WebPreserver is a browser-based online evidence collection tool used by investigators, legal teams, OSINT analysts, and brand protection professionals to capture and preserve web content as forensically-defensible evidence.
It installs as a browser plugin and captures whatever is visible in your browser, including the full structure, context, metadata, and authentication data required to use that content as evidence in court or an investigation.
In this article, we’ll cover what WebPreserver captures, how it handles different content types, and how the technology can produce evidence that holds up under legal scrutiny when screenshots and basic capture tools fall short.
If You Can See It, WebPreserver Can Capture It
WebPreserver's capture scope is straightforward: anything accessible through a web browser can be captured, preserved, and authenticated as evidence.
Each capture produces output files containing the full visual content, page structure, metadata, timestamp, source URL, SHA-256 hash value, and digital signature. These outputs are suitable for legal review, court submission, eDiscovery production, and investigative reporting.
Website Content WebPreserver Captures
Static and Dynamic Webpages
WebPreserver captures individual webpages in their complete rendered state, including all styling, images, embedded media, and layout elements. This includes pages built with JavaScript frameworks that render content dynamically, pages with infinite scroll, and content that loads progressively as a user interacts with the page.
Pages with interactive elements, including dropdown menus, accordion sections, tabbed content, and collapsible panels, are captured with their visible state intact.
These capabilities are core to the value that WebPreserver brings to investigations and evidence collection, as basic capture tools and screenshots frequently miss this kind of content entirely, producing incomplete records that misrepresent what was actually on the page.
Full Websites and Entire Domains
Beyond individual pages, WebPreserver includes a bulk capture capability for preserving entire websites or defined sections of a domain. It can capture linked pages, subdirectories, and associated assets while maintaining page layout, styling, and navigation context.
This is particularly useful for IP enforcement cases, fraud investigations, and situations where a target site may be taken down following legal action. An entire domain can be preserved before a takedown notice is issued, producing a complete authenticated record of what existed before removal.
Pages with Pop-Ups, Overlays, and Embedded Windows
Significant content and interactions happen inside pop-up windows, modal dialogs, and embedded content frames on websites. WebPreserver captures these elements, including content that exists inside embedded windows rather than the primary page view.
Most basic capture tools render these elements as blank space or miss them entirely, omitting user experiences and interactions that can be central to a case.
Authenticated and Session-Based Pages
Because WebPreserver operates as a browser plugin, it captures any content visible to the logged-in user at the time of collection. This includes content behind authentication walls and session-specific views, provided the investigator has lawful access through their own browser session.
This is a meaningful advantage over API-based collection tools, which can trigger platform security responses, flag examiner accounts as suspicious, and leave an activity trail that exposes the investigation.
A flagged account mid-investigation can alert the subject, compromise the case, and force the team to start over with a clean account, if the content hasn't already been deleted by then. WebPreserver's browser-based method leaves no such trace.
Complex Sites That Defeat Basic Crawlers
Some sites are built in ways that break conventional capture tools. Heavy JavaScript frameworks, aggressive bot-detection, non-standard architectures, and content that only renders after user interaction all cause basic crawlers to produce incomplete or broken outputs.
Because WebPreserver operates through the browser and captures content as it actually renders, these sites are treated no differently than any other. What the browser displays is what WebPreserver captures.
Social Media Content WebPreserver Captures
Public Profiles, Pages, and Accounts
WebPreserver captures full public social media profiles, including profile photos, bio information, account handles, follower counts, linked accounts, and all other content visible on the profile page at the time of capture.
Individual Posts and Complete Timelines
A single post can be captured in isolation, or WebPreserver can capture posts in a certain time range, or even entire social media timelines.
Timeline and post captures include visible engagement data such as likes, reactions, shares, and comment counts. Where other tools require manual scrolling and repeated individual captures, WebPreserver handles the full timeline automatically. WebPreserver can also bulk capture timeline posts by date range on Facebook, Instagram, Twitter/X, TikTok, LinkedIn and YouTube.
In active cases, the time spent on manual collection is time the subject has to delete, edit, or restrict their content.
Comments, Replies, and Nested Threads
There is plenty of social media evidence lurking in the replies, sometimes even more than the original post. WebPreserver automatically expands collapsed comment threads, nested replies, and "show more" sections without requiring manual interaction, to ensure you don’t miss anything.
For example, a Facebook timeline that appears as 500 pages in its default collapsed state may expand to over 3,000 pages of content when all threads are fully visible. Doing that manually takes hours, sometimes days. Any content missed during manual expansion is absent from the evidentiary record, making automated expansion essential in your evidence collection workflow.
