Is OSINT evidence admissible in court?

Yes — with proper preservation and authentication. OSINT findings (URLs, profiles, posts, listings, public records) are admissible under FRE 901(a) when the proponent can demonstrate the artifact accurately represents the original content. The challenges are two-fold: (1) the source is volatile — subjects sanitize trails, listings get edited, scam pages disappear under takedown pressure; without capture at moment of observation, the OSINT finding becomes 'I saw it but cannot prove it.' (2) raw OSINT printouts are insufficient — Griffin v. State (Md. 2011), Commonwealth v. Mangel (Pa. Super. 2018), and United States v. Vayner (2d Cir. 2014) excluded social-media printouts for lack of authorship authentication. A ProofSnap forensic ZIP solves both by sealing the artifact with SHA-256 + RSA-4096 + Bitcoin OpenTimestamps + Enterprise eIDAS qualified timestamp + ISO/IEC 27037-aligned chain of custody. The receiving attorney then drafts a Rule 902(11) custodian certification under 28 U.S.C. § 1746 referencing the manifest, signature, and OpenTimestamps proof for FRE 902(13)/(14) self-authentication — eliminating the need to call the investigator as an authentication witness.

How do investigators preserve evidence without exposing their investigation to the subject?

Operational security (OPSEC) is a major concern in 2026 OSINT workflows. AI-based research tools (ChatGPT, Perplexity, Claude.ai) log queries, associate them with accounts or device fingerprints, and store them for training — meaning if an investigation target gains access to those logs (breach, legal demand, account compromise), they learn what was being investigated and by whom. Cloud-archival tools (Wayback Machine, archive.ph) create public records of every URL submitted. ProofSnap is local-only by design: the extension captures and produces the ZIP entirely in the browser tab on the investigator's machine. Cookies, passwords, and authenticated session data never leave the device; captured page artifacts are bundled into the ZIP locally; no ProofSnap server sees the URL, the content, or the subject's identity. The only optional network call is the OpenTimestamps anchor hash submission — a 32-byte SHA-256 hash that reveals nothing about the captured content. For maximum OPSEC: capture from a dedicated investigative browser profile, store ZIPs in case-management DMS, and use Hunchly's continuous browsing log on the same machine for investigative-phase reconnaissance.

How is ProofSnap different from Hunchly for OSINT investigators?

Complementary, not competing. Hunchly (acquired by Maltego Technologies in May 2025) silently logs every page you browse during a case session into a local MHTML archive with SHA-256 hashes and device-local timestamps — optimized for long investigations where you do not know in advance which pages will matter. ProofSnap is one-click on-demand: you open the specific page you want as a court exhibit, click Capture, and produce a self-sealed ZIP with screenshot, HTML, metadata, SHA-256 manifest, RSA-4096 signature, Bitcoin OpenTimestamps anchor, ISO/IEC 27037-aligned forensic log, chain of custody, evidence.pdf, Provenance Certificate, and (Enterprise tier) eIDAS qualified RFC 3161 timestamp — ready to hand to counsel. Pricing: Hunchly $129.99/yr single user vs ProofSnap Essential $80/yr annual or Company $18.99/seat/month. Many investigators run both: Hunchly for the investigation phase (continuous browsing log), ProofSnap for the exhibit phase (specific captures going into the file).

Can I capture content behind login (banking dashboards, broker portals, admin views)?

Yes. ProofSnap is a Chrome/Edge desktop browser extension that captures exactly what your authenticated browser session is showing — banking dashboards, broker portals, escrow accounts, payment-processor views, internal admin pages, private social profiles, direct messages, and group content. Authentication is your own session (and you must have lawful access to the account — capture only what you are entitled to access). ProofSnap does not bypass logins, scrape, store credentials, or maintain persistent access. Cookies and passwords never leave your machine; only the captured page artifacts are bundled into the ZIP.

How do I integrate ProofSnap into my OSINT workflow?

Most OSINT investigators use ProofSnap as the capture endpoint of their workflow: Maltego/SpiderFoot/Intelligence-X discover the subject; Hunchly logs the investigative session continuously; when a specific page or profile becomes case-defining, you click ProofSnap to produce the FRE 902-ready ZIP that goes into the case file or counsel handoff. The forensic ZIP is self-contained — it travels with the case, not with your tool stack. Process: (1) capture pages you intend to use as exhibits the moment you find them, before the subject sanitizes the trail; (2) maintain a per-case folder of ZIPs; (3) at handoff, the attorney attaches the ZIP itself or extracts evidence.pdf as the Bates-stamped exhibit. ProofSnap captures both public-facing and behind-login content from your authenticated session.

