Capture volatile online evidence — with a documented chain of custody.
Profiles, listings and posts vanish the moment the subject notices you. GetProofAnchor turns what you see into a sealed Evidence ZIP and a public proof link with a qualified eIDAS timestamp — anyone can check the result: Match / Modified.
NEWNo time? We capture it for you — from €49 + VAT→
Behind-login capture
Banking dashboards, broker portals, internal admin views — captured exactly as your real browser shows them.
Documented chain of custody
Capture metadata + global hash chain + Bitcoin anchor + eIDAS qualified timestamp — all bundled, all offline-verifiable.
Counsel-ready handoff
Self-contained Evidence ZIP + bilingual README. Forensic expert reproduces the verification independently.
What this is: an evidence-preservation workflow for investigative work — fast field capture (public + behind-login), four-layer cryptographic integrity, EU-qualified timestamp, Bitcoin anchor, and a documented chain of custody ready for handoff to counsel or a forensic expert.
What this is not: an investigative tool that bypasses authentication, a covert capture device, or legal advice. Capture only what you are lawfully entitled to access. Admissibility depends on jurisdiction and circumstances.
Three steps, a few minutes
Investigator workflow
Designed for volatile sources, behind-login views, and clean handoff to counsel or forensic expert.
Capture
Browser extension for behind-login views (banking, broker, internal admin) or socials/marketplaces in your real session. Dashboard for public URLs. Single click; capture is signed and chained automatically.
Seal and export the Evidence ZIP
Self-contained, offline-verifiable bundle: full-page screenshot + captured DOM + extracted text + capture metadata + SHA-256 manifest + hash chain entries + Bitcoin OpenTimestamps receipt + eIDAS qualified-timestamp kit + bilingual verification README.
Share and verify
Send the ZIP to counsel and share the public proof link with the client or expert. Verification is reproducible: Match (intact) or Modified, with a per-layer report.
Works for: marketplace listings, classifieds, scam pages, fake-shop checkouts, dark-pattern flows, OSINT subjects, social profiles, banking & broker dashboards, internal admin, regulator notices, court filings.
What investigators capture with GetProofAnchor
Built for the volatile end of the web — sources that change, vanish, or sanitize themselves the moment they sense scrutiny.
Marketplace listings & classifieds
Bazoš, Marketplace, eBay, Amazon, Vinted, OLX, Sbazar — listings that get edited, taken down, or relisted under a new ID the moment a complaint lands.
Scam pages & fake shops
Phishing portals, fake e-shops, fake-bank login pages, romance-scam profiles — captured before takedown so the trail does not end.
Behind-login dashboards
Banking, broker, escrow, payment-processor, exchange, internal admin — exactly the views the user actually saw, captured from your real session.
OSINT subject preservation
Profiles, posts, comments, group memberships, follower lists — captured at the moment of observation, before the subject sanitizes the trail.
Dark-pattern UI & checkout flows
Pre-checked boxes, hidden auto-renewals, misleading buttons, fake countdowns — preserved as the user actually encountered them, including DOM and capture metadata.
Public records & regulator notices
Court filings, sanctions lists, regulator publications, beneficial-ownership registers, public companies registers — preserved at URL and exact moment of access.
Why this evidence holds up as chain of custody
Field screenshots and ad-hoc PDF print-outs are easy to challenge. GetProofAnchor wraps every capture in four independent integrity layers, each with its own files in the Evidence ZIP, each independently verifiable by a third party. Defeating any single layer doesn't break the others.
Layer 1
SHA-256 file fingerprints
Every captured file in the Evidence ZIP is bound by its SHA-256 hash into the qualified timestamp. Editing a single byte — even reformatting whitespace — fails the integrity check. The report and manifest are generated at download and are not sealed.
Layer 2
Append-only hash chain
Each capture is part of a global SHA-256 chain. Each entry contains the hash of the previous one, so inserting or modifying any past entry breaks the chain mathematically — providing a verifiable sequence of all your work.
