Digital Evidence

What Makes Web Evidence Defensible in Court?

June 10, 2026 · 7 min read

Anyone can take a screenshot. But when opposing counsel asks "how do we know this screenshot hasn't been edited?" — most investigators have no good answer.

Defensible web capture is a specific subset of digital evidence collection. It goes beyond pressing Print Screen and into the domain of forensic integrity: proving that what you captured is authentic, unaltered, and correctly dated.

The Five Properties of Defensible Web Evidence

Courts and legal professionals increasingly look for these properties when evaluating digital evidence:

1. Cryptographic hash at capture time

A SHA-256 hash is a 64-character fingerprint of an image file. It's computed from the raw pixel data — if even a single pixel changes, the hash changes completely.

When a screenshot is captured with its SHA-256 hash recorded, you can prove later that the image file in your possession is the exact file that was captured. This is the foundational property of tamper-evident evidence.

2. Precise, independently verifiable timestamp

The timestamp in your screenshot filename is not enough. A forensically sound timestamp is:

• Recorded in ISO 8601 format (e.g., 2026-06-10T14:32:07.814Z)
• Generated by the capture tool, not the OS file system (which can be manipulated)
• Embedded in the evidence report alongside the hash

3. Unbroken chain of custody

A chain of custody documents who had access to the evidence, when, and in what form. For web evidence, this means:

• A log of every page visited during an investigation session
• Timestamps for each page visit, not just captures
• Evidence that the investigator (not a third party) captured the material directly

WebInvestigator's automatic timeline builds this log without any manual steps.

4. Capture of the full page, not just visible content

Many screenshots only capture what's visible on screen. For social media posts, forum threads, or long articles, you need scroll capture — a composite image of the full page content from top to bottom. Without it, you may miss content that appears below the fold, and your evidence may be challenged as incomplete.

5. An exportable, self-contained report

A folder of screenshots is not a usable evidence package. A defensible evidence report is a single document containing:

• All captured images with their hashes
• All URLs with timestamps
• The complete timeline of the investigation session
• Notes and annotations added during capture

Why most tools fail this test

Browser screenshot extensions typically capture an image and nothing else. They have no concept of hashing, chain of custody, or investigation sessions. Even professional tools like Snagit or Lightshot produce files with no tamper-evident properties.

Purpose-built tools for preserving online evidence for court are designed around these five properties from the ground up.