Web Preservation by Screencast

A couple weeks back I posted about the challenge of preserving web-based evidence. Sharon Nelson (of Sensei Enterprises and Slaw) has linked over to some great input from Ben Wright (of SANS Computer Forensics) on the topic, including a blog post and this video.

This seems to do a good job of meeting most of the requirements I identified. What do you think?


  1. This looks interesting, Dan. It clearly offers a way to present evidence conveniently. But I can’t see how it is so much more authoritative than a paper printout or a static screen capture. (I know very little about forensic work, both technical and legal, so my questions are genuinely naive.) Is the thought here that because the images move, they can’t have been faked? Because if that’s the case, it’s not perfectly convincing; I’m guessing it’d be a day’s work to fake something like this if the stakes were high enough and one were into that sort of thing.

    Doesn’t it all come down to trusting the human being who is testifying or otherwise certifying evidence? This would be true most of the time in the old paper days also, no? It would be possible then, though, to detect many or most forgeries. But it seems that nowadays it’s much more difficult to detect forged websites-at-a-fixed-time. This, surely, makes the trusted human source even more critical than ever.

    It might be a good idea to establish an official, or officially accepted, ‘trusted source’ who could make the copies and record the electronic facts, enabling them to be used uncontradicted as proof in litigation. Maybe such a thing already exists?

  2. Thanks Simon.

    I agree with the essence of your comment. The subject of the video will need to testify to its authenticity. The talking image seems hard to fake, but the statement as to time could be challenged and the web capture image seems like it could be faked.

    I also like the solution because it does a better job of capturing context than screen caps and printouts.

  3. Ben Wright, author of the video discussed here has asked me to post the following comment on his behalf. Thank you!


    I made another demonstration video, depicting an investigator narrating what he sees live in an online chat session with a criminal. http://legal-beagle.typepad.com/wrights_legal_beagle/auditor/ The video of live interaction makes for much more compelling evidence than a mere screenshot or chat log.

    The video is like an affidavit, a formal statement by a witness. The investigator formally signs it with his voice.

    The video might be hearsay, but it helps the investigator remember exactly what happened. It also helps to prevent the investigator from delivering false testimony later.

    Hearsay like this video might be directly admissible in less formal proceedings, such as a parole hearing. What do you think? Comments welcome. –Ben