Documentation & Evidence

Learning Objectives

• Explain why OSINT findings must be captured at the moment they are found
• Capture a web page properly: URL, timestamp in UTC, full-page screenshot, source code, and context
• Generate and verify SHA-256 hashes on Linux, macOS, and Windows
• Keep an investigation log and a chain of custody record that someone else could follow
• Weigh the benefits of public web archives against their OPSEC cost

Why Documentation Matters

“If you didn’t document it, it didn’t happen.” OSINT deals with information that changes constantly:
- Posts get deleted, edited, or made private
- Accounts get suspended or renamed
- Websites get updated, taken down, or moved
- Search results change from day to day and from person to person

Good documentation does four jobs:
1. Preservation: you still have the evidence after the original disappears.
2. Reproducibility: a teammate, client, or reviewer can follow your steps and reach the same finding.
3. Credibility: every claim in your report points to captured evidence.
4. Legal defensibility: if findings end up in court, a disciplinary process, or law enforcement hands, you can show what you collected, when, how, and that it hasn’t been changed.

Before You Start: Set Up the Case

A few minutes of setup saves hours later.

Sync your clock and use UTC

Timestamps are only useful if they’re accurate and unambiguous.
- Make sure your system clock syncs with a time server (NTP). The Berkeley Protocol specifically recommends this so that time-related metadata in collected files is accurate.
- Record all times in UTC (Coordinated Universal Time), written like 2026-09-16T18:42:05Z. This avoids confusion about time zones and daylight saving time, especially when a team spans locations.

# Linux: check whether the clock is synchronized
timedatectl status
# Print the current time in UTC (ISO 8601 format)
date -u +"%Y-%m-%dT%H:%M:%SZ"

Create a case folder structure

CASE-2026-014_CompanyX/
├── 00_admin/          # scope, authorization, rules of engagement
├── 01_log/            # investigation log, chain of custody
├── 02_evidence/       # original captures — never edit these
│   ├── web/
│   ├── images/
│   ├── video/
│   └── documents/
├── 03_working/        # copies you annotate, crop, or analyze
├── 04_analysis/       # link charts, ACH matrices, timelines
└── 05_report/         # drafts and final report

Use a consistent file naming convention

<date>_<time>Z_<platform>_<short-description>.<ext>

Example: 2026-09-16_1842Z_linkedin_companyx-it-staff-page.png

What to Capture for Each Item

The Berkeley Protocol on Digital Open Source Investigations (covered below) lists what to collect for each online item. Its first three items are described as the minimum standard for evidence in court; collecting all of them is best practice:

The protocol also notes that for internal work that won’t be used as evidence, a screenshot or PDF may be enough. The more a capture might matter later, the more thorough it should be.

Screenshots done right

• Capture the full page, not just what fits on screen.
• Firefox: right-click → Take Screenshot → Save full page
• Chrome/Edge: open DevTools → Command Menu (Ctrl+Shift+P) → Capture full size screenshot
• Make sure the URL is visible, or record it right next to the file.
• Include the date and time (system clock visible, or recorded in your log).
• For social media, capture the post and the profile it came from.
• For long threads or comment sections, capture all of it, not just the part that supports your theory.

Saving the page itself

Screenshots show what you saw; saved pages preserve the underlying content.
- SingleFile (free, open-source browser extension): saves a complete page, including images and styles, as a single HTML file you can open offline.
- ArchiveWeb.page (free, from Webrecorder): records your browsing session and exports it as a WARC or WACZ file, standard web archive formats. Captures stay private on your machine unless you share them.
- View source: Ctrl+U in most browsers, then save the source as a text file.

Video

Video is often deleted quickly. If your scope allows downloading it (check the platform’s terms of service and your authorization; see Module 2), the open-source tool yt-dlp can save the video along with its metadata:

# Download a video plus its metadata (JSON) and thumbnail
yt-dlp --write-info-json --write-thumbnail "https://www.example.com/video/12345"

Record negative results too

“Searched for jordan.lee@companyx.com on Have I Been Pwned: no results (2026-09-16T19:05Z)” is a finding. Negative results stop teammates from repeating work and show the reader how thorough you were.