What if the subject deletes their profile or the listing gets taken down after I capture?

That is the most common scenario ProofSnap was built for. Once you have captured the page, the ZIP is your independent evidence — the live page being deleted, edited, or sanitized afterward does not affect what is in the ZIP. The SHA-256 manifest, RSA-4096 signature, and Bitcoin OpenTimestamps anchor are all bound to the captured state at the moment of capture; any post-deletion changes to the original site are simply documented as 'page no longer accessible' if you verify the URL later. Best practice: capture early (the moment you identify a relevant page or profile), capture often (revisit and recapture if the page changes), and capture the surrounding context (full profile, surrounding posts, follower lists) for circumstantial authentication later.

What is the best evidence preservation software for investigators in 2026?

The dominant evidence-preservation tools for private investigators, OSINT analysts, and DFIR examiners in 2026 are Hunchly, Page Vault, X1 Social Discovery, and ProofSnap. The right choice depends on workflow phase (investigation vs exhibit), volume, and counsel handoff requirements. Hunchly (Maltego-owned since May 2025): automatic continuous browsing log to MHTML with SHA-256, $129.99/yr single user, $349.99/yr three users, Chrome/Chromium only — best for the investigation phase. Page Vault: court-ready browser capture, designed for legal professionals, from $195/mo subscription — best for legal-services firms. X1 Social Discovery: Windows desktop tool for enterprise mass collection, quote-based pricing via reseller (Forensic Computers, Inc. and others) — best for corporate-investigations teams handling 100,000+ items per matter. ProofSnap: Chrome/Edge extension at $18.99/seat/month (Company Plan, min 2 seats), adds Bitcoin OpenTimestamps and Enterprise-tier eIDAS qualified timestamps, plus $4.99 client-side SnapPack — best for the exhibit phase and small-to-mid PI agencies handing off to counsel. Many investigators run Hunchly continuously for the investigation phase and ProofSnap on-demand for the exhibit phase.

Do I need eIDAS qualified timestamps for US investigation matters?

Almost never for US-only matters. OpenTimestamps (Bitcoin) is sufficient for FRE 902(13) self-authentication. eIDAS qualified timestamps (EU Regulation 910/2014 Article 41) add a statutory presumption of accuracy in all 27 EU member states — valuable for cross-border investigations: EU-domiciled subjects, foreign platforms, DSA Article 16 notices, GDPR enforcement actions, EU regulator submissions. Company Plan includes 5 eIDAS timestamps per user per month; Enterprise tier ($28.99/month) includes unlimited eIDAS on every capture — recommended for EU-based investigators and US firms with regular cross-border work.

How does ProofSnap protect my PI license when a client complains?

State PI boards investigate complaints about evidence-handling failures. Spoliation, fabrication, undocumented chain of custody, or capture outside authorized scope are common grounds for client complaints, bar referrals, and board investigations. ProofSnap is the documented, repeatable, expert-verifiable standard that licensed investigators use to demonstrate ISO/IEC 27037-aligned evidence handling. When a complaint arrives, the ProofSnap audit trail (forensic_log.json + chain_of_custody.json + SHA-256 manifest + RSA-4096 signature + Bitcoin OpenTimestamps anchor) is your defense — exactly what was captured, when, by whom, from what session, with cryptographic proof that nothing was altered. Most US state PI statutes (Cal. Bus. & Prof. Code § 7520 (regulated by BSIS); NY GBL Article 7; Tex. Occ. Code Ch. 1702; Fla. Stat. Ch. 493; 225 ILCS 447) cover gathering of information broadly. UK PIs operate within the Security Industry Authority (SIA) framework, though licensing implementation has historically been delayed; check the current SIA status. ProofSnap does not replace your license — it makes your license defensible. Capture only content you are lawfully entitled to access; we are not a licensing body. Consult your state board or attorney for jurisdiction-specific authorization questions.

How do I deliver the Evidence ZIP to the case stakeholder (counsel, compliance, regulator, carrier, journalist)?

