Guide

How to read a ProofSnap evidence package

A ProofSnap evidence package (2026 edition) is one ZIP per captured web page: evidence.pdf to read first, the screenshot and page files, metadata and a chain of custody, a manifest of SHA-256 hashes signed with RSA-4096 and timestamped where the plan includes it, and scripts that let anyone check that nothing was changed.

You captured a web page as digital evidence, or someone sent you a ProofSnap ZIP. This guide explains every file in it, walks through the evidence document section by section, and shows how to check the package and what to hand to a lawyer or a court.

Open first

evidence.pdf

Hand over

The whole ZIP, unchanged

Check it with

verify.sh, verify.ps1 or the Trust Verifier

By Radim Motycka, Founder and Lead Engineer at ProofSnap, who built the capture pipeline, the evidence PDF and the verification scripts this guide walks through. ·

Who this guide is for

  • You made a capture and want to know what you are handing over.
  • You are a lawyer, expert or judge who received a ProofSnap ZIP.
  • You need to find one fact fast: the time, the URL, the server, the custodian.

Making a capture? See How to capture a web page.

Part 1

What is in the ZIP

A web capture arrives as one ZIP with a name such as proofsnap_20261014_153012.zip, built from the local date and time on your computer when the download link appeared. The files fall into four groups. The exact list depends on the plan and on the options switched on, so two packages can differ.

  1. 1Read. evidence.pdf is the document for people: open it first. provenance_certificate.pdf is a one-page summary of the checks. The full screenshot is screenshot.jpeg. The HTML as the browser rendered it is page.html, a single-file archive of the page as it stood at capture time is page.mhtml, and its text is domtextcontent.txt. images.json lists the page's images, with the SHA-256 hash of each image file saved in the package. Those files are in the images/ folder, taken from the MHTML archive when it holds any.
  2. 2Record. metadata.json is the technical record of the page and the browser, chain_of_custody.json and forensic_log.json document who captured what, when and how, and forensic_log_summary.txt is the log in plain text. See parts 9 and 10.
  3. 3Seal. manifest.json lists the capture files with their hashes, manifest.sig is its RSA-4096 signature and publickey.pem the key to check it. manifest.json.ots is the Bitcoin timestamp (OpenTimestamps). See part 11.
  4. 4Check. The verification/ folder has verify.sh for macOS and Linux, verify.ps1 for Windows and a plain-text guide. See part 12.
A web capture on the Professional plan, opened in the file manager. Image file names are examples.

Part 2

Files that appear only in some captures

These files are in the package only when the option was on or the data was available. When one is missing, nothing is wrong: the capture simply did not include it.

  1. 1US court certification. rule_902_certification.pdf, a declaration template for United States federal courts with the capture details filled in. Available on every plan, and added only when the person making the capture switched it on. Always in English. See part 13.
  2. 2C2PA Content Credentials. c2pa.json is the sidecar of the Content Credentials manifest embedded in screenshot.jpeg.
  3. 3eIDAS. manifest.json.tsr is the EU qualified timestamp from Disig a.s., a Qualified Trust Service Provider on the EU Trusted List, and eidas_validation.json carries the certificate chain and revocation data needed to check it offline.
  4. 4Video. capture_video.webm or capture_video.mp4, the screen recording of the capture.
  5. 5Forensic mode. capture.warc (network archive), network.har (every request and response), resources.json with a resources/ folder of the loaded files, and certificate_details.json with the TLS certificate details of an HTTPS page. Forensic mode comes with the Professional, Enterprise and Company plans; see how to use forensic mode.

A session capture (multi-tab mode) adds a tabs/ folder with one subfolder per visited tab. Each holds its own screenshot, HTML, text, metadata, chain of custody and a shorter Per-Tab Evidence Record PDF. The root evidence.pdf covers the primary tab and lists the whole session.

The download table in the side panel after a capture with every option on (example). Optional rows are tinted here for this guide.

Part 3

evidence.pdf, page 1: the summary and the screenshot

The evidence document is written in the evidence language chosen before the capture, which can be any of 29 languages. Its sections are numbered from 1 to 15, and the numbers never change, so a lawyer can cite a section of the evidence document by its number in any exhibit. Page 1 opens with the header and a summary box, then goes straight to the screenshot.

