A counterfeit seller has a storefront, ten listings and a checkout. A harassment case spans a profile, posts and comments. Ask whether the tool can capture a whole browsing session into one sealed package, and how it handles content behind a login.

A server capture usually cannot log in as you, and it should not. For logged-in pages you need a browser-based capture or an operator using their own account, and the record should state which one was used.

7. Output formats your reader can actually open

A judge, a prosecutor or opposing counsel will not install your vendor's software. A PDF with an embedded qualified timestamp in the PAdES format (ETSI EN 319 142) can be validated in Adobe Acrobat Reader. A ZIP package with a hash manifest suits technical experts who want every raw file.

Ask whether you get both, what exactly the PDF seals, and whether long-term validation data is embedded so the timestamp can still be checked after the provider's certificate expires.

8. Pricing model versus your real volume

The price per capture varies more than headline prices suggest. Model your real year:

per-capture prices or credit packs suit occasional cases
monthly plans suit teams with a steady volume
annual desktop licences suit heavy, repeated work

Check what counts as one capture (one page, one session or one package), whether the qualified timestamp is included in every capture or sold as an add-on, and what happens to your packages if you cancel.

9. Data protection and retention

Captures often contain personal data. Ask where captures are processed and stored, which sub-processors are involved, whether you can switch off any third-party processing, how long packages are kept and how you export them. Keep your own copy of every package: your evidence should not live only in someone else's account.

10. Can you test a real sample first?

The fastest test of any vendor is a sample of a URL you choose. Open the package, verify it offline and read the report the way the other side's expert would. A vendor that is confident in its evidence will let you do that before you pay.

Where GetProofAnchor fits, honestly

We built GetProofAnchor around these questions, so here is the plain mapping. Every paid proof is sealed with a qualified eIDAS timestamp from SK ID Solutions, an EU qualified trust service provider, and can be verified offline with the open-source gpa-verify. Three ways to use it:

Forensic Browser (Windows desktop app): browse normally and capture a whole session, including logged-in pages, into one sealed package, either a PDF with an embedded qualified timestamp that validates in Adobe Acrobat Reader or a ZIP for experts. Annual licence from 290 € excl. VAT (350.90 € incl. 21 % VAT).
Web app: server capture by URL with screenshot, HTML, MHTML, HAR, video, TLS and DNS in one Evidence ZIP, plus a browser extension for logged-in pages. From 9 € excl. VAT for 3 proofs (10.89 € incl. VAT) or 19 € per month excl. VAT (22.99 € incl. VAT).
Assisted Capture: send us the URLs and an operator captures them for you, from 49 € excl. VAT (59.29 € incl. VAT) with delivery within 90 minutes, or Rush with a guaranteed 60 minutes for 249 € excl. VAT (301.29 € incl. VAT).

No tool can guarantee that a court will accept evidence; that is for the court to decide. What a tool can do is make the evidence hard to attack. If you want to check that yourself, ask us for a free sample proof of a URL of your choice.

Frequently asked questions

Is a screenshot tool with a timestamp enough?

It depends on what the timestamp is and what it covers. A timestamp from the tool's own server proves little to a third party. A qualified eIDAS timestamp bound to the hashes of all captured files gives a legal presumption of the accuracy of the time and of the integrity of the data under Article 41(2) eIDAS, but not of the truth of the content.

Do courts require a qualified timestamp for web evidence?

No EU rule makes it mandatory, and courts assess evidence under national procedural law. A qualified timestamp shifts the burden: whoever disputes the time or integrity has to rebut the presumption. Without it, you may have to prove those points yourself.

Server capture or browser capture: which is better?

Server capture is independent of your device and suits public pages. Browser-based capture is needed for logged-in content, but it records what your own browser showed. Many teams use both, and the record should always state which method was used.

What should a vendor's sample package contain?

Raw files you can open without the vendor's account, a manifest of hashes, the timestamp token and a report that explains the methodology and lists every intervention. You should be able to verify it offline.

What does a defensible capture cost?

From a few euros per page for occasional cases to an annual licence for teams. At GetProofAnchor: 9 € excl. VAT for 3 proofs, monthly plans from 19 € excl. VAT, Forensic Browser from 290 € excl. VAT per year and Assisted Capture from 49 € excl. VAT; consumers pay 21 % VAT on top.

Sources

For lawyers and legal teams

Evidence the other side can’t easily dismiss

Forensic web capture with an eIDAS qualified timestamp, Bitcoin anchor and an offline-verifiable Evidence ZIP — aligned with ISO/IEC 27037. File it as a data package and a PDF report.

Solutions for lawyers Urgent? Rush capture in 60 min

Compare with notary and Wayback →

Related guides

See the evidence before you choose

Ask for a free sample proof of a URL of your choice, or start with 3 proofs for 9 € excl. VAT (10.89 € incl. VAT).

Create a proof Verify a proof

Qualified eIDAS timestamp on every paid proof. Offline verification with the open-source gpa-verify.

Web evidence capture software: 10 questions to ask before you buy