Radim Motycka is the founder of ProofSnap, a web evidence preservation tool designed to help investigators capture and verify online content. In this interview, Radim discusses the limitations of screenshots, the challenges of preserving dynamic web content, and the role of forensic artefacts and independent verification in web evidence capture.
You come from a software engineering background rather than traditional digital forensics. What led you to build ProofSnap?
I came at it as an engineer with a practical problem: proving what a web page said on a given day. A screenshot is a rendered bitmap with no link to the server that produced it. It contains no HTTP response, no certificate and no independent time, and anyone can edit it in minutes.
Solving that properly is mostly engineering: hashing, signing, time anchoring, observing the network layer, handling sites that resist capture. ISO/IEC 27037 supplies the requirements.
Coming from outside meant no habits to defend. I decided early that verifying our evidence must never require our software. Every package ships with verify.sh and verify.ps1, which need only OpenSSL and tools already on the machine, so the other side can confirm the hashes, the signature and the hash chain themselves. A conclusion opposing counsel reaches on their own is worth more than one they are asked to accept.
What are the main evidential limitations of using screenshots to preserve online content, and what does ProofSnap aim to capture instead?
A screenshot is trivially editable. Nothing in the file breaks when you change it, and its time is asserted by the party submitting it. It is a picture of a rendering, so it says nothing about where the content came from.
ProofSnap captures the surroundings as well: the HTML and extracted text, the images as original files with their own SHA-256, the HTTP response headers, the server certificate chain, DNS resolved through two independent resolvers and cross-checked, WHOIS or RDAP, and time from NTP consensus rather than the local clock.
Everything is hashed, the manifest is signed, and the manifest hash is anchored through OpenTimestamps and optionally a qualified eIDAS timestamp, which under Article 41(2) of the eIDAS Regulation carries a presumption of date accuracy and data integrity. A chain of custody document and a tamper-evident log of every operation sit on top. A screenshot says what one person saw. The package says what the server sent, when, and how to check both.
Modern sites can be difficult to preserve because of infinite scrolling, changing layouts and session-based content. How does ProofSnap deal with those challenges in practice?
Many applications scroll an inner element, not the window, so the tool first has to find what actually moves. Then come the things that ruin a stitched capture: sticky headers, cookie banners, scroll locks, and recommendation feeds that never end. Each is neutralised for the capture, restored afterwards, and named in the chain of custody, so every modification is already on the record before anyone asks about it.
Virtualised lists, where off-screen content leaves the DOM, get routines that walk the container in steps. Where scroll and stitch cannot work at all, capture runs through the browser debugging protocol instead. The messaging platforms and social networks people actually litigate over are the ones we built dedicated paths for.
A multi-tab mode gives each visited tab its own snapshot inside one package, so a browsing flow stays a sequence instead of a pile of unrelated files. An opt-in forensic mode observes the network during the load and writes the HTTP transactions, the response bodies and the certificate chain into capture.warc, network.har and resources/, so the saved page still opens a year after the site is gone.
A ProofSnap package can include WARC, HAR, HTML, images, hashes, timestamps, TLS and DNS information, and image provenance data. Which of these artefacts are most useful to an investigator, and what should users be careful not to over-interpret?
Four earn their place most often. The original image and resource files with individual hashes, because in copyright and counterfeit cases the disputed object is a specific file and an expert wants it at full resolution, not a recompressed picture of it. The WARC, because it uses the ISO 28500 standard and can be opened in tools nobody associates with us. The HTTP headers with the certificate chain, because they tie content to a server and a moment. And the time anchor, because everything else only proves integrity since capture.
The discipline is saying what each artefact proves and then stopping. A hash proves the file has not changed since capture. DNS and WHOIS are snapshots of that moment. Last-Modified and ETag values are assertions made by a CDN about a cached object, a lead on a file’s age, not the date a photograph was taken. A missing C2PA manifest says nothing about whether an image was generated, because most of the web strips metadata.
A capture is evidence of what was shown to a specific browser, account and location, which on personalised platforms is usually the precise thing in dispute. Stating that precisely is what survives cross-examination. Reports that blur it are where the other side starts.
As online content becomes easier to alter, delete or fake, how do you think web evidence preservation will need to change over the next few years?
Speed stops being optional. Content that matters disappears in hours, often because the person who posted it realises what they posted. If preservation needs a booked expert, it happens too late. That is why this is a browser extension a lawyer or investigator uses in the moment, not a service you send a URL to.
The argument in court moves from the content to the capture. Once everyone accepts that any image can be generated, debating whether a screenshot looks real is pointless. What stays arguable is who captured this, with what, at what time according to whom, and whether anyone outside the vendor can confirm it.
C2PA credentials are appearing in cameras and generative tools and will help asymmetrically: a valid manifest tells you something, an absent one tells you almost nothing. That direction rewards open formats, independent verification and qualified time anchoring, which is what we built the product on.
And finally, what do you enjoy in your spare time?
Golf. It is my version of meditation: a few hours where the only thing you can control is the next shot, and everything else has to wait until you are back.
ProofSnap is a web evidence preservation tool designed for investigative, legal, and compliance workflows. It captures live web content together with supporting artefacts such as WARC, HAR, HTML, images, hashes, timestamps, TLS and DNS information, and image provenance data. ProofSnap is designed to help users preserve dynamic and session-based content while maintaining a clear chain of custody and enabling independent verification of the resulting evidence package.
