Forensic OSINT alternative · compared as of October 2026
Forensic OSINT vs ProofSnap: an OSINT report, or a sealed evidence package?
In 2026, choose Forensic OSINT when the work is an OSINT investigation: continuous capture while browsing, comment expansion, identifier extraction and digitally signed PDF reports. Choose ProofSnap when anyone must be able to check the exhibit: a sealed ZIP of 11 to 15 files with a signed SHA-256 manifest, chain of custody, open-source verifier and optional eIDAS qualified timestamp.
The 7-day trial requires a credit card at sign-up and can be canceled at any time. Don't want a subscription? A SnapPack is a one-time $4.99 for 10 captures.
Quick answer
Forensic OSINT or ProofSnap?
Both are extensions for Chrome and Edge, and they answer different questions. Forensic OSINT is built around the investigation: capture while you browse, expand comments, extract identifiers and produce a digitally signed PDF report. ProofSnap is built around the exhibit: one page, one session or one recorded video becomes a ZIP of 11 to 15 files that opposing counsel can verify with an open-source tool.
What Forensic OSINT is
Forensic OSINT is a browser extension for Chrome and Edge (download page) published by TwiceSafe Software Solutions Inc., whose name also appears in the footer of the Forensic Notes note-taking platform. Its co-founder and CTO, Rob Merriott, founded Forensic Notes; the other co-founder is Ritu Gill (about page). The pricing page lists a Forensic Notes Professional subscription (valued at $588) as part of its higher plans.
The product is organized around an investigation. According to its pricing page, it offers full-page capture with "Expand & Capture", Continuous Auto-Capture and Elite Assisted Capture, comment auto-expansion on YouTube, Facebook and Instagram, key-value extraction of user IDs, likes and followers, video downloads, MHTML source code, case management and a Subject Dossier for persons of interest. PDF reports are "digitally signed, with the time recorded by the Forensic OSINT system."
It also ships a set of OSINT tools (IP lookup, username search across platforms, email header analyzer, domain-to-IP lookup, EXIF reader, timestamp decoder), and its own Hunchly vs Forensic OSINT page positions it as a Hunchly alternative with signed reports and identifier extraction.
What ProofSnap is
ProofSnap is a forensic web capture platform that runs as a side panel in Chrome and Edge. It captures a single page or a multi-tab session, can record the screen while it captures, and writes everything into one evidence ZIP that is assembled in the browser and saved to your Downloads folder.
The package
11 files on Essential, 12 on Professional, 15 on Enterprise and Company: screenshot, page.html, visible text, metadata, an evidence PDF in 29 languages, a hash-chained forensic log, chain_of_custody.json, a SHA-256 manifest signed with RSA-4096, the public key and verification scripts.
The context
NTP-verified time, DNS cross-checked against two resolvers, WHOIS/RDAP, HTTP response headers, C2PA Content Credentials on the screenshot, and a record of every banner or sticky header that was neutralized for the capture.
Chats and logged-in pages
Dedicated capture paths for WhatsApp Web, Telegram Web, Discord, Slack, Messenger and LinkedIn, in your own logged-in session. Forensic mode on Professional and above adds WARC, HAR, every loaded resource and the TLS details.
Dashboard and API
A separate ProofSnap Dashboard and REST API capture URLs on ProofSnap servers, with matters, legal hold, scheduled captures and signed webhooks.
Forensic OSINT vs ProofSnap, side by side
As of October 2026. Forensic OSINT facts come from its own pages, checked on October 23, 2026, and linked in the last row. Where Forensic OSINT does not publish a fact, the table says so.