Five common delivery patterns — the ZIP is self-contained for any of them. (1) To counsel (litigation): send the ZIP as native exhibit; counsel authors a Rule 902(11) custodian certification under 28 U.S.C. § 1746 referencing the SHA-256 manifest, RSA-4096 signature, and OpenTimestamps proof for FRE 902(13)/(14) self-authentication. Or counsel's litigation-support team imports into Relativity / Everlaw / Logikcull / Filevine, which auto-Bates evidence.pdf as the standard exhibit with companion files as sub-Bates numbers. (2) To corporate compliance / general counsel: store ZIP in the matter file in OneTrust / NAVEX / ServiceNow GRC or DMS (iManage, NetDocuments, SharePoint). The chain_of_custody.json + forensic_log.json satisfy internal audit and board-reporting requirements without requiring a Rule 902(11) certification. (3) To regulator (FTC, SEC, FCA, BaFin, AFM, CNIL, ICO): attach ZIP to the complaint or filing. The Bitcoin OpenTimestamps anchor and Enterprise eIDAS qualified timestamp satisfy regulator's evidence-integrity requirements without expert testimony. (4) To insurance carrier SIU: ZIP attaches to the claim file. The forensic log + chain of custody pre-empt the standard SIU question 'how did you preserve this?' (5) To investigative journalist / newsroom counsel: ZIP supports source-protection workflows; reporters and editors can verify integrity offline without revealing collection methodology. In every case the ZIP travels as a self-contained, offline-verifiable bundle — no ProofSnap account or service required on the recipient side, no internet connection needed for the integrity check (Bitcoin verification is the only optional online step).

What about contracts, client confidentiality, and privilege?

ProofSnap runs locally in the browser tab. Captured content is never sent to ProofSnap servers — the ZIP is produced client-side and stays under your control. Standard investigator confidentiality applies: the existence and content of the investigation remain with you and your client (or instructing attorney) under your normal NDA / engagement letter. When a matter is performed at the direction of counsel, the work-product privilege may attach — coordinate with the instructing attorney on document-retention and production protocols. Company Plan uses per-seat credentials; SAML/SCIM SSO available on Enterprise. ZIPs can be stored in your own DMS or case-management system.

How long does ProofSnap evidence stay verifiable?

Designed to remain verifiable indefinitely. The TSA certificate chain and a frozen snapshot of the EU Trusted List are bundled inside the ZIP, so eIDAS verification works offline even years later. The Bitcoin OpenTimestamps anchor is preserved by the entire Bitcoin network — independent of ProofSnap's continued existence. SHA-256 and RSA-4096 are NIST-recommended standards expected to remain secure through at least 2030. Verification requires only python3 + openssl + ots client — standard, open-source tools used in digital forensics labs worldwide.

Why now: ISO/IEC 27037 + EU AI Act Art. 50 (Aug 2026)

For investigators · OSINT · DFIR · US · EU · UK

Your subject deleted the profile. Your evidence didn't.

Q: How do I maintain chain of custody for OSINT investigations?

Chain of custody for OSINT requires four documented steps under ISO/IEC 27037:2012: identification (which page, profile, listing, or dashboard), collection (when, by whom, from what session, with what tooling), acquisition (the cryptographic seal: hash + signature + timestamp), and preservation (how the artifact is stored and transferred without alteration). The UNODC recognizes ISO/IEC 27037 as a fundamental reference for digital investigations globally. ProofSnap satisfies all four steps in a single 41-second capture: forensic_log.json documents identification + collection + acquisition per the ISO/IEC 27037 process model; chain_of_custody.json records device identifiers and NTP-verified time; manifest.json with SHA-256 hashes plus manifest.sig RSA-4096 signature seals integrity; manifest.json.ots Bitcoin OpenTimestamps anchor proves time-of-capture independently. Recipient (counsel, expert, regulator, SIU) verifies offline with python3 + openssl + ots — no investigator testimony or vendor cooperation required for the integrity check.

In short: ProofSnap is a Chrome/Edge browser extension that captures marketplace listings, scam pages, social profiles, OSINT subjects, and behind-login dashboards as FRE 902(13)/(14) self-authenticating ZIPs with ISO/IEC 27037-aligned chain of custody. Each ZIP carries a SHA-256 manifest, RSA-4096 signature, Bitcoin OpenTimestamps anchor, and (optionally) an eIDAS qualified timestamp under EU Regulation 910/2014. Used by private investigators, OSINT analysts, DFIR examiners, fraud investigators, and corporate due-diligence teams across US, EU, and UK matters. Company Plan $18.99/seat/month (min 2 seats). 7-day free trial.

