Step-by-step guide

Forensic mode: the page's network, archived

In 2026, ProofSnap forensic mode is one switch in the side panel on the Professional, Enterprise and Company plans. After the normal capture it reloads the page under Chrome's debugger and adds a WARC web archive, a HAR network log, each loaded resource with its SHA-256 hash and, on HTTPS pages, the site's TLS certificate details.

By Radim Motycka, Founder and Lead Engineer of ProofSnap, who built the forensic network capture this guide describes ·

Plans

Professional, Enterprise, Company

Adds

WARC, HAR, resources, TLS details

Extra time

One page reload

Which plans include forensic mode

Forensic mode comes with the Professional, Enterprise and Company subscriptions (compare them in how to choose a plan). Captures without it are still complete: forensic mode only adds files to the package.

Professional
Included
Also included in the 7-day Professional trial.
Enterprise
Included
Also included in the 7-day Enterprise trial.
Company
Included
For every member of the team.
Essential
Not included
The switch is visible but gray, with an Upgrade to enable link.
SnapPacks without a subscription
Not included
eIDAS and Video SnapPacks do not unlock it either.

What forensic mode adds to the package

ProofSnap forensic mode archives up to 300 requests from the reloaded page, up to 15 MB per response and 200 MB in total, and gives every saved resource its own SHA-256 hash in resources.json. These are the files it adds to the evidence package:

capture.warcNetwork archive (WARC)
Every successful response from the reload with headers, body and the matching request, plus redirect hops
ReplayWeb.page or another WARC replay tool
network.harNetwork log (HAR)
Requests and responses with headers and status codes, no bodies
Chrome DevTools, Network panel, Import HAR file
resources/In the ZIP only
Each response body as its own file
The usual program for that file type
resources.jsonArchived sub-resources
Index of resources/: URL, status, type, size, SHA-256
Any text editor
certificate_details.jsonTLS certificate details
TLS version, cipher, certificate issuer, subject, validity, domain names
Any text editor

Before you start

  • ProofSnap is installed and you are signed in to an account on a Professional, Enterprise or Company plan.
  • The page is open in the active tab, as you want it captured.
  • You know how a normal capture works. If not, start with How to capture a web page.

Step 1

Find forensic mode in the side panel

Open the page you want to capture and click the ProofSnap icon to open the side panel. The capture options sit under the blue Capture page snapshot button. With video recording off, forensic mode is the switch right under Record capture video; with it on, the video options and Reload page before capture come in between.

  1. 1Forensic mode: network archive (WARC + HAR + resources + TLS). It is off by default and resets to off each time you open the side panel, so it runs only when you turn it on for a capture.
With video off, forensic mode is the switch under Record capture video. Side panel recreated from the extension's actual interface; plan and numbers are examples.

Step 2

Switch forensic mode on

Click the switch so it turns blue. Set it before you click the capture button: the switch is locked while a capture runs or a video is recording.

  1. 1Switched on. The next capture adds the network archive to the package.
  2. 2The small “i” icon. Hover over it to see what the mode adds and a note that the browser will show a debugging bar.
  3. 3Upgrade to enable. On Essential, on a SnapPack without a subscription, or on an Essential trial, the switch is gray and this link opens the plans.

On the Essential plan

Top: Professional plan; the explanation appears when you hover over the small “i” icon. Bottom: Essential.

Step 3

Capture as usual and let the page reload

Click Capture page snapshot. ProofSnap first takes the normal capture of the page as you see it: screenshot, HTML, text and metadata. Then, as the last capture step, it attaches the browser debugger, reloads the tab with the cache switched off and records every request and response during that fresh load. When the load is finished and the network has been quiet for a moment, it detaches the debugger and builds the package.

  1. 1Chrome's debugging bar. Chrome displays a bar saying that ProofSnap started debugging the browser. This is expected, and the bar disappears when the capture ends. Do not click Cancel: it stops network recording, and the network archive will be missing or incomplete. The rest of the package is still created.
  2. 2Capturing... Leave the tab alone until the button is blue again. ProofSnap waits up to 45 seconds for the reloaded page to finish loading.
Chrome's own debugging bar and the reloading tab, simplified and drawn in Chrome's colors; the exact wording depends on your Chrome version. Side panel recreated from the extension's actual interface.

Step 4

Find the new rows in the download table

When the capture is done, the download table lists four extra rows on an HTTPS page and three on a plain HTTP page, which has no certificate. Each blue icon downloads the file in its row; Download zip file saves the whole package with all of them inside.

  1. 1Network archive (WARC). capture.warc: the responses from the reload with their headers and bodies, each paired with the request that produced it.
  2. 2Network log (HAR). network.har: the same requests and responses as a list, with headers and status codes but without the bodies.
  3. 3Archived sub-resources. resources.json: the index of the resources/ folder in the ZIP, one entry per request.
  4. 4TLS certificate details. certificate_details.json: the HTTPS connection and the certificate the site presented. See step 6.
Download table after a forensic capture on the Professional plan, with no eIDAS timestamp and no video. The four highlighted rows appear only with forensic mode.

Step 5

Know what each file is for

All forensic files sit in the root of the ZIP next to the rest of the package. Every one of them, including every file in resources/, is hashed and listed in manifest.json, so the signature and the timestamps cover them and the Trust Verifier checks them like any other file. See how to verify an evidence package and how to read an evidence package for the rest of the files.

  1. 1capture.warc. WARC is the standard format for web archives (ISO 28500). The Library of Congress describes it this way: “The WARC (Web ARChive) format specifies a method for combining multiple digital resources into an aggregate archival file together with related information” (Library of Congress, WARC format description). Open it in a replay tool such as ReplayWeb.page to browse the archived load.
  2. 2network.har. HAR is the format browsers export network logs in. Open it in Chrome DevTools: Network panel, then Import HAR file (Chrome DevTools Network reference). Each entry with a body names its file in resources/.
  3. 3resources/ and resources.json. Every response body from the reload as its own file, numbered in load order. A number is skipped when no body was saved, for example for an empty tracking beacon or a failed request. resources.json lists each request with its URL, status, type, size, SHA-256 hash and file name.
  4. 4certificate_details.json. Plain JSON; any text editor can open it.
The same capture opened in the file manager. Forensic files in bold; resource names are examples.

Step 6

Read the TLS certificate details

A normal capture records whether the page used HTTPS, but a browser extension cannot read the site's certificate. Forensic mode can, because it watches the load through the debugger. The file certificate_details.json describes the connection used for the first secure response during the reload, which is normally the page itself.

  1. 1protocol, cipher, key_exchange. The TLS version and the encryption the connection used.
  2. 2issuer, subject. Who issued the certificate and which name it was issued to.
  3. 3valid_from, valid_to. The validity period of the certificate, in UTC.
  4. 4san_list. All domain names the certificate covers.
  5. 5certificate_transparency_compliance. Whether Chrome found the certificate compliant with Certificate Transparency, the public logging system for TLS certificates.
Field names exactly as ProofSnap writes them; values are examples.

Common questions

Capture the page and its network

Install ProofSnap and turn on forensic mode with a Professional, Enterprise or Company plan.

Install ProofSnap, 7 days free

Also available for Microsoft Edge

More guides: How to capture a web page · How to record video evidence · How to choose a plan

Install ProofSnap, 7 days free