Why is the chain of custody important for digital evidence?

Because digital evidence is easy to change and the change is invisible to the eye. When the other side challenges an exhibit, counsel has to show who collected it, when, how, and that nothing has happened to it since. A documented chain of custody answers those questions from the record; without it, the answer rests on your memory and your credibility on the stand.

What breaks the chain of custody for an online capture?

A gap in the record: a screenshot with no time source, a file copied or renamed with no note of who did it, an edit made after collection, or a capture nobody can tie to a person and a device. Once the chain is broken, the exhibit is not automatically excluded, but counsel has to fill the gap with testimony and the weight of the evidence drops. Sealing at the moment of capture and keeping the ZIP unchanged close most of these gaps.

Can I capture video or several tabs as one case?

Yes. In manual mode you start a screen recording, browse, then stop and save, and the video goes into the sealed ZIP; recordings run up to 5 minutes, 10 minutes on Company and Enterprise, and 75 minutes with a Video SnapPack. Session mode captures each tab you view as its own sealed snapshot inside one package, which suits a subject spread across several profiles and listings.

Is OSINT evidence admissible in court?

It can be, and the court decides. The proponent has to show that a capture is what it is claimed to be, and two things usually get in the way: the source is volatile, and a bare printout says nothing about who made it, which is why Griffin v. State (Md. 2011) reversed a conviction because MySpace printouts were admitted without proper authentication. A ProofSnap ZIP records what the page showed in your browser, when, and from which session. In US federal court one route is a declaration by a qualified person describing the capture process, the self-authentication route of FRE 902(13) and (14); the other is testimony. The instructing attorney chooses.

How is ProofSnap different from Hunchly for OSINT investigators?

They cover different phases. Hunchly logs the pages you browse during an investigation, which suits long-running research when you do not yet know which pages will matter. ProofSnap works on demand: you open the page you want as an exhibit, click Capture, and get a sealed ZIP with the screenshot, HTML, metadata, SHA-256 manifest, RSA-4096 signature, chain of custody, evidence.pdf and the Provenance Certificate, plus an OpenTimestamps anchor on every plan except Essential and an eIDAS qualified timestamp on Company and Enterprise. Many investigators run a browsing log for research and ProofSnap for exhibits.

What if the subject deletes their profile or the listing gets taken down after I capture it?

Nothing in the ZIP changes. The hashes and signature are bound to the captured files, and on every plan except Essential, the OpenTimestamps anchor shows the manifest existed no later than the anchor time, whatever happens to the live page afterward. Capture early, recapture if the page changes, and capture the surrounding context (the full profile, nearby posts) so counsel has more to work with.

What is the best evidence preservation software for investigators in 2026?

It depends on the phase of the work and the volume. Continuous browsing-log tools suit the research phase, and enterprise collection platforms suit corporate teams that collect at scale. ProofSnap suits the exhibit phase: a Chrome and Edge extension at $18.99 per seat per month (Company Plan, minimum 2 seats), with a Bitcoin OpenTimestamps anchor on every plan except Essential, eIDAS qualified timestamps on Company and Enterprise, and a $4.99 SnapPack a client can use before the engagement starts.

Do I need eIDAS qualified timestamps for US investigation matters?

Almost never for US-only matters. One US federal route is a certification by a qualified person; an OpenTimestamps anchor supports that certification but does not replace it. eIDAS qualified timestamps carry the EU presumption of accuracy of the date and time and of the integrity of the stamped manifest, which matters before EU courts and authorities, for example in EU regulator submissions. The Company Plan includes 5 eIDAS qualified timestamps per user per month; Enterprise ($28.99 per month) includes 10 per month.

How do I deliver the evidence ZIP to counsel, compliance, a regulator or a carrier?

The ZIP is self-contained, so how you deliver it depends only on the recipient. For counsel, send the ZIP; the attorney decides whether to use a certification or a witness. For corporate compliance or general counsel, store the ZIP in the matter file or your document management system. For a regulator, attach the ZIP where the portal accepts supporting files. For an insurance SIU, attach it to the claim file, where the forensic log and chain of custody answer "how did you preserve this?"

How long does ProofSnap evidence stay verifiable?

It is designed to remain verifiable for years. The TSA certificate chain, the root certificate and the OCSP and CRL revocation data are bundled inside the ZIP, so the eIDAS stamp can be checked offline long after capture. The Bitcoin OpenTimestamps anchor lives on the Bitcoin blockchain, independent of ProofSnap's continued existence. The hash and signature can be checked offline with standard tools, and the anchor with the open-source ots client. Anyone who receives a ZIP can also check it in the free Trust Verifier without an account.

For investigators · OSINT · DFIR · US · EU · UK

Your subject deleted the profile. Your evidence didn't.

