Open-source evidence capture checklist

Open-source material fails in court for one reason above all others: nobody can say precisely how it was collected. This checklist condenses our articles on chain of custody for open-source evidence and ISO/IEC 27037 into steps a collector can follow under time pressure. It is published under CC BY 4.0 so that teams can paste it into their own standard operating procedure, adapt it, and keep the attribution.

Before capture

1. Record who is collecting, and under what authorisation. The collector is an identified person or a documented automated process, and the authority for the collection is written down before it starts.
2. Capture before you engage. Any interaction with a subject — a follow, a message, a connection request — can trigger deletion. Preserve first.
3. Record the operating environment. Research persona, VPN exit, language and region settings all shape what a platform serves; content that only appears to certain profiles is a real cross-examination line.
4. Decide, and record why, whether you collect or acquire. Collection takes the device or medium itself; acquisition produces a verified copy. Live systems, volatile data and proportionality decide which applies, and online material is acquired.

At capture

5. Record provenance. The precise source: full URL, platform, account, and the context needed to relocate it, or to explain why it no longer exists.
6. Record the capture time in UTC from a reliable clock. Keep content-internal times, such as post timestamps and EXIF data, clearly distinguished from the capture time.
7. Record the method. The tool and technique — full-page capture, API export, WARC crawl, video screen recording — including tool versions where they matter.
8. Capture more than the pixel. A flat screenshot proves little. Prefer formats that retain structure and metadata — WARC or MHTML archives, API responses, platform data exports — with a rendered capture alongside for human readers.
9. Hash immediately. Compute the cryptographic hash (SHA-256 as the working default) as part of the capture step and log it with the UTC time; a hash created at capture is the anchor everything else hangs from.
10. Corroborate independently where the stakes justify it. A third-party archive capture of the same URL made near the same time is powerful corroboration that the content existed publicly as claimed.

After capture

11. Preserve originals unaltered. Analysis happens on working copies; storage, transport and every handover protect the integrity of the original.
12. Document every transformation. Storage location, access, copies, conversions and redactions extend the same record. A documented transformation is never a problem; an undocumented one can taint the exhibit.
13. Verify hashes at every handover. A handover checklist that re-checks the hash at each step is what proves the artifact is unchanged since capture.
14. Keep the handling auditable, repeatable, reproducible and justifiable. A third party can examine the record; the same procedure gives the same result; a different tool still gives the same result where applicable; and every choice, including the options rejected, can be defended.
15. Align the procedure with named standards. ISO/IEC 27037 for identification, collection, acquisition and preservation, ISO/IEC 27043 for the wider investigation process, and the Berkeley Protocol on Digital Open Source Investigations for the online-specific craft — so the person defending the work has something recognised to point at.

The test of the whole record is boring by design: months later, a person who was not involved can reconstruct exactly what was collected, when, how, by whom, and prove it unchanged. How Next Sight applies this across engagements is described on the compliance page.

Frequently asked questions