If you did not preserve it, it did not happen: evidence handling for OSINT

Evidence handling is the least glamorous part of open-source intelligence and the part most likely to decide whether the work matters. Courts, regulators and disciplinary panels do not ask whether a finding was clever. They ask whether the evidence is authentic, complete and unchanged since it was collected.

Online evidence is volatile

Web content changes constantly and often deliberately. Posts are edited and deleted, accounts are renamed or suspended, websites are taken down, and the same page can show different content depending on where, when and how it is viewed. Subjects who realize they are being examined frequently clean up their footprint within hours.

That volatility drives our first rule: preserve before you analyze, and preserve before anyone takes action that could alert the subject. A takedown request, a cease-and-desist letter or an internal interview can all trigger deletion. If the capture is not already complete, the evidence may be lost permanently.

What a defensible capture contains

A screenshot shows what a page looked like. A defensible capture proves it. Every item collected through our platform, Aldervane Capture, is recorded with the following elements:

• A full rendering of the page or post as displayed, including content below the fold.
• The underlying source, including the HTML and the resources the page loaded, so the capture can be examined beyond its appearance.
• Request and response details, including the exact URL, any redirects and the server responses received.
• Original media files at the highest available resolution, separate from the rendered page.
• Collection metadata: the retrieval time in UTC from a synchronized clock, the collecting environment, the analyst and the case reference.
• Context: how the item was found, from which earlier item it was reached, and why it was collected.
• A cryptographic hash of every file, computed at the moment of capture.

Hashing and the chain of custody

A cryptographic hash function turns any file into a fixed-length fingerprint. SHA-256 produces a 64-character value that changes completely if even a single bit of the file changes. If the hash recorded at capture matches the hash of the file presented in court a year later, the file has not been altered in between.

Hashing is only meaningful if it happens at the right moment and the record of it is protected. Our practice is:

1. Compute the hash automatically at the moment of capture, before any analyst can open or edit the file.
2. Write the hash, with its timestamp, to an append-only log stored separately from the evidence itself.
3. Work only on copies. The original capture is never modified, annotated or re-saved.
4. Re-verify hashes whenever evidence is exported, and record the verification.
5. Log every access and transfer, so the chain of custody shows who handled each item and when.

A hash proves integrity, not authenticity. It shows that a file has not changed since capture. It does not show that the content was genuine in the first place. Authenticity is established separately, by corroboration, metadata analysis and the documented context of collection.

Screenshots are not enough

Screenshots are easy to make and easy to dispute. They capture only what was on screen, they lose the underlying data and they can be fabricated by anyone with an image editor. A screenshot on its own invites the question every opposing lawyer will ask: how do we know this is real?

We capture pages in a standard web archive container format, such as WARC, that records the requests and responses exchanged with the server, so the page can be replayed and inspected exactly as it was delivered. Rendered images and documents are kept alongside for readability, but they are presentations of the evidence, not the evidence itself.

Media files need special care. Many platforms re-encode uploaded images and video and strip their embedded metadata. Where the original file is available from another source, such as a personal website or a file-sharing link, we capture that version too, because it may retain metadata that the platform copy lost.

Social media and dynamic content

Social platforms are built for scrolling, not for preservation. Content loads dynamically, comments are collapsed, and stories disappear after a day. Capturing them properly means:

• Expanding threads and comments fully before capture, and recording that this was done.
• Recording stable account identifiers, which usually persist when a handle or display name changes.
• Capturing profile pages, follower context and account metadata alongside individual posts.
• Saving video and audio as original files, not screen recordings, wherever possible.
• Noting what the content looked like to the viewing account, since visibility can differ between logged-out visitors and research personas.

Collecting without contaminating

The act of collection can change what is collected. Visiting a profile can notify its owner. Following an account alters its follower list. A search from a corporate network can reveal the investigating organization to anyone who monitors their own traffic.

We collect through managed attribution: non-attributable research infrastructure that cannot be traced to us or to the client. Research personas are used only to observe. They never deceive anyone into providing information, never engage subjects and never like, share, follow or comment in ways that would alter the evidence or the subject's behavior. The research environment is documented so that its configuration can be explained if the collection is ever challenged.

Documentation that survives cross-examination

Evidence is rarely attacked directly. More often the attack targets the process: what exactly did the investigator do, in what order, with what tools, and could they have missed or distorted something? The answer has to be on paper, written at the time.

• Contemporaneous notes recording each search, pivot and decision, with timestamps.
• Tool and environment records, including versions and configuration, so results can be explained.
• Reproducible steps that an independent examiner could follow using the preserved evidence alone.
• Negative results, because searches that found nothing are often as important as those that did.

When a matter goes to court, our investigators can provide witness statements describing how the evidence was collected and preserved, supported by the capture log and the hash records.

Admissibility is decided by the court. Our job is to make sure the evidence never gives it a reason to say no.

Handover, retention and disclosure

Evidence eventually leaves the investigator's hands, and the handover is where many chains of custody break. Our evidence bundles are exported with a manifest that lists every item, its original hash, its capture time and its grade. The recipient can verify every file against the manifest without trusting us or our tools, using any standard hashing utility.

Bundles are structured for the way they will be used. A referral to law enforcement emphasizes the material that supports a request for legal process. A litigation bundle is organized for disclosure, with privileged analysis separated from the underlying captures. A platform takedown package is built so that an enforcement reviewer can verify each account in minutes.

Retention is part of evidence handling too. Holding data longer than necessary creates risk for clients and for the people in it. Unless a legal hold applies, we delete case data 90 days after an engagement closes. Where litigation or a prosecution is anticipated, we agree a hold with the client's counsel in writing, and the evidence is kept intact, with its hashes and custody log, for as long as the hold requires.

Seven common mistakes

1. Relying on screenshots taken on a personal device, with no record of time or source.
2. Collecting from a personal or corporate account that alerts the subject or exposes the investigator.
3. Editing, cropping or annotating the original file instead of a copy.
4. Hashing evidence days after collection, or storing hashes alongside the files they protect.
5. Recording handles but not the stable identifiers behind them.
6. Taking action against a subject before the capture is complete.
7. Keeping no record of searches that returned nothing.

Before you rely on an item

Grading is covered in Attribution is a standard of proof. The standards that govern every collection we make are published on our standards and ethics page.