As of 2026, ProofSnap is a Chrome and Edge extension that captures marketplace listings, scam pages, social profiles and behind-login dashboards as sealed evidence for investigators: a SHA-256 manifest, an RSA-4096 signature, a chain of custody following the ISO/IEC 27037 process model, an OpenTimestamps anchor on every plan except Essential and an optional eIDAS qualified timestamp.

Radim Motycka, founder and lead engineer of ProofSnap · Last updated: October 14, 2026 · Verify any package yourself in the Trust Verifier

A browser extension built for the field. Capture volatile online evidence the moment you find it, before the subject sanitizes the trail, the listing gets edited or the scam page disappears, and hand counsel a sealed ZIP they can check offline.

Start your 7-day free trial and install the extension

Capture evidence for your first case tonight. Card required; cancel by day 7 at zero cost.

Sample ZIP

11 to 15 files · see what counsel receives

Agency pricing

From $18.99/seat/month

Chrome and Edge No public archive submission Follows the ISO/IEC 27037 process model

ProofSnap Chrome extension for investigators capturing OSINT pages, marketplace listings and behind-login dashboards as sealed evidence ZIPs

For your agency

Investigators, OSINT analysts and fraud examiners capture in the field
Chain of custody that follows the ISO/IEC 27037 process model
Agency-wide Company Plan $18.99/seat/month, min 2 seats

For your clients

Client buys a $4.99 SnapPack, captures 10 items, emails you the ZIPs
Evidence arrives before subjects sanitize their trails or platforms take content down
A sealed ZIP with the client on record as the person who captured it

Or we do it for you

You send a link or the files. We send back the sealed package.

For the profile that has to be sealed before it disappears, the claim file that closes today, or the chat export a client emailed you as a raw text file. You send a public URL or the files you already hold. We run the same forensic pipeline and return a signed, timestamped ZIP within 48 hours, ready to attach to the report. It helps when the capture should come from someone other than you, or when one case has more pages than a shift allows.

We capture a web page Any public URL, from $44.99 WhatsApp chat export Line-numbered court transcript, $59.99 Telegram chat export Line-numbered court transcript, $59.99 Signal chat export Line-numbered court transcript, $59.99 Messenger chat export Line-numbered court transcript, $59.99 Email thread Headers and attachments certified, $59.99 Documents, photos, video, audio Files you already have, $59.99 Facebook post Every comment and reply, $44.99

A chat export is the file the app gives you when you tap Export chat. We render it as a line-numbered transcript, hash every file and timestamp the result, so any edit after sealing is detectable.

Several URLs in one matter: Evidence Pack, up to 5 URLs for $149. A video with its comments and channel context: YouTube evidence service, from $44.99. Full comparison and FAQ.

eIDAS qualified timestamps issued by Disig a.s., a qualified trust service provider on the EU Trusted List.

Not sure which one fits? Tell us the situation and we will scope it →

What an unsealed capture costs an investigator

Three ways field screenshots fail a case.

For investigators, evidence is the deliverable. When a capture cannot answer an authenticity challenge, the instructing attorney carries the risk, and you lose the referral.

01
Exhibit challenged

Opposing counsel claims the screenshot was edited. In Rossbach v. Montefiore the Second Circuit affirmed dismissal after the district court found that a text-message image had been fabricated. A bare screenshot gives the examiner nothing to check it against.

With ProofSnap: every file is hashed and the manifest is signed; on every plan except Essential, an OpenTimestamps anchor fixes the manifest in time, so a later rebuild of the package is detectable.
02
Subject sanitized the trail

The moment a subject senses attention, profiles close, posts disappear, listings get pulled and scam pages vanish under takedown pressure. Without a sealed capture from the moment of observation, the report says "I saw it" and nothing more.

With ProofSnap: capture in the field the moment you find the page; on every plan except Essential, an OpenTimestamps anchor on the Bitcoin blockchain shows the capture existed no later than that moment.
03
Investigation exposed

Submitting case URLs to the Wayback Machine or archive.ph creates a public record of every page you preserve. A subject who watches those archives can learn what you are looking at before the report is delivered.

With ProofSnap: nothing is submitted to a public archive, and the OpenTimestamps anchor carries only a 32-byte hash.

Capture before the trail goes cold. Start the 7-day trial.

The ZIP your agency produces

Forensic evidence package of 11 to 15 files.