Engagement Indicators and Contextual Metadata
WebPreserver preserves the full visible context of each post, including usernames, account handles, timestamps as displayed on the platform, hashtags, mentions, emoji, reactions, share counts, and other platform-specific elements. Strip that context away and a post becomes an unattributed block of text. Courts need to see who said it, when, on what platform, and what the public response was. Without that surrounding data, the evidentiary value of the content could drop significantly.
Platform-Specific Capture Logic
WebPreserver is built with platform-aware capture functionality for major social networks.
Rather than treating every platform as a generic webpage, WebPreserver understands how each platform loads and displays content, including platform-specific UI patterns, dynamic content loading, and display formatting.
This produces captures that accurately reflect what a user would have seen at the moment of collection, rather than a flattened or broken rendering. A capture that doesn't look like the platform it came from is a capture that will be questioned.
Platforms with native capture support include Facebook, Instagram, X (formerly Twitter), LinkedIn, TikTok, YouTube, and Reddit, among others.
Wondering if WebPreserver can capture a unique or complex platform not listed here? Jump to the Custom Scripts Section.
Video and Rich Media WebPreserver Captures
Embedded Website Videos
WebPreserver captures embedded videos on websites, preserving the video file as well as its surrounding page context. Basic capture tools either skip embedded video entirely or produce a static thumbnail with no playable file.
For cases involving advertising claims, fraudulent product promotions, or any situation where a video is the primary piece of evidence, a static image of a video player is not evidence, it's a placeholder.
Platform-Native Video Formats on Social Media
WebPreserver automatically captures platform-native video content, including Facebook Reels, Instagram Stories, YouTube Shorts, TikTok videos, and live stream recordings.
Videos are captured in MP4 format and saved directly to the local hard drive, alongside all associated content including thumbnails, captions, surrounding engagement data, and the timestamp as displayed on the platform.
This eliminates the need for separate screen recording tools or third-party video capture software. It also protects you against significant evidentiary risk: video files collected through screen recording or basic export methods can be challenged by opposing counsel as potentially manipulated. A video file without platform context is harder to attribute, harder to date, and easier to dismiss.
Each WebPreserver video capture includes the posting account, caption, engagement data, and tamper-proof authentication chain that ensure your video files are defensible evidence.
Content Across the Open and Dark Web WebPreserver Captures
Because WebPreserver operates through the browser rather than through platform APIs or server-side crawlers, its capture scope extends to any content a browser can render.
On the open web, that includes review platforms, forums, blogs, marketplaces, paste sites, and community discussion boards. For brand protection teams and investigators monitoring reputational threats, content from these sources carries the same authentication standard as social media captures.
On the dark web, content accessed through Tor Network via the Brave browser is treated no differently than any other browser-visible content. If the page is visible in the browser, WebPreserver can capture it, authenticate it, and produce it in a legally defensible format.
For investigators working cases involving dark web marketplaces, illicit forums, or other onion services, evidence collected from those sources carries the same SHA-256 hash, timestamp, and digital signature as any other WebPreserver capture.
What Every WebPreserver Capture Includes
Authentication and metadata are built into every capture by default. There is no additional step required to apply authentication, and nothing is captured without it.
Every WebPreserver capture includes:
SHA-256 hash value. A cryptographic fingerprint of the captured content generated at the moment of collection. The hash value proves that the content has not been altered since capture. Under the Federal Rules of Evidence, demonstrating that a digital file has not been modified since collection is a core requirement for admissibility.
Timestamp. Applied using a certified Stratum-1 atomic clock in compliance with the eSign Act. This provides verifiable proof of when the content was captured. Without a certified timestamp, the timing of a capture is the investigator's word against opposing counsel's doubt.
Digital signature. A 256-bit PKCS1 v1.5 digital signature is applied to each capture. Combined with the timestamp and hash value, this creates a complete authentication chain that addresses the three questions every court asks about digital evidence: is it genuine, has it been altered, and when was it collected.
Source URL and page structure. The exact URL of the captured content, along with the full HTML structure of the page, is preserved in the output file.
Collector identity. The IP address of the device used to collect the evidence is recorded, supporting chain of custody documentation.
Export formats. Captures are exportable as OCR PDF (fully searchable, suitable for legal review and court production), MHTML (preserves full page context and is searchable), and ISO standard WARC files (the archival standard for web content, ensuring long-term accessibility and format integrity).
WebPreserver Bulk Capture and Large-Scale Evidence Collection
For investigations requiring large volumes of content quickly, WebPreserver's bulk capture functionality allows investigators to collect entire social media timelines, complete websites, or defined sets of pages without manual intervention for each item.