Public Web Archives: Useful, But Not Free of Cost

Services like the Wayback Machine’s Save Page Now and archive.today create a copy of a page on a third-party server.

Benefits
- An independent, timestamped copy that anyone, including a client, a court, or a journalist, can check.
- The copy survives even if the original is deleted and your own files are lost.

OSINT/OPSEC costs
- The archived copy is public. Anyone can look up which captures exist for a URL, including the target.
- A sudden new capture of an obscure page (like a small company’s staff page or a personal profile) can signal that someone is investigating.
- You generally can’t take a public capture back once it’s made.
- You’re also making a public copy of someone else’s content, which may include personal information (think about minimization; see Module 2).

A practical rule: capture privately by default (screenshots, SingleFile, ArchiveWeb.page). Use public archives when independent verification matters more than stealth, and when your scope and OPSEC plan allow it. See Module 8 OPSEC for more on how investigators give themselves away.

Hashing: Proving Files Haven’t Changed

A hash is a fixed-length fingerprint calculated from a file’s contents. Change even one bit of the file and the hash changes completely. If the hash you calculate today matches the hash you recorded at collection time, the file hasn’t been modified.

SHA-256 is the widely used standard today. Older algorithms like MD5 and SHA-1 are considered broken for security purposes because researchers can create different files with the same hash. The Berkeley Protocol doesn’t lock in one algorithm; it tells investigators to use the currently accepted standard, since standards change over time.

Linux

# Hash one file
sha256sum 2026-09-16_1842Z_linkedin_companyx-it-staff-page.png

# Hash every file in the evidence folder and save the list
cd 02_evidence/web
sha256sum * > ../../01_log/web-hashes.sha256

# Later: check that nothing has changed
cd 02_evidence/web
sha256sum -c ../../01_log/web-hashes.sha256

macOS

shasum -a 256 2026-09-16_1842Z_linkedin_companyx-it-staff-page.png

Windows (PowerShell)

# Hash one file
Get-FileHash .\2026-09-16_1842Z_linkedin_companyx-it-staff-page.png -Algorithm SHA256

# Hash every file in a folder and save the results to a CSV
Get-ChildItem .\02_evidence\web -File |
  Get-FileHash -Algorithm SHA256 |
  Export-Csv .\01_log\web-hashes.csv -NoTypeInformation

What a hash does and doesn’t prove

• It does prove the file is unchanged since the hash was recorded.
• It doesn’t prove when the file was captured, who captured it, or that the content is true. That’s what your investigation log and verification work are for.
• Hash at the moment of collection. A hash calculated a week later only proves the file hasn’t changed since then.

The Investigation Log

The investigation log is a running, timestamped record of everything you did. The test: could someone else follow it and reproduce your findings?

Log template

(Shortened hashes are for display only; always record the full hash.)

Tips

• Write entries as you go, not from memory at the end of the day.
• Record the exact search query, including operators.
• Note the research persona, VPN exit location, or environment used (see Module 8).
• Note pivots: “Found username jlee-sysadmin in commit metadata → searched username on WhatsMyName.”
• Record decisions: “Did not investigate employee’s family accounts: out of scope.”

Chain of Custody

The Berkeley Protocol defines chain of custody as the chronological documentation of who has had custody of a piece of evidence, along with its control, date and time, transfer, analysis, and final disposition. In practice: for every evidence item, you can show who had it, when, and what they did with it.

It matters most when findings may go to court, law enforcement, HR, or a regulator. For a typical pentest OSINT report it’s still good practice, because it builds the habit.

Chain of custody record template

## Evidence Item: EV-014
- Description: Full-page screenshot of Company X LinkedIn IT staff page
- Original file: 02_evidence/web/2026-09-16_1842Z_linkedin_companyx-it-staff-page.png
- SHA-256 at collection: <full hash>
- Collected by: A. Rivera
- Collected at: 2026-09-16T18:42Z
- Collection method: Firefox full-page screenshot, research persona RP-02, case VM
- Source URL: https://www.linkedin.com/company/companyx/people/

| Date/time (UTC) | From | To | Action / purpose | Hash verified? |
|---|---|---|---|---|
| 2026-09-16T18:42Z | — | A. Rivera | Collected | Yes |
| 2026-09-18T14:00Z | A. Rivera | B. Chen (QA reviewer) | Peer review, read-only copy | Yes |
| 2026-09-20T16:30Z | A. Rivera | Company X CISO | Delivered with final report (encrypted) | Yes |
| 2026-12-20T00:00Z | A. Rivera | — | Securely deleted per engagement data-retention terms | n/a |