Designed for a clean handoff to the instructing attorney, with a chain of custody that follows the ISO/IEC 27037 process model. Each package carries a hash, a signature, a blockchain anchor (not on Essential) and, on eIDAS plans, a qualified timestamp. The anchor can be checked independently at opentimestamps.org.

screenshot.jpeg Visual capture of the page

capture_video.webm Screen recording, when you record

page.html Full HTML content

domtextcontent.txt Extracted DOM text

metadata.json Timestamp, URL, browser, HTTP headers, cookies and local storage

evidence.pdf Compiled evidence report

provenance_certificate.pdf Six checks of capture conditions

manifest.json File listing + SHA-256 hashes

manifest.sig RSA-4096 digital signature

manifest.json.ots OpenTimestamps Bitcoin anchor (not on Essential)

publickey.pem Public key for signature verification

forensic_log.json Capture log (ISO/IEC 27037 process model)

chain_of_custody.json Device identifiers and NTP-verified time

manifest.json.tsr eIDAS qualified RFC 3161 timestamp (eIDAS plans)

The forensic log (forensic_log.json) and chain of custody (chain_of_custody.json) follow the ISO/IEC 27037 process model for identification, collection, acquisition, and preservation of digital evidence. Counsel's forensic expert can check the hashes and signature offline with standard tools and the blockchain anchor with the open-source ots client, with no ProofSnap service or account required.

Start 7-day free trial → Download sample ZIP

What investigators capture

From a marketplace listing to a banking dashboard.

Any content that lives on the open web or behind your authenticated session: preserved at the moment of observation, before the subject sanitizes the trail.

Marketplace listings

eBay, Amazon, Vinted, OLX, Facebook Marketplace, Craigslist: listings that get edited, taken down, or relisted under new IDs the moment a complaint lands.

Scam pages & phishing

Phishing portals, fake e-shops, romance-scam profiles, fake-bank login pages: captured before takedown so the investigative trail does not end.

Behind-login dashboards

Banking, broker, escrow, payment-processor and internal admin views: captured from your authenticated session (capture only what you are entitled to access).

OSINT subject preservation

Profiles, posts, comments, group memberships, follower lists: captured at the moment of observation, before subjects sanitize their trails.

Social media surveillance

Subject activity, DMs (where lawfully accessible), comments, posts before they are deleted, account modifications: preserved with the page HTML and HTTP response headers.

Dark-pattern UIs

Pre-checked boxes, hidden auto-renewals, misleading buttons, fake countdowns: preserved as the consumer actually encountered them, including the DOM and metadata.

Public records & regulator notices

Court filings, sanctions lists, regulator publications, beneficial-ownership registers, company registers: preserved with the URL and the moment of access.

Background & due diligence

Pre-employment screening, M&A due diligence, enhanced KYC/AML review, beneficial-ownership verification: supporting evidence with timestamps for compliance audits.

Insurance & financial fraud

Claimant social media activity, lifestyle posts, contradictory public statements, posts before they are deleted, geolocation-revealing content: preserved for SIU and counsel handoff.

Internal corporate investigations

HR investigations, IT incident response, vendor due diligence, internal compliance reviews: behind-login content from internal systems, captured with a chain of custody for handoff to the board or general counsel.

Cryptocurrency & blockchain forensics

Exchange dashboards, wallet activity views, on-chain explorer snapshots, OTC desk listings, DeFi protocol UIs: preserved at the point of access for tracing reports and exchange or regulator submissions.

Threat intel and leak-site pages

Leak-site postings, ransomware-group disclosures, IOC pages, breach-data marketplaces, alias profiles: preserved before the source rotates or is taken down.

Case law for quick reference

Two rulings counsel will cite about your captures.

Griffin v. State, 419 Md. 343 (2011): Maryland's highest court reversed a murder conviction because pages said to be printed from a MySpace profile were not properly authenticated; someone other than the purported creator could have made them. For your report, a capture shows what the page displayed; who controls the account needs its own evidence.
Rossbach v. Montefiore Med. Ctr., 81 F.4th 124 (2d Cir. 2023): the Second Circuit affirmed dismissal after the district court found that a text-message image had been fabricated, partly because it did not match how any iPhone displays messages. A capture sealed at the moment of collection gives the examiner something to check against.

Chain of custody · international standards

ISO/IEC 27037 and eIDAS for cross-border matters.

Corporate investigations, regulatory submissions and cross-border matters put your evidence in front of reviewers in other jurisdictions, so it has to hold up there too.

ISO/IEC 27037:2012

The international guideline a forensic expert in another country will recognize, covering identification, collection, acquisition and preservation of digital evidence. For a cross-border matter, ProofSnap's forensic_log.json documents the four-stage process; chain_of_custody.json records the device, NTP-verified time and the capture steps.

eIDAS qualified timestamps

Article 41(2) of the eIDAS Regulation reads: “A qualified electronic time stamp shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound.” The same article separately provides that an electronic timestamp shall not be denied legal effect and admissibility as evidence solely because it is in electronic form, or because it is not a qualified timestamp. This matters before EU courts and authorities, for example in EU regulator submissions and cross-border civil claims.