  1. 1Summary box. Domain of the page, capture Time in UTC, User (the custodian ID of the account and the IP address it captured from) and Hash, the SHA-256 of page.html. When an EU qualified timestamp was requested, an eIDAS row says it applies if the eIDAS files are in the package.
  2. 21. Page Screenshot. The page itself, first, because it is the exhibit. Everything after it supports it.
  3. 3The blue band. ProofSnap adds a band to the top of the screenshot with the URL, the UTC time, the NTP offset and the evidence ID, labeled as an annotation, not the browser address bar. The note under the file name says so and states that the page content below it is unmodified.
  4. 4Footer on every page. Tool and version, a link to getproofsnap.com, the full evidence ID and Page X / Y, so a printed copy cannot lose or swap a page unnoticed.
1
Domain:example-shop.com
Time:2026-10-14T15:30:12Z (UTC)
User:Xq7LmR2vTn9KpB4sWc1YhZ8dFa63 (203.0.113.42)
Hash:page.html · SHA-256: e5e239560bc125a20ff2ac1fea50915bc198dd4f5b5256ec447a8a71e00132b3
eIDAS:Requested; applied if manifest.json.tsr and eidas_validation.json are present in this package

1. Page Screenshot:2

Below is a visual capture of the web page at the time of snapshot.

Screenshot file: screenshot.jpeg

The blue band at the top of this image is an annotation added by ProofSnap software, not a capture of the browser address bar. It restates the captured page URL, the UTC capture time and the evidence ID recorded elsewhere in this package. ...3

ProofSnapannotation added by software, not the browser address bar

https://example-shop.com/listing/4821

2026-10-14T15:30:12Z (UTC) NTP offset +38 ms

ID ps_3f9c2a71-8e4b-4d1a-b6f0-5c27e9a1d304

Example Shop

Vintage desk lamp

Listing #4821 · posted by seller_77

$120

4
Captured with ProofSnap v1.19.5 · getproofsnap.comps_3f9c2a71-8e4b-4d1a-b6f0-5c27e9a1d304 · Page 1 / 17
Simplified page 1 of evidence.pdf, default header, eIDAS requested. Values are examples.

Part 4

End of the screenshot and the Evidence Verification summary

A long page runs over several PDF pages. After the screenshot comes a plain-language summary meant for a judge or a client who will not read the technical sections.

  1. 1Truncation notice. The PDF shows the start of the screenshot under its heading and at most 10 further pages. When the page is longer, a note says how many pages are shown and that the complete image is screenshot.jpeg, which is what the hashes and the signature cover.
  2. 2Evidence Verification. One paragraph stating what the document is, with the source URL and capture time repeated.
  3. 3What was verified. Short bullet points. Each bullet appears only when it is true for this capture. The live-page line needs a fresh server response; the tool line needs a store installation and a passed device check.
  4. 4Legal basis. A neutral paragraph on the integrity checks that names no national law. When an EU qualified timestamp was requested, a further paragraph on the qualified timestamp follows. Then come the verification links.

Screenshot truncated - showing first 10 of 14 pages. The complete screenshot is available in the screenshot.jpeg file included in the evidence package.1

End of Page Screenshot Section. Note: the image reproduced above may have been shortened to keep this document to a workable size. The screenshot as it was recorded is the file screenshot.jpeg in this evidence package, and that file is what the hash values and the signature cover.

Evidence Verification2

This is verifiable digital evidence. ProofSnap captured the page below at the stated time; any later modification is detectable. Its authenticity can be verified independently.

Source URL: https://example-shop.com/listing/4821

Time: 2026-10-14T15:30:12Z (UTC)

What was verified3

• The page was genuinely live at capture: the server responded and the connection was secured (TLS).

• The content is unchanged since capture: protected by a SHA-256 cryptographic hash; any modification is detectable.

• The package is protected against substitution by an RSA-4096 digital signature: any modification after signing is detectable.

• Captured with a verified, unmodified tool: extension and device integrity were confirmed.