Layer 3
Bitcoin anchor (OpenTimestamps)
Each proof's timestamped content is bound into a Merkle tree whose root is anchored to Bitcoin via OpenTimestamps. The ZIP includes the inclusion proof, so anyone can check offline that the anchor covers exactly this proof — independent of GetProofAnchor and of any platform involved in the case.
Layer 4
Qualified eIDAS timestamp
RFC 3161 timestamp from an EU qualified trust service provider. Under eIDAS Art. 41(2) it carries a legal presumption of the accuracy of its time and the integrity of the sealed data.
All four layers pass → the chain of custody is cryptographically intact, not just credible. Any layer FAILS → modification is detected, with a per-layer report showing exactly which one was tampered with — turning a vague tampering accusation into a deterministic technical question.
Why field screenshots aren't enough anymore
Investigative work increasingly hinges on volatile online sources — marketplace listings, scam pages, behind-login dashboards, OSINT subjects who sanitize trails the moment they sense surveillance. A screenshot is a single point of trust: yours. Without an integrity mechanism and an independent time anchor, the opposing side can argue it was edited, taken at a different time, or fabricated. A four-layer cryptographic chain replaces credibility with verifiability.
Cryptographic integrity verification
Evidence ZIP includes a SHA-256 manifest of every file. Subsequent edits — text, screenshot pixels, file replacement, even JSON whitespace reformatting — become mathematically detectable. The chain of custody does not depend on your sworn statement.
Independent time anchors
Each proof gets two independent time anchors: an eIDAS qualified timestamp (with legal weight in the EU) and a Bitcoin OpenTimestamps anchor (preserved by the Bitcoin network). Backdating, both accusing and defending, becomes a cryptographic fact-check rather than a credibility contest.
What's inside the Evidence ZIP
A standardized, self-contained bundle of around 24 files (format: getproofanchor-evidence-1). Designed to live in a case file, be sent to counsel or a forensic expert, attached to a regulatory complaint, or referenced in a sworn report — and to verify independently of GetProofAnchor.
manifest.jsonthe integrity baseline — SHA-256 hash of every other file in the packageproof.jsonmain record — source URL, final URL, capture time, SHA-256 fingerprints, eIDAS status, Bitcoin anchor infoscreenshot.pngfull-page screenshot at capture time (the visible state of the page as you saw it in the field)page.html + content.txtcaptured DOM/HTML and extracted plain-text content — the underlying source for behind-the-pixels analysiscapture/capture_meta.jsonforensic capture metadata — engine, viewport, scroll, consent dialogs auto-handled — the chain-of-custody backbonechain/*append-only hash chain entries linking this proof to the global chain of all capturesanchor/anchor_receipt.otsbinary OpenTimestamps receipt with the Bitcoin merkle path — verifiable against any Bitcoin nodetimestamp/*complete eIDAS qualified-timestamp kit — RFC 3161 token, TSA certificate chain, frozen EU Trusted List snapshot, verification reportreport.pdfhuman-readable Evidence Report PDF — formatted summary suitable for the case file or sworn submissionREADME.mdbilingual (EN + CS) verification guide with copy-paste commands using python3, openssl, ots — counsel or expert reproduces the verification independently
Verification result: Match / Modified.
For a file-by-file walkthrough see the Evidence ZIP — every file inside tutorial.
eIDAS qualified timestamp — what it adds to chain of custody
Every GetProofAnchor proof gets an RFC 3161 timestamp from a qualified trust service provider on the EU trusted list. It is not a marketing label — it has a specific legal meaning under Regulation (EU) 910/2014 (eIDAS): it carries a legal presumption that its time is accurate and the sealed data are intact, recognised in all EU member states.
Qualified provider
The timestamp comes from a qualified trust service provider listed on the EU trusted list.
Legal presumption
Under eIDAS Art. 41(2) the date, time and integrity of the timestamped data are presumed correct unless proven otherwise. You don’t have to rely on GetProofAnchor’s word.