The Company Plan includes 5 eIDAS qualified timestamps per user per month. The Enterprise tier ($28.99/month) includes 10 eIDAS qualified timestamps per month and is recommended for EU-based agencies and US firms with regular cross-border investigations.

Read more about eIDAS for legal evidence →

Agency pricing

Start with a trial. Pay per seat or per case.

7-day free trial on all plans. A card is required to start, and billing begins on day 8 unless you cancel. SnapPack covers client-paid one-off captures.

Recommended for agencies

Company Plan

$18.99 / seat / month

Minimum 2 seats · annual $190/seat (save 17%).

7-day free trial · cancel by day 7 at zero cost

Unlimited captures per seat
Team admin: add and remove members
5 eIDAS qualified timestamps per user per month (EU presumption of accuracy)
Designed to support a US self-authentication certification
Bitcoin OpenTimestamps anchoring on every capture with this plan
Chain-of-custody documentation (ISO/IEC 27037 process model)
Email support within 3 business days

Start 7-day free trial →

Cancel by day 7 Cancel any time after Questions?

Solo investigator

$28.99 / month

Enterprise, single seat · $280/year billed annually (save 20%).

7-day free trial · cancel by day 7 at zero cost

Unlimited captures
10 eIDAS qualified timestamps per month
Bitcoin OpenTimestamps + RSA-4096
Email support within 3 business days

Start 7-day free trial →

Or one-off · SnapPack $4.99 for 10 captures (no subscription) at getproofsnap.com, ideal when a client captures before the retainer is signed.

Microsoft Edge Add-ons No public archive submission Annual plans save 17-20%

See the full pricing table for the lower Essential ($8.99/mo) and Professional ($16.99/mo) tiers.

Investigator FAQ

Chain of custody is the documented record of who collected an item, when and how, and everything that happened to it afterward. It matters because it lets counsel show the item was not altered between collection and the hearing. Document four steps for every capture: identification (which page, profile, listing or dashboard), collection (when, by whom, from which session), acquisition (the seal) and preservation (how the file is stored and handed over). That is the process model of ISO/IEC 27037. In a ProofSnap ZIP, forensic_log.json logs the steps in a hash chain, chain_of_custody.json records device identifiers and NTP-verified time, the SHA-256 manifest and RSA-4096 signature seal the files, and on every plan except Essential, an OpenTimestamps anchor fixes the manifest in time. The recipient can check the hashes and signature offline with standard tools.

Do not submit case URLs to the Wayback Machine or archive.ph, because both create a public record of every page you preserve. ProofSnap submits nothing to a public archive. Some capture steps do contact ProofSnap and third-party services: the screenshot is sent for C2PA signing, the manifest hash goes to the timestamp services, and the domain is looked up in DNS and WHOIS. The optional page refresh and the optional image-provenance check also request the page and its images from the site again. The page's cookies and local storage are recorded in metadata.json, so capture from a dedicated investigative browser profile and review a ZIP before it leaves the case file.

Yes. ProofSnap is a Chrome and Edge desktop extension that captures what your signed-in browser session shows: banking and broker dashboards, escrow and payment-processor views, internal admin pages, private profiles, direct messages and group content. You must have lawful access to the account. ProofSnap does not bypass logins, scrape data or retain access. The page's cookies and local storage are recorded in metadata.json, so review the package before sharing it outside the matter.

The package documents what you captured, when, from which browser and session, and whether anything has changed since: forensic_log.json, chain_of_custody.json, the SHA-256 manifest and the RSA-4096 signature, plus the OpenTimestamps anchor on every plan except Essential, which fixes the manifest in time. That gives you a verifiable record to show instead of an account from memory. ProofSnap does not replace your license; capture only content you are lawfully entitled to access.

The ZIP is produced in your browser and saved where you choose, so the case file stays under your control. During capture the screenshot is sent to ProofSnap for C2PA signing, the manifest hash to the timestamp services and the domain to DNS and WHOIS lookups, and the page's cookies and local storage are recorded in metadata.json. When the work is done at the direction of counsel, work-product protection may attach, so agree on retention and production with the instructing attorney.

Your next case is one click away

Install the Chrome extension. Capture the next listing tonight.

7-day free trial, cancel by day 7 at zero cost. The moment you identify a subject, you have a forensic ZIP ready for counsel.

Start your 7-day free trial and install the extension Edge Add-ons version

Cancel by day 7 at zero cost · download the sample ZIP first · support@getproofsnap.com

Legal disclaimer: This page provides general information for private investigators, OSINT analysts, and DFIR examiners and is not legal advice. ProofSnap is not a licensing body and does not represent clients. Capture only content you are lawfully entitled to access; comply with state PI licensing, UK SIA, EU national regulations, and platform terms of service. Consult a licensed attorney or your state board for jurisdiction-specific guidance.

Related guides for investigators

Standards & research shortcuts