A browser extension built for the field. Capture volatile online evidence the moment you find it — before the subject sanitizes the trail, the listing gets edited, or the scam page disappears. SHA-256, RSA-4096, Bitcoin OpenTimestamps, eIDAS — counsel-ready ZIP, offline-verifiable, no service dependency.

Start 7-day free trial — install Chrome extension

Capture your first case tonight. Cancel by day 7 at zero cost.

Sample ZIP

14 files · see what counsel receives

Agency pricing

From $18.99/seat/month

Chrome Web Store verified Microsoft Edge Runs locally · no service dependency ISO/IEC 27037 aligned

ProofSnap Chrome extension for investigators — capture OSINT, marketplace listings, and behind-login dashboards as FRE 902-ready ZIPs with SHA-256, RSA-4096, Bitcoin OpenTimestamps, and ISO/IEC 27037 chain of custody

For your agency

✓Investigators, OSINT analysts, fraud examiners capture in the field
✓ISO/IEC 27037 chain of custody + FRE 902(13)/(14) self-authenticating
✓Agency-wide Company Plan $18.99/seat/month, min 2 seats

For your clients

✓Client buys SnapPack $4.99, captures 10 items, emails you the ZIPs
✓Evidence arrives before subjects sanitize trails or platforms take content down
✓Same forensic ZIP structure as agency-captured evidence

What ProofSnap is — and what it is not

ProofSnap is a digital evidence preservation tool. It captures the cryptographic foundation that supports FRE 901/902 authentication and ISO/IEC 27037 chain of custody. It is not a license, not a covert capture tool, and not legal advice. Capture only content you are lawfully entitled to access — behind-login capture requires you to be authorized to view the account, and OSINT collection must comply with your jurisdiction's surveillance, privacy, and PI-licensing requirements. We are not a licensing body; consult your state PI board, SIA, or attorney for jurisdiction-specific guidance.

What unauthenticated captures cost your agency

Four ways field screenshots end careers and cases.

For investigators, evidence is the deliverable. When it cannot stand on its own, the case dies and the relationship with the instructing attorney goes with it. Here is what is on the table when your captures cannot survive challenge.

Exhibit excluded at trial

Rossbach v. Montefiore (2d Cir. 2023): plaintiff's Title VII case terminated after forensic analysis exposed fabricated iMessage screenshots (emoji rendering inconsistent with the claimed iOS version). Griffin / Mangel / Vayner: social media printouts excluded for lack of authentication. If you collected the captures, your work disappears from the record — and the attorney who relied on it loses the case.

ProofSnap effect: any post-hoc edit breaks the SHA-256 manifest, invalidates the RSA-4096 signature, and orphans the OpenTimestamps anchor — Rossbach-style metadata-inconsistency analysis has nothing to find.

PI license exposure

State PI boards take complaints about evidence-handling failures seriously. A capture that gets excluded for spoliation or authentication failure becomes the basis for a client complaint, a bar referral, or a board investigation. Repeated failures put your license at risk.

ProofSnap effect: ISO/IEC 27037-aligned forensic log + chain-of-custody documentation is a defensible standard of practice — documented, repeatable, verifiable by any expert.

Instructing attorney lost

Attorneys remember investigators whose captures hold up. They also remember investigators whose captures don't. Modern litigators are increasingly aware of Rossbach-style attacks and will not retain investigators who deliver unauthenticated screenshots. One bad matter ends the referral pipeline.

ProofSnap effect: ZIP is self-authenticating under FRE 902(13)/(14). Attorney attaches it directly to motions; you do not need to be called as an authentication witness. Repeat referrals follow.

Subject sanitized before you captured

The moment a subject senses surveillance, profiles close, posts delete, marketplace listings get pulled, scam pages disappear under takedown pressure. Without a fast, cryptographically sealed capture at the moment of observation, the trail goes cold and the deliverable becomes "I saw it but cannot prove it."

ProofSnap effect: 41-second capture in the field. Bitcoin OpenTimestamps anchors the hash to the public blockchain — the "when" becomes a cryptographic fact, not a credibility contest, even years after subject deletion.