The paragraphs below describe technical properties, not a legal opinion. ProofSnap does not give legal advice and does not determine before which court or tribunal this record will be produced.4

Legal basis: these cryptographic properties (SHA-256 hash, digital signature, independent timestamp and chain of custody) are designed to support the authentication of electronic records. Admissibility is determined by the competent court under the applicable rules of evidence.

This summary verifies the technical integrity of the capture; it does not assess the truth of the page's content.

Verify online: getproofsnap.com/verify/index.html

Verify source code (MIT): github.com/proofsnap/proofsnap-verify

Captured with ProofSnap v1.19.5 · getproofsnap.comps_3f9c2a71-8e4b-4d1a-b6f0-5c27e9a1d304 · Page 11 / 17
Simplified page 11 of evidence.pdf for a long page, with the eIDAS paragraph left out. Page count and values are examples.

Part 5

Sections 2 to 5: what, when, who and with what

These sections identify the evidence and the circumstances of the capture.

  1. 12. Evidence Identification. Evidence ID, source URL, page title, timestamp, the case reference, examiner and note when they were entered, the standard followed and the hash of the page HTML.
  2. 23. Time Verification. The capture time corrected by NTP, the time server, the offset of the computer clock and how many time sources agreed.
  3. 3Capture context. Referrer (how the browser got to the page), the full user agent and the operating system.
  4. 4Custodian and browser state. The custodian ID, IP address, browser and timezone. The email address of the account is not printed; its SHA-256 hash is in chain_of_custody.json. Up to five entries per cookie or storage store follow, shortened. Values whose names suggest tokens or sessions are withheld. The complete set is in metadata.json.
  5. 54. Device Integrity and 5. Extension Integrity. Signs of an automated or headless browser, an integrity score, and the identity and version of the extension that made the capture.
Simplified pages 12 and 13 of evidence.pdf. Some rows shortened; values are examples.

Part 6

Sections 6 to 11: files, text, connection and domain

The technical body of the document. A section with no data for this capture keeps its heading with a short note that it is empty, so the numbering stays the same.

  1. 16. Evidence Package Files. SHA-256 hashes of the main files, and details of the video when one was recorded. The PDF cannot list its own hash; manifest.json has all of them.
  2. 27. Page text. Points to domtextcontent.txt and warns that its order follows the page source, so it should be read together with the screenshot.
  3. 38. TLS/SSL. Whether the connection was encrypted with TLS. The browser does not give an extension the protocol version, the cipher or the certificate, so those rows read Not available via browser API. The connection and certificate details (protocol, cipher, issuer, subject, validity, alternative names) are captured only in forensic mode, in certificate_details.json.
  4. 49. DNS. The IP addresses the domain resolved to, checked against two DNS resolvers, and the DNSSEC status.
  5. 510. HTTP Response Headers. The server's answer to the page request: status code, when and how the headers were captured, and the key headers.
  6. 611. WHOIS/RDAP. Registrar, registration and expiry dates, name servers and the registrant, often redacted under the GDPR.
Simplified pages 14 and 15 of evidence.pdf, a capture without forensic mode. Some rows shortened. Values are examples.

Part 7

Sections 12 to 15 and the footer

The document ends with the optional content checks and the formal sections.

  1. 112. AI Content Detection and 13. Image Provenance. Filled in when these checks ran: signals of AI generation in the page's images, and per-image server dates. Otherwise the headings stay with a note that no data was available.
  2. 214. Data Collection Methodology. Starts on a new page: the target URL, collection time, environment and the pseudonymous user who made the capture.
  3. 315. Legal Notice. What the document is and what it may be used for.
  4. 4Standards & Compliance. Alignment with the ISO/IEC 27037:2012 guidelines for handling digital evidence (a guidance standard, not a certification), the self-authentication line only in English documents, and the eIDAS line only when eIDAS was requested. Then come the verification links.
  5. 5Footer. The same on every page, including the last.
Simplified pages 16 and 17 of evidence.pdf, AI detection and image provenance not switched on. Values are examples.

Part 8

provenance_certificate.pdf: one page, six checks

The provenance certificate condenses the capture into a single page in the same evidence language. Hand it to someone who needs the result at a glance.

