Capture volatile online evidence — with a defensible chain of custody.
Listings get edited, profiles get cleaned, scam pages vanish, dashboards change between sessions. GetProofAnchor lets you preserve what you saw — including content behind login — as a portable Evidence ZIP and shareable Proof ID, anchored in four independent integrity layers — ready to hand to counsel or a forensic expert with a deterministic verifier outcome: Match / Modified.
Banking dashboards, broker portals, internal admin views — captured exactly as your real browser shows them.
Capture metadata + global hash chain + Bitcoin anchor + eIDAS qualified timestamp — all bundled, all offline-verifiable.
Self-contained Evidence ZIP + bilingual README. Forensic expert reproduces the verification independently.
What this is: an evidence-preservation workflow for investigative work — fast field capture (public + behind-login), four-layer cryptographic integrity, EU-qualified timestamp, Bitcoin anchor, and a documented chain of custody ready for handoff to counsel or a forensic expert.
What this is not: an investigative tool that bypasses authentication, a covert capture device, or legal advice. Capture only what you are lawfully entitled to access. Admissibility depends on jurisdiction and circumstances.
Designed for volatile sources, behind-login views, and clean handoff to counsel or forensic expert.
Browser extension for behind-login views (banking, broker, internal admin) or socials/marketplaces in your real session. Dashboard for public URLs. Single click; capture is signed and chained automatically.
Self-contained, offline-verifiable bundle: full-page screenshot + captured DOM + extracted text + capture metadata + SHA-256 manifest + hash chain entries + Bitcoin OpenTimestamps receipt + eIDAS qualified-timestamp kit + bilingual verification README.
Send the ZIP to counsel; share the Proof ID URL with the client or expert. Verification is deterministic and reproducible: Match (intact) or Modified (per-layer report). Fully offline if needed.
What investigators capture with GetProofAnchor
Built for the volatile end of the web — sources that change, vanish, or sanitize themselves the moment they sense scrutiny.
Bazoš, Marketplace, eBay, Amazon, Vinted, OLX, Sbazar — listings that get edited, taken down, or relisted under a new ID the moment a complaint lands.
Phishing portals, fake e-shops, fake-bank login pages, romance-scam profiles — captured before takedown so the trail does not end.
Banking, broker, escrow, payment-processor, exchange, internal admin — exactly the views the user actually saw, captured from your real session.
Profiles, posts, comments, group memberships, follower lists — captured at the moment of observation, before the subject sanitizes the trail.
Pre-checked boxes, hidden auto-renewals, misleading buttons, fake countdowns — preserved as the user actually encountered them, including DOM and capture metadata.
Court filings, sanctions lists, regulator publications, beneficial-ownership registers, public companies registers — preserved at URL and exact moment of access.
Why this evidence holds up as chain of custody
Field screenshots and ad-hoc PDF print-outs do not survive a determined challenge. GetProofAnchor wraps every capture in four independent integrity layers, each with its own files in the Evidence ZIP, each independently verifiable by a third party. Defeating any single layer doesn't break the others.
Every file in the Evidence ZIP has its hash recorded in manifest.json. Editing a single byte — even reformatting whitespace — fails the integrity check.
Each capture is part of a global SHA-256 chain. Each entry contains the hash of the previous one, so inserting or modifying any past entry breaks the chain mathematically — providing a verifiable sequence of all your work.
The chain head is anchored to the Bitcoin blockchain. Once confirmed, the timestamp is preserved by the entire Bitcoin network — independent of GetProofAnchor and of any platform involved in the case.
RFC 3161 timestamp from an EU-qualified Trust Service Provider (currently SK ID Solutions, Estonia). Recognized as legal-grade proof of existence at a point in time under Regulation (EU) 910/2014.
All four layers PASS → the chain of custody is cryptographically intact, not just credible. Any layer FAILS → modification is detected, with a per-layer report showing exactly which one was tampered with — turning a vague tampering accusation into a deterministic technical question.