| Feature | Forensic OSINT |  ProofSnap |
|---|---|---|
| Form | Extension for desktop Chrome and Edge | Extension for Chrome and Edge, plus a separate dashboard and REST API |
| Capture style | Manual capture, Expand & Capture, Continuous Auto-Capture, Elite Assisted Capture | On demand: single page, multi-tab session, screen recording during capture, file certification |
| Social media and chats | Comment auto-expansion on YouTube, Facebook and Instagram; focused Instagram, Facebook, TikTok and X captures; advanced capture of Facebook Marketplace and Groups, Instagram Stories and chat apps; video downloads | Capture paths for WhatsApp Web, Telegram Web, Discord, Slack, Messenger and LinkedIn |
| Main output | Digitally signed PDF report, MHTML, a Full Disclosure Package (ZIP with a manifest of hashes and a digital signature), encrypted export for air-gapped systems | Sealed ZIP of 11 to 15 files with an evidence PDF in 29 languages |
| Integrity | SHA-256 hashing at capture, digitally signed reports and disclosure packages, integrity check on import | SHA-256 of every file in manifest.json, RSA-4096 signature, hash-chained forensic log |
| Time in the report | "The time recorded by the Forensic OSINT system" | NTP-verified time in the chain of custody |
| Bitcoin anchor | Not mentioned on its site | OpenTimestamps on Professional and above, and on the standalone SnapPack |
| eIDAS qualified timestamp | Account-wide add-on quoted on request, "not in Essential or Elite", provider not named | Disig a.s., Qualified Trust Service Provider on the EU Trusted List: 10 a month on Enterprise, 5 per license a month on Company, eIDAS SnapPack from $6.99 |
| Verification by the recipient | Support guides "Validating Your Captures in Adobe" and "Verifying Forensic OSINT Digital Signatures" | MIT-licensed proofsnap-verify in the browser or as a CLI, plus verify.sh and verify.ps1 in every package |
| Chain of custody | Case management, investigator notes, Subject Dossier; audit trail from capture through export, transfer and import | chain_of_custody.json modeled on ISO/IEC 27037, with every layout change made for the capture disclosed |
| Storage | Managed cloud on Azure in the US; single-tenant cloud and on-premises options; "by default, captures are not stored in the EU" | Extension: the ZIP is saved to your own Downloads folder. API: stored by ProofSnap and downloaded from the dashboard |
| Entry price | Free tier, 100 captures a year; Essential $197 a year | Essential $8.99 a month or $80 a year; SnapPack $4.99 one-time |
| Sources | forensicosint.com/pricing, /eidas, /download, /hunchly-vs-forensic-osint, /about-us, /court, /export-import, /support; ProofSnap: pricing and API. | |
Where the time in the evidence comes from
The date on a capture is usually the first thing the other side questions. Forensic OSINT signs its PDF reports with the time recorded by its own system and offers an eIDAS qualified timestamp as a separate account add-on.
ProofSnap records three layers of time, depending on the plan:
- NTP-verified time on every capture, from a consensus of time.google.com and time.cloudflare.com, written into the chain of custody.
- A Bitcoin anchor through OpenTimestamps from Professional upward and on the standalone SnapPack. It shows that the manifest existed no later than the block it is anchored in, and anyone can check it against the public chain.
- An eIDAS qualified timestamp (RFC 3161) from Disig a.s., a Qualified Trust Service Provider on the EU Trusted List, on the Enterprise and Company plans and with eIDAS SnapPacks. It is stored as manifest.json.tsr with eidas_validation.json for long-term validation.
What the eIDAS Regulation says about a qualified timestamp
"A qualified electronic time stamp shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound."
That is Article 41(2) of the eIDAS Regulation, which applies to the qualified timestamp on the Enterprise and Company plans and in eIDAS SnapPacks. With ProofSnap, the stamped data is the manifest, which lists the SHA-256 hash of every file in the package.
Who can verify the result
A Forensic OSINT report is validated through its digital signature, for example in Adobe Acrobat, which shows whether the signed PDF has been changed. A ProofSnap package is checked file by file, and the tools for that are public:
- proofsnap-verify, MIT licensed, in the browser at the Trust Verifier or on the command line with
npx proofsnap-verify package.zip. It recomputes every hash, checks the RSA signature over manifest.json, recomputes the forensic log chain, replays the Bitcoin proof and validates the eIDAS token against the EU Trusted List. verification/verify.shandverify.ps1inside every package, which re-check the file hashes and the signature with standard tools, plus a plain-text verification guide.
A valid result means the files have not changed since they were sealed and existed no later than the time shown. To check a package yourself:
- Download the sample evidence ZIP.
- Drop it into the Trust Verifier, or run
npx proofsnap-verifyon it. - Read the result: VALID, VALID WITH WARNINGS or INVALID, with every hash, signature and timestamp check listed.
When to choose Forensic OSINT, and when ProofSnap
Forensic OSINT fits when
- you run long OSINT investigations and want pages documented as you browse;
- you work on social media profiles and need comments expanded and user IDs extracted;
- you download platform videos with a continuity report;
- your team already keeps notes in Forensic Notes or needs an on-premises deployment.
ProofSnap fits when
- the capture is an exhibit that a lawyer, a court or an opposing expert will examine;
- the recipient must be able to verify it with open-source tools;
- you need an eIDAS qualified timestamp on a plan or for a single exhibit, without having to request a quote;
- the evidence is in WhatsApp Web, Telegram Web, Discord, Slack, Messenger or LinkedIn and you want a dedicated capture path for each;
- you want captures by API or on a schedule, with matters and legal hold.
If Hunchly is on your shortlist too, read Hunchly vs ProofSnap; Hunchly, now part of Maltego Technologies, offers Hunchly Free and a Classic license at $169 a year (Hunchly pricing). For the wider market, see our roundup of the best web evidence tools in 2026 and our page for investigators and OSINT teams.
Pricing as of October 2026
Forensic OSINT prices are taken from its pricing page and its Hunchly comparison page as of October 23, 2026.