This matters for large-scale fraud investigations, IP enforcement across multiple infringing accounts, and litigation where a complete record of a subject's online activity is required.
At scale, manual collection is slow and a liability. Every hour spent clicking through pages is an hour the subject has to delete content, every gap in the record is a gap opposing counsel will find, and every missed post is a piece of evidence that no longer exists.
Repeating and Structured Capture
Some investigations require the same sources to be captured repeatedly over time, tracking how content changes, what gets deleted, and what gets added. WebPreserver supports structured, repeatable capture workflows that produce consistent, comparable records across multiple collection points.
Custom Scripts for Complex and Non-Standard Pages
For websites and content that are particularly complex, WebPreserver’s custom scripts give investigators direct control over how a capture is processed.
A custom script is a set of JSON instructions that tells WebPreserver how to handle a page (controlling things like scroll targets, delay between screenshots, infinite scroll handling, and how sticky or fixed page elements are managed) and what automations to run during capture ( including clicking buttons, removing elements, and downloading files, using CSS selectors to target specific page elements).
WebPreserver includes a built-in script library with ready-made templates for common scenarios, including capturing Telegram chats, removing Bluesky sticky banners, and hiding Wayback Machine overlays. These can be used as-is or as a starting point for custom configurations.
For investigators working cases that involve platforms or page structures outside the norm, custom scripts eliminate the need for manual workarounds or separate tools.
Complete, Defensible Evidence in Two Clicks
Screenshots get challenged. Basic exports get questioned. Manual collection introduces gaps that opposing counsel will find. The combination of comprehensive capture scope and built-in cryptographic authentication is what separates WebPreserver from the tools most investigators and legal teams currently rely on.
If you can see it in your browser, WebPreserver can capture it, authenticate it, and produce it in a format that holds up in court.
Schedule a Demo to see WebPreserver in action.
Frequently Asked Questions About WebPreserver Capture Capabilities
What is WebPreserver used for?
WebPreserver is an on-demand online evidence collection tool used to capture and preserve web content, social media posts, videos, and other browser-accessible content as forensically defensible evidence for investigations, litigation, eDiscovery, and brand protection.
What types of content can WebPreserver capture?
WebPreserver captures websites (individual pages and entire domains), social media profiles and posts, comment threads and replies, embedded videos, platform-native video formats including Reels, Shorts, and Stories, pop-ups and embedded windows, dark web content accessed through Tor-enabled browsers, and any other content visible through a web browser.
How is WebPreserver different from taking a screenshot?
Screenshots cannot prove when they were taken, cannot verify the content hasn't been altered, and capture only what is visible on screen at one moment. WebPreserver captures the full page, timeline or website, including hidden threads and dynamic elements, applies a SHA-256 hash, a certified timestamp, and a digital signature, and exports in formats accepted for legal and eDiscovery use.
How is WebPreserver different from other web capture tools?
Basic web capture tools produce visual representations of pages without underlying structure, metadata, or cryptographic authentication. API-based tools can trigger platform security responses and leave activity trails that expose investigations. WebPreserver operates through the browser, captures complete content including dynamic and interactive elements, and applies authentication automatically to every capture.
What authentication does WebPreserver include with each capture?
Every capture includes a SHA-256 hash value, a timestamp from a certified Stratum-1 atomic clock, a 256-bit PKCS1 v1.5 digital signature, the source URL, full page structure data, and the collector's IP address.
What export formats does WebPreserver support?
Captures can be exported as OCR PDF, MHTML, and ISO standard WARC files.
Can WebPreserver capture video content?
Yes. WebPreserver automatically captures and downloads embedded website videos and platform-native formats including Facebook Reels, Instagram Stories, YouTube Shorts, and TikTok videos, saving them locally as MP4 files with full platform context and authentication data.
Can WebPreserver automatically expand collapsed comments and threads?
Yes. WebPreserver automatically expands collapsed comment threads, nested replies, and "show more" sections without manual interaction.
Can WebPreserver capture dark web content?
Yes. WebPreserver captures any content visible through a browser. Content accessed through Tor or similar browsers is captured with the same authentication and export options as any other browser-visible content.
What are custom scripts in WebPreserver?
Custom scripts are JSON instructions that tell WebPreserver how to handle complex or non-standard page captures. They can automate actions like clicking buttons, removing elements, and managing scroll behavior on complex or unique pages. WebPreserver has a built-in script library to provide ready-made templates for common scenarios.
Who uses WebPreserver?
WebPreserver is used by private investigators, digital forensics analysts, OSINT and SOCMINT professionals, eDiscovery specialists, litigation support teams, paralegals, attorneys, corporate counsel, brand protection teams, and law enforcement investigators.
