What Is a Forensic Certificate?
When TrueSnap captures a web page, it generates a forensic certificate — a PDF report that summarizes everything about the capture in a human-readable format. This certificate is designed to be presented to lawyers, judges, arbitrators, or anyone who needs to understand and verify the evidence without technical expertise.
The certificate serves as a bridge between the raw technical data (hashes, HAR files, DOM snapshots) and the legal requirements for evidence admissibility.
The Sections of a TrueSnap Certificate
1. Capture Summary
The top section provides an at-a-glance overview:
- Captured URL — The exact web address that was captured
- Capture timestamp — The precise date and time (in UTC) when the capture was performed
- Page title — The title of the web page as it appeared in the browser
This section answers the most basic questions: what was captured and when.
2. Visual Evidence
The certificate includes a thumbnail or reference to the full-page screenshot. This is the visual representation of what the web page looked like at the moment of capture.
While the screenshot alone isn't sufficient as evidence (for reasons outlined in TrueSnap's documentation on screenshot limitations), it provides essential visual context when paired with the technical verification data below.
3. SHA-256 Hash
This section displays the cryptographic hash of the complete evidence package:
- Hash algorithm — SHA-256 (the industry standard)
- Hash value — The 64-character hexadecimal string uniquely identifying the evidence package
This hash is the core of the integrity proof. Anyone can recompute the hash of the evidence package and compare it with this value. If they match, the evidence has not been altered since capture.
4. Blockchain Verification
The blockchain section contains:
- Network — The blockchain used (Polygon)
- Transaction hash — The unique transaction ID on the blockchain
- Block number — The specific block containing the transaction
- Blockchain timestamp — The time recorded by the blockchain (independent of TrueSnap's own timestamp)
- Verification link — A direct URL to view the transaction on Polygonscan
This section proves when the evidence hash was permanently recorded. Because blockchain timestamps cannot be retroactively altered, this establishes an immutable timeline.
5. TLS Certificate Information
This section documents the website's SSL/TLS certificate at the time of capture:
- Domain — The domain the certificate was issued for
- Issuer — The Certificate Authority (e.g., Let's Encrypt, DigiCert)
- Validity period — When the certificate was valid from and until
- Certificate chain — The hierarchy of trust from root to end-entity certificate
TLS certificate data proves that the captured content came from the legitimate server for that domain — not a spoofed or impersonated site.
6. Evidence Package Contents
A listing of all files included in the evidence package:
- screenshot.png — Visual capture of the page
- page.html — Complete DOM snapshot (the page's HTML source)
- network.har — Network traffic log recording all server communications
- certificate.json — Full TLS certificate chain data
- metadata.json — Capture environment details and hash information
- report.pdf — The forensic certificate itself
Each file serves a specific evidentiary purpose, and together they provide a comprehensive, cross-verifiable record.
7. Capture Environment
Technical details about the conditions under which the capture was performed:
- Application version — The version of TrueSnap used
- Operating system — The OS and version on the capture machine
- Browser engine — The rendering engine and its version
- Security measures — Confirmation that Developer Tools were disabled and integrity checks passed
This section addresses chain-of-custody concerns by documenting the controlled environment in which the capture occurred.
How to Use the Certificate
For Legal Proceedings
When presenting evidence in court or to a lawyer:
- Provide the complete evidence package (ZIP file) along with the certificate
- Reference the certificate as the summary document that explains the technical evidence
- Highlight the blockchain timestamp as independent proof of when the evidence was captured
- Offer the verification steps — The opposing party or the court can independently verify the hash and blockchain record
For Internal Investigations
For corporate compliance, HR investigations, or internal disputes:
- Archive the complete package in your document management system
- Use the certificate as the reference document in reports and communications
- Include the hash value in any chain-of-custody documentation
For Insurance Claims
When filing claims that require evidence of online content:
- Attach the certificate to your claim submission
- Reference the capture timestamp to establish when the evidence existed
- Keep the full package in case detailed technical verification is requested
Common Questions
Is the certificate itself tamper-proof?
The certificate PDF is part of the hashed evidence package. Any modification to the certificate would change the package's hash, causing a mismatch with the blockchain record.
Can I regenerate a certificate if I lose it?
The certificate is included in the evidence package ZIP file. As long as you have the package, you have the certificate. TrueSnap also stores capture records in your account for retrieval.
Will courts accept this certificate?
The certificate itself is a summary document. Its strength comes from the underlying technical evidence — the hash, blockchain timestamp, network logs, and DOM snapshot — which satisfy the authentication, integrity, and chain-of-custody requirements that courts demand for digital evidence.
Key Takeaway
The forensic certificate makes complex technical evidence accessible. It translates cryptographic hashes, blockchain transactions, and network forensics into a format that anyone can read and verify. When presenting digital evidence, the certificate is your starting point — it tells the story of what was captured, when, and how its integrity can be proven.