Forensic OSINT
- Free: 100 captures a year, 3 video downloads a year
- Essential: $197 a year, unlimited captures
- ELITE: price not shown on the pricing page
- Elite Assisted Capture: $1,699 a year or $159 a month as an introductory price through October 31, 2026, then $2,097 a year for new subscriptions
- eIDAS add-on: quoted on request
- Volume discounts from 20 ELITE or Elite Assisted Capture licenses
ProofSnap
- Essential: $8.99 a month or $80 a year, 100 captures a month
- Professional: $16.99 a month or $160 a year, 200 captures a month, Bitcoin anchor, forensic mode
- Enterprise: $28.99 a month or $280 a year, unlimited captures, 10 eIDAS timestamps a month, white-label PDF
- Company: $18.99 per license a month or $190 per license a year, minimum 2 licenses, 5 eIDAS timestamps per license a month
- SnapPack: $4.99 once for 10 captures that never expire
- eIDAS SnapPack: $6.99 for 1, $24.99 for 5, $49.99 for 10 stamps
The 7-day trial requires a credit card at sign-up. SnapPacks are one-time purchases with no subscription.
Install ProofSnapFrequently asked questions
Is ProofSnap a Forensic OSINT alternative?
Yes. Both are Chrome and Edge extensions built for web evidence in legal work, but with different centers of gravity. Forensic OSINT is built around OSINT investigations, with continuous capture, comment expansion, identifier extraction and digitally signed PDF reports. ProofSnap seals a page, a multi-tab session or a recorded video into a ZIP of 11 to 15 files with a signed SHA-256 manifest and a chain of custody that anyone can verify with an open-source tool.
How much does Forensic OSINT cost?
As of October 23, 2026, Forensic OSINT lists a Free tier with 100 captures a year, Essential at $197 a year, and Elite Assisted Capture at an introductory $1,699 a year or $159 a month through October 31, after which new subscriptions are $2,097 a year. The ELITE price is not shown on its pricing page. Volume discounts start at 20 ELITE or Elite Assisted Capture licenses. ProofSnap starts at $8.99 a month, or a one-time $4.99 for a SnapPack of 10 captures.
Does Forensic OSINT offer eIDAS qualified timestamps?
Forensic OSINT offers eIDAS qualified timestamps as an account-wide add-on quoted on request. Its eIDAS page states that the add-on is not included in Essential or Elite, and the page does not name the trust service provider. By default its PDF reports carry the time recorded by the Forensic OSINT system. ProofSnap provides RFC 3161 qualified timestamps from Disig a.s., a Qualified Trust Service Provider on the EU Trusted List, on the Enterprise and Company plans and through eIDAS SnapPacks from $6.99.
Can the other side verify a ProofSnap package without ProofSnap?
Yes. The open-source verifier proofsnap-verify is published under the MIT license and runs in the browser or on the command line with npx proofsnap-verify. It recomputes every hash, checks the RSA signature over manifest.json, replays the Bitcoin proof and validates the eIDAS timestamp against the EU Trusted List. Each package also carries verify.sh and verify.ps1, which re-check the file hashes and the signature.
Is ProofSnap also a Hunchly alternative?
For the exhibit step, yes. Hunchly, now part of Maltego Technologies, logs an investigation as you browse and offers Hunchly Free and a Classic license at $169 a year. ProofSnap turns the pages you need in court into sealed evidence packages. The full comparison is on the Hunchly vs ProofSnap page.
Can I use Forensic OSINT and ProofSnap together?
Yes. You can keep an OSINT tool running during research and use ProofSnap to capture the pages that matter for the case file, so counsel receives a sealed package with its own verification tools.
Can ProofSnap capture a whole browsing session, like Continuous Auto-Capture?
Yes, in session mode. Each tab you actively view during the session gets its own forensic snapshot (screenshot, page.html, visible text, metadata, chain of custody and evidence PDF) inside one sealed package, and Manual mode records a video while you browse until you click “Stop and save”.
Does ProofSnap capture chats and messaging apps?
Yes. ProofSnap has dedicated capture paths for WhatsApp Web, Telegram Web, Discord, Slack, Messenger, and LinkedIn profiles and company pages. They scroll the conversation or profile in steps and stitch it into one screenshot, in the operator's own logged-in session.
Author: Radim Motycka, founder of ProofSnap, who designs the evidence package format, the chain of custody and the verification tools.
Published and last checked: October 23, 2026.
Method: every Forensic OSINT fact is taken from its own public pages, linked in the comparison table and accessed on October 23, 2026. ProofSnap facts are checked against the product itself.
Seal your next exhibit in your own browser
Install ProofSnap in Chrome or Edge and capture the page you need. The 7-day trial requires a credit card at sign-up and can be canceled at any time.