  1. 1Capture details. Evidence ID, page title, URL, time, the SHA-256 of the screenshot, browser, extension version and the custodian ID.
  2. 2Package integrity. A reminder that all hashes are in the signed manifest, and that this was a live browser capture, not an uploaded file.
  3. 3Integrity checks. Automation detection, NTP time cross-checked against up to three sources, DNS from two resolvers, and the device integrity score against its pass mark of 80. The status reflects the moment of capture; the PDF is not updated afterwards.
  4. 4Blockchain timestamp. SUBMITTED: the Bitcoin anchor is confirmed a few hours later, so check it then with the verifier. NOT INCLUDED on Essential unless an eIDAS or Video SnapPack credit paid for the capture.
  5. 5eIDAS qualified timestamp. REQUESTED or NOT INCLUDED. The stamp is applied after this PDF is written, so it is the presence of manifest.json.tsr and eidas_validation.json in the package that confirms it.

PROVENANCE CERTIFICATE

Source Authenticity Declaration

1
Evidence IDps_3f9c2a71-8e4b-4d1a-b6f0-5c27e9a1d304
Page titleVintage desk lamp · Example Shop
URLhttps://example-shop.com/listing/4821
Captured2026-10-14T15:30:12Z (UTC)
SHA-256 (screenshot)8dccea5217902053b636f0e105c590eb30db4280b8a7a51806110f7ff7b5177e
BrowserChrome 141
ExtensionProofSnap v1.19.5
Captured byXq7LmR2vTn9KpB4sWc1YhZ8dFa63

2Package integrity: SHA-256 hashes of all files in manifest.json (signed RSA-4096)

Live browser capture (not file upload)

3INTEGRITY CHECKSSTATUS

Status as at the time this record was generated; this document is not updated afterwards.

Automation / headless detectionPASS
NTP time verification (3 sources)PASS

maximum spread between sources: 41 ms

DNS cross-verification (2 sources)PASS
Device integrity scorePASS

integrity score 100/100 (pass threshold: 80)

4
Blockchain timestampSUBMITTED
5
eIDAS qualified timestampREQUESTED

Requested; applied if manifest.json.tsr and eidas_validation.json are present in this package

Verify online: getproofsnap.com/verify/index.html

Verify source code (MIT): github.com/proofsnap/proofsnap-verify

Captured with ProofSnap v1.19.5 · getproofsnap.comps_3f9c2a71-8e4b-4d1a-b6f0-5c27e9a1d304 · Page 1 / 1
Simplified provenance_certificate.pdf, default header, eIDAS requested. Values are examples.

Part 9

metadata.json: the technical record

The JSON files stay in English whatever the evidence language, so tools and experts can read them. metadata.json holds everything the PDF summarizes, uncut. Open it in any text editor or browser.

  1. 1Page. URL, title, capture time, user agent, referrer and the page's meta tags.
  2. 2Browser state. The page's cookies, local storage and session storage as the page could read them, in full and not masked. Treat the package as confidential.
  3. 3Connection. TLS information as far as the browser exposes it.
  4. 4Lookups. Evidence ID, the DNS results, the HTTP response headers and WHOIS. Screenshot scope and the page dimensions live here too.
metadata.json in a plain text editor, shortened. Key names are the real ones; values are examples.

Part 10

chain_of_custody.json and forensic_log.json

These two files are the record of the capture itself. forensic_log_summary.txt shows the same log as plain text for readers without a JSON viewer.

  1. 1Evidence. Evidence ID, local and NTP-corrected capture time, source URL with its hash, and page title.
  2. 2Custodian. The custodian ID (user_uid) and the SHA-256 of the account's email address, so the person who made the capture can be identified on request without printing the address.
  3. 3Integrity. How the record is sealed (sealed_in_manifest), the state of the timestamps when the package was built (ots_status reads pending when a Bitcoin timestamp was obtained, because the anchor is confirmed hours later, and not_stamped otherwise; eidas_status reads requested or not_requested) and the list of files. A legal_context block appears only when at least one of its fields, such as a case reference, was filled in.
  4. 4Link to the log. The hash of forensic_log.json and the last hash of its chain.
  5. 5Operations. Every step of the capture from capture_init on, with times, durations and results. When a video was recorded, the video steps follow the generation of the evidence PDF. The verification files, the US court declaration template, the chain of custody, hashing, signing and zipping come after the log is closed and are covered by the manifest instead.
  6. 6Hash chain. Each step carries the hash of the one before, so removing or editing a step breaks the chain.
Both files in a plain text editor, shortened. Key names are the real ones; values are examples.