ROI math · typical engagement billing

SIU fraud investigation

$3K–$10K

ProofSnap = 0.2–0.6 %

PI background check

$200–$500

SnapPack $4.99 = 1–2.5 %

Corporate due diligence

$5K–$50K

ProofSnap = 0.04–0.4 %

Company Plan $18.99/seat/month · pays for itself if it prevents one exhibit exclusion, one re-capture, or one expert-witness engagement in the next 12 months. Most agencies break even on the first matter.

Capture before the trail goes cold — start 7-day free trial

The ZIP your agency produces

14-file forensic evidence package.

Designed for clean counsel handoff: FRE 902(13)/(14) self-authenticating with an ISO/IEC 27037-aligned chain of custody. Hash + signature + blockchain anchor + qualified timestamp — verifiable independently at opentimestamps.org.

screenshot.jpeg Visual capture of the page

capture_video.webm Screen recording of capture

page.html Full HTML content

domtextcontent.txt Extracted DOM text

metadata.json Timestamp, URL, browser, TLS

evidence.pdf Compiled evidence report

provenance_certificate.pdf Content credentials / capture integrity

manifest.json File listing + SHA-256 hashes

manifest.sig RSA-4096 digital signature

manifest.json.ots OpenTimestamps Bitcoin anchor

publickey.pem Public key (verify signature)

forensic_log.json ISO/IEC 27037 capture log

chain_of_custody.json Device + NTP verification

manifest.json.tsr eIDAS qualified RFC 3161 timestamp

The forensic log (forensic_log.json) and chain of custody (chain_of_custody.json) align with the ISO/IEC 27037:2012 process model for identification, collection, acquisition, and preservation of digital evidence. Verifies offline by counsel's forensic expert with only python3 + openssl + ots — no ProofSnap service or account required on the recipient side.

Start 7-day free trial → Download sample ZIP

What investigators capture

From a marketplace listing to a banking dashboard.

Any content that lives on the open web or behind your authenticated session — preserved at the moment of observation, before the subject sanitizes the trail.

Marketplace listings

eBay, Amazon, Vinted, OLX, Facebook Marketplace, Craigslist — listings that get edited, taken down, or relisted under new IDs the moment a complaint lands.

Scam pages & phishing

Phishing portals, fake e-shops, romance-scam profiles, fake-bank login pages — captured before takedown so the investigative trail does not end.

Behind-login dashboards

Banking, broker, escrow, payment-processor admin, internal admin views — captured from your authenticated session (capture only what you are entitled to access).

OSINT subject preservation

Profiles, posts, comments, group memberships, follower lists — captured at the moment of observation, before subjects sanitize trails.

Social media surveillance

Subject activity, DMs (where lawfully accessible), comments, deleted posts, account modifications — preserved with HTTP/TLS metadata for authorship rebuttal.

Dark-pattern UIs

Pre-checked boxes, hidden auto-renewals, misleading buttons, fake countdowns — preserved as the consumer actually encountered them, including DOM and metadata.

Public records & regulator notices

Court filings, sanctions lists, regulator publications, beneficial-ownership registers, public-companies registers — preserved at URL and exact moment of access.

Background & due diligence

Pre-employment screening, M&A due diligence, KYC/AML enhanced review, beneficial-ownership verification — supporting evidence with timestamps for compliance audit.

Insurance & financial fraud

Claimant social media activity, lifestyle posts, contradicting public statements, deleted posts, geolocation-revealing content — preserved for SIU and counsel handoff.

Internal corporate investigations

HR investigations, IT incident response, vendor due diligence, compliance internal review — capture behind-login content from internal systems with chain of custody for board / general counsel handoff.

Cryptocurrency & blockchain forensics

Exchange dashboards, wallet activity views, on-chain explorer snapshots, OTC desk listings, DeFi protocol UIs — preserved at point of access for tracing reports and exchange / regulator submissions.

Threat intel & dark web monitoring

Leak-site postings, ransomware-group disclosures, IOC pages, breach-data marketplaces, alias profiles — preserved when the source operates on takedown / rotation cycles measured in hours.

Key case law for quick reference

The authentication cases counsel will cite from your captures.

