How to Preserve and Document OSINT Evidence

Findings are only as strong as your ability to prove them later. Content gets deleted, edited, or denied; a raw screenshot proves little on its own. This method captures evidence with the provenance — source, time, and integrity — that lets someone else trust and reproduce it.

What you'll need

• Archiving and capture tools from the Archives category
• A consistent method or framework from the General frameworks category
• A structured place to store captures, notes, and a running log

Steps

1. Capture the whole context, not just a crop. Save the full page, the URL, and the surrounding content — not a tight screenshot that hides the source. A full-page capture plus the live URL is far harder to dispute.
2. Push it to an independent web archive. Submitting the URL to a public archive creates a timestamped, third-party copy you don't control — strong corroboration that the content existed as you saw it.
3. Record the metadata. Note the exact capture time (with time zone), the URL, the tool used, and — for files — hashes and any embedded metadata. This is what turns a picture into evidence.
4. Hash your captures. Compute a checksum (for example SHA-256) of each saved file and log it. A matching hash later proves the file hasn't been altered since capture.
5. Keep an audit trail. Log every step in order: what you did, when, where the item came from, and what you concluded. Anyone should be able to follow your log and reach the same place.
6. Corroborate before you rely on it. Preservation proves a thing existed; it doesn't prove the thing is true. Seek a second independent source for any claim that matters.

Common pitfalls

• Screenshots with no source. A cropped image with no URL, time, or archive is easy to dismiss and impossible to reproduce.
• Trusting a copy you control. Evidence you can edit is weak; an independent archive and a logged hash are what make it credible.
• Confusing preservation with proof. Capturing a post proves it was posted, not that its contents are accurate — corroborate separately.

Verify your result

Your evidence holds up when each item has a source URL, an independent timestamped copy, a recorded hash, and a log entry — and when another person could follow that trail to the same material and conclusion.