Part 11

manifest.json, the signature and the timestamps

The seal of the package. Everything else is checked against manifest.json, and the manifest is checked against its signature and timestamps.

  1. 1Header. Manifest version, the evidence ID as capture_id, source URL and capture time.
  2. 2Files. The capture files with their SHA-256, SHA-512 and size. If one byte of a listed file changes, its hash no longer matches. publickey.pem and manifest.sig are listed by name only, and the timestamp files, made after the manifest, are not listed.
  3. 3Signature and key. manifest.sig is an RSA-4096 signature over the manifest and publickey.pem the key to check it. The signature binds the listed file hashes together; the key is generated for each capture and travels in the ZIP, so the timestamps are what fix the manifest in time. manifest.json.ots anchors the manifest hash in Bitcoin and shows it existed no later than the anchored block; manifest.json.tsr, when present, is the qualified timestamp.

"A time-stamping service supports assertions of proof that a datum existed before a particular time."

IETF RFC 3161 (2001), section 1, the standard behind the qualified timestamp in manifest.json.tsr

Both timestamps cover the hash of manifest.json, not the page itself, which is why every other file is checked through the manifest. To check the Bitcoin anchor by hand, see how to verify an OpenTimestamps .ots file.

manifest.json in a plain text editor, shortened. Key names are the real ones; values are examples.

Part 12

Check the package

Two ways. The scripts run on the reader's own computer and need nothing from ProofSnap. The Trust Verifier runs in the side panel or, with no account, on the ProofSnap website. Every step, with the full output explained, is in the guide on how to verify an evidence package.

  1. 1File integrity. Unzip the package and run bash verification/verify.sh (macOS, Linux) or verify.ps1 in PowerShell (Windows). It recomputes the hash of every listed file and compares it with the manifest.
  2. 2Signature. Checks manifest.sig with publickey.pem. This step needs OpenSSL.
  3. 3Timestamps. Reads the eIDAS token when present and prints the command for a deep check of the Bitcoin anchor.
  4. 4Verdict. PASS, FAIL when a check ran and disagreed, or INCOMPLETE when a tool was missing, which does not indicate a problem with the package.
  5. 5Trust Verifier. Drop the ZIP and click Verify zip file.
  6. 6Result. Integrity: match means the files match the manifest and the manifest matches its signature. Show technical verification lists every check.

verify.sh in the macOS Terminal, simplified and shortened. The file count is an example.

The Trust Verifier in the side panel.

Part 13

What to hand to a lawyer or a court

Hand over the ZIP exactly as it was downloaded. Copy files out of it to read them, but do not edit, re-save or re-zip the originals. For reading and printing, evidence.pdf is the document; the ZIP is what makes it checkable. The package supplies the integrity and time records the court can check.

  1. 1US court declaration template. When the person making the capture switched on Court filing forms, the package has a declaration template for self-authentication under FRE 902(13). A qualified person completes and signs a copy, and the rule also requires reasonable written notice to the other side before the trial or hearing. Leave the template in the package untouched: changing it would break its hash. See how to complete the US court declaration.
  2. 2Download right away. ProofSnap does not keep a copy, so the downloaded ZIP is the original.
  3. 3One ZIP per capture. Keep it with your case file and give the other side and the court the same ZIP, so everyone can run the same checks.
Side panel: the Court filing forms row before a capture, and the download after it.

Common questions

Make evidence a court can check

Install ProofSnap and capture your first page.

Install ProofSnap, 7 days free

Also available for Microsoft Edge

More guides: How to capture a web page · How to verify an evidence package · How to record video evidence · How to certify a file

Install ProofSnap, 7 days free