Cautionary precedent

Rossbach v. Montefiore Med. Ctr., No. 21-2084 (2d Cir. 2023)

What happened. Plaintiff in a Title VII sexual-harassment and retaliation matter against her former employer produced iMessage screenshots as core evidence of alleged supervisor communications. Defense expert analyzed the screenshots and found emoji rendering inconsistent with the iOS version available on the claimed dates, plus a credibility gap between plaintiff's testimony that her iPhone screen was too damaged (“severe cracks” and “ink bleed”) to take screenshots and the existence of the screenshots themselves — the District Court (S.D.N.Y., Judge Cote) found by clear and convincing evidence that the screenshots had been fabricated.

Result. The District Court imposed case-terminating sanctions in 2021; the Second Circuit affirmed the case-terminating sanction against Rossbach in August 2023 (the panel vacated the monetary sanction against her counsel and remanded for application of the correct bad-faith standard). The opinion is cited as authority for compelling forensic examination of any party's phone-screenshot evidence.

Why it matters to investigators. If you were the investigator who collected the screenshots that Rossbach-style examination later revealed as fabricated — even if you did not know they were fabricated — your professional standing and the instructing attorney's case are both gone. The defense playbook now travels beyond employment cases into family law, defamation, IP, fraud, and breach-of-contract matters.

How ProofSnap closes the attack. Each capture is sealed at the moment of acquisition with a SHA-256 manifest, RSA-4096 signature, and Bitcoin OpenTimestamps anchor. Any post-hoc edit (one byte, one pixel) breaks the hash, invalidates the signature, and orphans the timestamp. The Rossbach-style examination has no internal contradiction to find — the file is either deterministically intact, or visibly broken.

Six supporting cases counsel will reference

Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 534 (D. Md. 2007) — Judge Grimm's foundational ESI framework (Rule 901 / 801–807 / 1001–1008 / 403). The ZIP supports the Rule 901 identification prong; remaining prongs are counsel's legal work.
Griffin v. State, 419 Md. 343 (2011) — social-media printouts alone don't authenticate authorship. ProofSnap captures the full account profile alongside posts, giving counsel the circumstantial foundation under FRE 901(b)(4).
Commonwealth v. Mangel, 181 A.3d 1154 (Pa. Super. 2018) — extends Griffin's authorship concern. Same foundation applies; the ZIP's HTTP/TLS metadata can rebut a spoofing defense.
Commonwealth v. Banas, 5 N.E.3d 3 (Mass. App. Ct. 2014) — Facebook screenshot printout ruled inadmissible without additional circumstantial authentication. Reinforces the Griffin / Mangel pattern.
United States v. Vayner, 769 F.3d 125 (2d Cir. 2014) — VKontakte page authentication reversed for insufficient circumstantial evidence of ownership. HTTP/TLS handshake metadata in the ZIP rebuts the core Vayner concern.
Tienda v. State, 358 S.W.3d 633 (Tex. Crim. App. 2012) — MySpace profile authenticated through combination of distinctive content, photos, and corroborating circumstances. ProofSnap captures all three layers in a single ZIP.

ProofSnap strengthens counsel's foundation across every authentication case — start 7-day free trial

Chain of custody · international standards

ISO/IEC 27037 + eIDAS for cross-jurisdiction matters.

For corporate investigations, regulatory submissions, and cross-border matters, your evidence has to survive the recipient's forensic standards — not just your own.

ISO/IEC 27037:2012

International standard for identification, collection, acquisition, and preservation of potential digital evidence. The UNODC identifies ISO/IEC 27037 as a fundamental reference for digital investigations globally. ProofSnap's forensic_log.json documents the four-stage process; chain_of_custody.json records the chronology of movement and handling.

eIDAS qualified timestamps

EU Regulation 910/2014 Article 41 grants qualified timestamps a statutory presumption of accuracy across all 27 EU member states — admissible in any European court without additional authentication. RFC 3161 timestamps from EU Trusted List Qualified TSPs. Full certificate chain bundled in ZIP for offline verification.

Company Plan includes 5 eIDAS qualified timestamps per user/month. Enterprise tier ($28.99/month) includes unlimited eIDAS on every capture — recommended for EU-based agencies and US firms with regular cross-border investigations.

Read more about eIDAS for legal evidence →

Already evaluating Hunchly, Page Vault, or X1 Social Discovery?

How ProofSnap compares.