Verifiable offline
The certificate chain and a copy of the trusted list are inside the ZIP, so the timestamp can be checked without internet and without us — also after the timestamp certificate has expired.
Together with the Bitcoin anchor you get two independent time anchors — one with legal weight in the EU, one public and global — for the same evidence.
Common questions from investigators
Straight answers to the questions we hear most.
How fast can I capture in the field?
The browser extension captures in seconds — it's a single click on the page you're already looking at. The dashboard captures public URLs in roughly 30–60 seconds depending on the page. The Evidence ZIP, including the eIDAS qualified timestamp and Bitcoin anchor, is generated automatically and ready to download or hand off shortly after. Speed matters for volatile sources like classified ads, scam pages, and rapidly changing profiles — capture early, capture often.
Can I capture content behind login (banking dashboards, broker portals, internal admin)?
Yes — that is the primary investigator workflow. Available on every paid plan, including the 9 € Starter Pack, the Chrome extension captures exactly what your real browser is showing, including content that requires login, 2FA, paid subscription, or a specific session. Public URLs can also be captured server-side via the dashboard. Cookies, passwords, and browsing history never leave your machine — only the captured page artifacts are uploaded.
Does this provide chain of custody?
Yes — chain of custody is a core design goal. Every Evidence ZIP includes (1) capture metadata (engine, viewport, scroll, automatically handled consent dialogs), (2) the global append-only hash chain entries linking the proof to all preceding captures, (3) a Bitcoin OpenTimestamps receipt independent of GetProofAnchor, and (4) an eIDAS qualified timestamp from an EU-qualified TSA. A forensic expert can independently verify the entire stack offline. The bilingual README documents each step. The chain is mathematical — there is no signed affidavit to attack.
Can I hand the Evidence ZIP directly to counsel or a forensic expert?
Yes — that is exactly the intended handoff. The Evidence ZIP is a self-contained, offline-verifiable bundle of around 24 files (format: getproofanchor-evidence-1) plus a bilingual EN+CS verification README. No GetProofAnchor account, no service dependency, no internet connection needed for the integrity check (Bitcoin verification is the only optional online step). Counsel attaches the ZIP to the case file; the forensic expert runs the verification using python3, openssl, and ots — independently of GetProofAnchor.
What about OSINT subject pages, dark-pattern checkout flows, or rapidly changing scam sites?
These are exactly the volatile sources the workflow is built around. Marketplace listings get edited, scam pages disappear under takedown pressure, dark-pattern UIs change between sessions, and OSINT subjects clean up profiles the moment they sense surveillance. Capture at the moment of observation. The eIDAS qualified timestamp and Bitcoin anchor independently fix the “when”; the four-layer integrity stack independently fixes the “what”. Subsequent edits to the live page do not affect your captured evidence.
Will the Evidence ZIP still verify if my client is in a different country, or years later?
The package is designed for long-term offline verification. The TSA certificate chain and a snapshot of the trusted list that lists the TSA are bundled inside the Evidence ZIP at capture time, so the qualified timestamp can be checked without an internet connection and without us — also after the TSA's certificate has expired. The Bitcoin anchor is an additional, independent layer. The hash manifest is verifiable with standard SHA-256 tooling. Keep the original ZIP: it is the evidence.
Further reading
Deeper reading for investigators, counsel, and forensic experts on the receiving end of the Evidence ZIP:
How it works
How GetProofAnchor works — capture, sealing, Evidence ZIP, verification
Open →Getting started
How to create a proof — from a URL or with the browser extension
Open →Reference
Evidence ZIP — every file inside, verifiable offline
Open →Verification
How to verify evidence — proof link or ZIP, online and offline
Open →Assisted Capture
Don't want to do it yourself?
Send us the URL and our team creates the forensic capture for you — full Evidence ZIP with eIDAS qualified timestamp, delivered to your inbox. From €49 per capture.
Capture it before the subject deletes it
Volatile online evidence with cryptographic chain of custody, EU-qualified timestamp, and a Bitcoin anchor. Counsel-ready, forensic-grade, offline-verifiable.