Storing Evidence Safely

• Never edit originals. Keep them in the evidence folder and do all cropping, highlighting, and annotation on copies in the working folder.
• Encrypt evidence at rest (encrypted drive or encrypted container) and in transit.
• Limit access to people who need it.
• Back up using the rule the Berkeley Protocol cites from IT experts: at least three copies, on at least two different types of storage, with at least one copy in a different location.
• Check integrity periodically by re-verifying hashes; storage media degrade over time.
• Follow retention rules. Delete evidence securely when the engagement’s data-retention period ends. OSINT collections often contain personal information that shouldn’t be kept longer than necessary (see Module 2 on minimization).

Tools for Capture and Note-Taking

Tools change often; confirm features and pricing before relying on them.

The Berkeley Protocol

The Berkeley Protocol on Digital Open Source Investigations is a practical guide published by the UN Office of the High Commissioner for Human Rights (OHCHR) and the Human Rights Center at UC Berkeley School of Law. It was launched in December 2020 (the UN publication is dated 2022). It was written for investigations into violations of international criminal, human rights, and humanitarian law, but its practices are widely treated as a benchmark for any OSINT work that needs to hold up to scrutiny.

Six phases of an investigation

1. Online inquiry: searching for and discovering information
2. Preliminary assessment: deciding whether an item is relevant and worth collecting
3. Collection: capturing the item
4. Preservation: storing it safely so it stays intact and usable
5. Verification: establishing whether it is accurate and authentic
6. Investigative analysis: drawing conclusions

These phases repeat as new information opens new lines of inquiry, much like the OSINT cycle from the intro lecture. The protocol says investigators should document their activities during every phase.

Guidance worth teaching directly

• Collect content when removal is likely, even before verification is finished; you can refine later.
• Capture the URL, HTML source, and a full-page capture at minimum when material may be used as evidence.
• Record collection data: collector name, IP address, research persona used, and timestamp, with the clock synced to a time server.
• Add a hash at the moment of collection, using the currently accepted algorithm.
• Maintain the chain of custody through a proper preservation system.
• Keep multiple backups and check hashes over time to detect degradation.
• Its Annex IV includes a sample online data collection form, a good model for student templates.

Key Terms

• Capture: saving a copy of online content (screenshot, saved page, video) at the time it’s found
• UTC: Coordinated Universal Time, a single reference time zone for timestamps
• NTP: Network Time Protocol, used to keep system clocks accurate
• Hash (SHA-256): a fixed-length fingerprint of a file’s contents; any change produces a different hash
• Investigation log: a timestamped record of every step taken in an investigation
• Chain of custody: documentation of who handled evidence, when, and what they did with it
• WARC / WACZ: standard file formats for web archives
• Evidentiary (original) copy: the untouched original capture, kept separately from working copies
• Berkeley Protocol: UN OHCHR and UC Berkeley guide to professional digital open source investigations

Key Takeaways

• Capture it when you find it; online content disappears
• Minimum capture: URL + full-page screenshot + source code, timestamped in UTC
• Hash at collection (SHA-256) to prove files haven’t changed
• Log every step, including searches that found nothing
• Never edit originals; work on copies
• Public archives are public; weigh verification value against OPSEC
• Chain of custody: who had it, when, and what they did with it
• The Berkeley Protocol is the benchmark for evidence-quality OSINT

References

• Berkeley Protocol on Digital Open Source Investigations — OHCHR (publication page)
• Berkeley Protocol on Digital Open Source Investigations (PDF) — OHCHR
• Berkeley Protocol — Human Rights Center, UC Berkeley School of Law
• Launch of the Berkeley Protocol on Digital Open-Source Investigations — OHCHR (December 2020)
• Hunchly
• Hunchly — OSINT Tools Library
• Forensic OSINT
• ArchiveWeb.page — Webrecorder
• OSINT Tools: Capturing Evidence & Notetaking — Forensic Notes