All four tools support digital investigations. The differences are in workflow phase (investigation vs exhibit), price model, behind-login support, blockchain anchoring, and EU eIDAS coverage. Public information, last reviewed May 2026 — verify current details on each vendor's site before purchasing.

Feature	ProofSnap	Hunchly	Page Vault	X1 Social Discovery
Pricing model	$18.99/seat/mo Company; $4.99 SnapPack	$129.99/yr solo; $349.99/yr 3-user	From $195/mo (subscription)	Quote-based (via X1/Forensic Computers reseller)
Workflow phase	Exhibit phase (on-demand capture)	Investigation phase (continuous log)	Exhibit phase (legal-services focus)	Enterprise mass collection
Deployment	Chrome / Edge extension, 30 sec install	Chrome / Chromium extension (no Firefox)	Browser-based, account required	Windows desktop install
SHA-256 hash + RSA-4096 signature	✓ Both, every capture	SHA-256 only	SHA-256 only	SHA-256 only
Bitcoin OpenTimestamps anchor	✓ Every capture	—	—	—
eIDAS qualified timestamp	✓ Enterprise tier	—	—	—
ISO/IEC 27037 chain of custody	✓ Aligned	Partial (capture log only)	Partial	✓
Behind-login capture (DMs, dashboards)	✓ Native, user's session	✓	✓	✓
Continuous browsing log	On-demand only	✓ Automatic	—	✓ enterprise
Client-side capture (pre-retainer)	✓ SnapPack $4.99	—	—	—
Free trial	7-day free trial, all plans	14-day trial	Demo only	Demo only

vs. Hunchly

Fit-based, not price-based. Hunchly silently logs every page browsed during investigation; ProofSnap is one-click on-demand for specific exhibits going to counsel. Many investigators run both: Hunchly for the investigation phase, ProofSnap for the exhibit phase. Full comparison →

vs. Maltego (post-Hunchly acquisition)

Maltego is a relationship-mapping & transform platform (current tiers Basic free / Entry €3,000/yr / Professional €7,500/yr for up to 5 users / Enterprise custom — Classic was discontinued in 2020). ProofSnap is the capture-and-seal layer. Many investigators run Maltego for graph analysis + ProofSnap for the specific page snapshots that go into exhibits.

vs. ShadowDragon

ShadowDragon (Horizon® / SocialNet®) is an enterprise OSINT discovery platform with social-network mapping; ProofSnap is the exhibit-grade capture layer. Used together: SD finds the subject, ProofSnap seals the specific evidence pages.

vs. Page Vault

Same browser-extension UX, adds Bitcoin OpenTimestamps + eIDAS + RSA signature + ISO/IEC 27037 chain of custody, plus client-side SnapPack for pre-engagement capture.

vs. X1 Social Discovery

Substantially lower TCO at small-to-mid agency scale (X1 is quote-based and historically positioned for enterprise mass-collection). X1 wins large-volume corporate workflows; ProofSnap wins per-matter capture + cross-platform (Mac/Linux via Chrome/Edge).

vs. OSINT Industries / Videris / SpiderFoot

Discovery and footprinting platforms operate upstream of evidence preservation. Use them to identify the subject and surface URLs; use ProofSnap to seal the specific pages as FRE 902 / ISO 27037 exhibits.

Comparison based on each vendor's publicly available marketing materials and reviews on G2 / Capterra / SoftwareWorld as of May 2026. Hunchly was acquired by Maltego Technologies in May 2025; the comparison reflects the pre-acquisition Hunchly product and the post-acquisition Maltego ecosystem. Verify current pricing and feature parity directly with each vendor.

Agency pricing

Start free. Upgrade when you bill for the case.

7-day free trial on all plans. Billing starts at day 8 unless you cancel — credit card required to start, charged only after the trial period if you don't cancel. Agency overhead, not per-capture billing.

Recommended for agencies

Company Plan

$18.99 / seat / month

Minimum 2 seats · annual $190/seat (save 17%).

✓ 7-day free trial · cancel by day 7 at zero cost

Unlimited captures per seat
Team dashboard + shared audit log
5 eIDAS qualified timestamps per user/month (Art. 41 EU presumption)
FRE 902(13)/(14) self-authenticating ZIPs
Bitcoin OpenTimestamps anchoring on every capture
ISO/IEC 27037 chain-of-custody documentation
Priority support

Start 7-day free trial →

Cancel by day 7 Cancel any time after Questions?

