Legal & Evidence

Preserving Online Evidence for Court: A Practical Guide

June 10, 2026 · 9 min read

Online evidence disappears faster than most lawyers expect. Websites are edited, social media posts are deleted, and servers are wiped — often within hours of a legal dispute being raised. Preserving that evidence correctly, before it vanishes and in a form that will be accepted by a court, is one of the most time-sensitive challenges in modern litigation.

This guide covers what online evidence is, what makes it admissible, and the step-by-step process for capturing and preserving it.

What counts as online evidence?

Online evidence includes any digital content accessible via a web browser that is relevant to legal proceedings:

• Social media posts, comments, and profiles (Facebook, Instagram, X/Twitter, LinkedIn, TikTok)
• Marketplace listings and seller profiles (eBay, Facebook Marketplace, Gumtree)
• Forum posts and review sites (Reddit, Google Reviews, Trustpilot)
• Website content, including product claims, pricing, and terms
• Email threads and messaging platforms (when accessed via browser)
• Job advertisements and company pages
• Domain registration records and WHOIS data

Why most screenshots aren't enough

A screenshot saved to your desktop is not evidence — it's a file. Unless you can prove when that file was created, that it hasn't been edited, and that you (not a third party) captured it, opposing counsel will challenge it.

The common objections to screenshot evidence:

• "The date could have been manipulated." — File metadata can be changed by anyone with basic tools.
• "The image could have been edited." — Without a cryptographic hash, there's no way to prove it wasn't.
• "You can't prove you saw that on that date." — Without a logged investigation session, you have no chain of custody.

The five-step process for court-ready web evidence

1. Capture immediately
   The moment you become aware of relevant online content, capture it. Do not wait. Websites change. Social media posts get deleted. Start an investigation session with a clear case reference before you begin browsing.
2. Use a tool that hashes at capture time
   The screenshot must be hashed the moment it is taken — not after the fact. The SHA-256 hash must be computed from the raw image bytes and recorded alongside the screenshot in the evidence report.
3. Capture the full page
   Use scroll capture to record content below the fold. For social media, this means capturing the entire thread or profile, not just what's visible. Partial captures can be argued to be selectively misleading.
4. Document the context
   Record the URL, page title, and your investigation notes. Where a post appears matters — is it on a public profile, a private group, or an unlisted page? The chain of custody log should include every page you visited during the session.
5. Export a signed, self-contained report immediately
   Export your evidence report as soon as the session ends. Do not leave evidence in a browser extension for weeks before exporting — export the same day and store it securely. The report should be a single file with all images, hashes, timestamps, and URLs embedded.

What courts and jurisdictions look for

Property	Why it matters	How to satisfy it
Authenticity	Is this actually what the webpage showed?	SHA-256 hash computed at capture time
Integrity	Has it been altered since capture?	Hash matches the stored image file
Chain of custody	Who captured it and when?	Timestamped session log with all visited pages
Completeness	Is the full context captured?	Full-page scroll capture, not visible-only
Reproducibility	Can the capture method be independently verified?	Use auditable, documented software

Common mistakes to avoid

• Screenshotting in parts. Multiple screenshots of different sections of the same page create gaps. Use full-page scroll capture to document the entire content in one image.
• Saving to a shared drive first. File system metadata can be altered. Store your evidence report in a secure, access-logged system.
• Waiting before exporting. Export immediately after the investigation session. Stored data in a browser extension is not a primary evidence store.
• No case reference on the investigation. Every investigation should be labelled with the matter reference so evidence can be linked to the correct proceeding.
• Not capturing the URL bar. The screenshot should include the full URL, not just the page content. This is automatically recorded by WebInvestigator in the evidence report.