Why field screenshots aren't enough anymore
Investigative work increasingly hinges on volatile online sources — marketplace listings, scam pages, behind-login dashboards, OSINT subjects who sanitize trails the moment they sense surveillance. A screenshot is a single point of trust: yours. Without an integrity mechanism and an independent time anchor, the opposing side can argue it was edited, taken at a different time, or fabricated. A four-layer cryptographic chain replaces credibility with verifiability.
Evidence ZIP includes a SHA-256 manifest of every file. Subsequent edits — text, screenshot pixels, file replacement, even JSON whitespace reformatting — become mathematically detectable. The chain of custody does not depend on your sworn statement.
Each proof gets two independent time anchors: an eIDAS qualified timestamp (legally recognized in EU/EEA) and a Bitcoin OpenTimestamps anchor (preserved by the Bitcoin network). Backdating, both accusing and defending, becomes a cryptographic fact-check rather than a credibility contest.
A standardized, self-contained bundle of around 24 files (format: getproofanchor-evidence-1). Designed to live in a case file, be sent to counsel or a forensic expert, attached to a regulatory complaint, or referenced in a sworn report — and to verify independently of GetProofAnchor.
- manifest.json — the integrity baseline — SHA-256 hash of every other file in the package
- proof.json — main record — Proof ID, source URL, final URL, capture time, SHA-256 fingerprints, eIDAS status, Bitcoin anchor info
- screenshot.png — full-page screenshot at capture time (the visible state of the page as you saw it in the field)
- page.html + content.txt — captured DOM/HTML and extracted plain-text content — the underlying source for behind-the-pixels analysis
- capture/capture_meta.json — forensic capture metadata — engine, viewport, scroll, consent dialogs auto-handled — the chain-of-custody backbone
- chain/* — append-only hash chain entries linking this proof to the global chain of all captures
- anchor/anchor_receipt.ots — binary OpenTimestamps receipt with the Bitcoin merkle path — verifiable against any Bitcoin node
- timestamp/* — complete eIDAS qualified-timestamp kit — RFC 3161 token, TSA certificate chain, frozen EU Trusted List snapshot, verification report
- report.pdf — human-readable Evidence Report PDF — formatted summary suitable for the case file or sworn submission
- README.md — bilingual (EN + CS) verification guide with copy-paste commands using python3, openssl, ots — counsel or expert reproduces the verification independently
For a file-by-file walkthrough see the Evidence ZIP — every file inside tutorial.
eIDAS qualified timestamp — what it adds to chain of custody
Every GetProofAnchor proof receives an RFC 3161 timestamp from an EU-qualified Trust Service Provider. This is not a marketing label — it has specific legal meaning under Regulation (EU) 910/2014 (eIDAS) and gives the chain of custody a defensible time anchor in the EU and EEA, recognized independently of you, your firm, and GetProofAnchor.
Currently SK ID Solutions AS (Estonia), listed on the EU Trusted List as a Qualified Trust Service Provider.
Recognized in EU/EEA courts and regulatory proceedings as proof of existence at the timestamped moment, with no need for the court to trust the investigator, the firm, or GetProofAnchor.
The full TSA certificate chain and a frozen snapshot of the EU Trusted List are inside the ZIP — verification works offline, even years after the case closes, even if the TSA later ceases operation.
Common questions from investigators
Direct answers to the questions we hear most often. Tap to expand.
How fast can I capture in the field?
Can I capture content behind login (banking dashboards, broker portals, internal admin)?
Does this provide chain of custody?
Can I hand the Evidence ZIP directly to counsel or a forensic expert?
What about OSINT subject pages, dark-pattern checkout flows, or rapidly changing scam sites?
Will the Evidence ZIP still verify if my client is in a different country, or years later?
Reference material
Deeper reading for investigators, counsel, and forensic experts on the receiving end of the Evidence ZIP:
How GetProofAnchor works — capture, trust stack, Evidence ZIP, verification
How to create a proof from a URL — Dashboard + Browser Widget
Evidence ZIP — every file inside, offline-verifiable
How to verify evidence — Proof ID, ZIP, online & offline
Capture before the trail goes cold
Volatile online evidence with cryptographic chain of custody, EU-qualified timestamp, and a Bitcoin anchor. Counsel-ready, forensic-grade, offline-verifiable.