Solo investigator · Enterprise single-seat

$28.99 / month

Annual $280/yr (save 20%).

✓ 7-day free trial · cancel by day 7 at zero cost

Unlimited captures
Unlimited eIDAS qualified timestamps on every capture (EU court-ready)
Bitcoin OpenTimestamps + RSA-4096
Priority support
SAML/SCIM SSO available

Start 7-day free trial →

Credit card required to start · cancel by day 7 at zero cost

Chrome Web Store verified Microsoft Edge Add-ons Local-only · no service dependency Annual plans save 17–20%

See full pricing table for Essential ($8.99/mo) and Professional ($16.99/mo) mid-tiers, or SnapPack $4.99 for client-paid one-off captures.

Investigator FAQ

Chain of custody for OSINT requires four documented steps: identification (which page, profile, listing, or dashboard), collection (when, by whom, from what session, with what tooling), acquisition (the cryptographic seal: hash + signature + timestamp), and preservation (how the artifact is stored and transferred without alteration). ISO/IEC 27037:2012 is the international standard recognized by the UNODC as a fundamental reference for digital investigations globally. ProofSnap satisfies all four steps in a single 41-second capture: forensic_log.json documents identification + collection + acquisition per the ISO/IEC 27037 process model; chain_of_custody.json records device identifiers and NTP-verified time; manifest.json with SHA-256 hashes + manifest.sig RSA-4096 signature seals integrity; manifest.json.ots Bitcoin OpenTimestamps anchor proves time-of-capture independently. Recipient (counsel, expert, regulator, SIU) verifies offline with python3 + openssl + ots — no investigator testimony or vendor cooperation required for the integrity check.

Five common delivery patterns — the ZIP is self-contained for any of them.

• To counsel (litigation): send the ZIP as native exhibit; counsel authors a Rule 902(11) custodian certification under 28 U.S.C. § 1746 referencing the SHA-256 manifest, RSA-4096 signature, and OpenTimestamps proof for FRE 902(13)/(14) self-authentication. Or counsel's litigation-support team imports into Relativity / Everlaw / Logikcull / Filevine, which auto-Bates evidence.pdf as the standard exhibit with companion files as sub-Bates numbers.

• To corporate compliance / general counsel: store ZIP in the matter file in Coupa / OneTrust / NAVEX / ServiceNow GRC or your DMS (iManage, NetDocuments, SharePoint). The chain_of_custody.json + forensic_log.json satisfy internal audit and board-reporting requirements without requiring a Rule 902(11) certification.

• To regulator (FTC, SEC, FCA, BaFin, AFM, CNIL, ICO): attach ZIP to the complaint or filing; many regulatory portals accept ZIP as supporting evidence. The Bitcoin OpenTimestamps anchor and (Enterprise) eIDAS qualified timestamp satisfy regulator's evidence-integrity requirements without expert testimony.

• To insurance carrier SIU: ZIP attaches to the claim file. The forensic log + chain of custody pre-empt the standard SIU question "how did you preserve this?" — documented, repeatable, verifiable.

• To investigative journalist / newsroom counsel: ZIP supports source-protection workflows; reporters and editors can verify the integrity offline without revealing collection methodology. Helpful for FOIA / SAR / freedom-of-information evidence streams.

In every case the ZIP travels as a self-contained, offline-verifiable bundle — no ProofSnap account or service required on the recipient side, no internet connection needed for the integrity check (Bitcoin verification is the only optional online step).

Next case is one click away

Install the Chrome extension now. Capture the next listing tonight.

7-day free trial — cancel by day 7 at zero cost. The moment you identify a subject, you have a forensic ZIP ready for counsel handoff in 41 seconds.

Start 7-day free trial — install Chrome extension Edge Add-ons version

Cancel by day 7 at zero cost · download sample ZIP first · support@getproofsnap.com

Legal disclaimer: This page provides general information for private investigators, OSINT analysts, and DFIR examiners and is not legal advice. ProofSnap is not a licensing body and does not represent clients. Capture only content you are lawfully entitled to access; comply with state PI licensing, UK SIA, EU national regulations, and platform terms of service. Consult a licensed attorney or your state board for jurisdiction-specific guidance.

Related guides for investigators

Standards & research shortcuts