C.E.R.T.O. — Certification and Online Trace Collection — AcquisizioniForensi.it

==================================================================
         WEB PAGE ACQUISITION REPORT
==================================================================

ACQUISITION INFORMATION
-------------------------
Acquired URL: https://certo.acquisizioniforensi.com/demo/
Domain: certo.acquisizioniforensi.com
Remote server IP: 77.37.83.187
Acquisition code: 2e089745-bd9e-4561-9e3d-1696768504d0

TIME INFORMATION
----------------------
Start time (UTC): 2026-09-28 15:34:02.543Z
Navigation end (UTC): 2026-09-28 15:34:30.384Z
Start time (Europe/Rome): 2026-09-28 17:34:02 GMT+2
Navigation end (Europe/Rome): 2026-09-28 17:34:30 GMT+2
Note: the end shown is when the operator closed the navigation. The full-page re-capture, the network checks, the timestamp and the packaging happen afterwards, each dated in the log.

TIME SYNCHRONIZATION (NTP)
--------------------------------
NTP server: time.google.com
NTP synchronized: Yes
System offset: 14 ms
NTP round-trip: 65 ms
Assessment: Clock synchronized (3/3 sources, consensus offset: 14ms, max dev.: 17ms)

CLIENT NETWORK INFORMATION
--------------------------
LAN IP address: 192.168.1.20
Public IP address: 93.67.184.82
Default gateway: 192.168.1.1

SERVER AND CONTENT DELIVERY NETWORK
-----------------------------------
Acquired host:                   certo.acquisizioniforensi.com
Contacted address:               77.37.83.187
                                 (observed by the browser during the connection)
Content delivery network (CDN):  Hostinger hCDN — conclusive identification
Edge node:                       srv-edge4
Origin server:                   not observable from this capture point
                                 (this is precisely what an interposed CDN conceals: the contacted address is the edge node, not the origin server)
DNS A records:                   77.37.83.145, 91.108.98.80
DNS AAAA records:                2a02:4780:32:29f:d417:3348:b9e4:188e, 2a02:4780:23:be6b:a9fc:4c40:4731:4d12
DNS records measured at:         2026-09-28T15:34:39.060Z
DNS discrepancy:                 the contacted address does not appear among the A records: the name resolves to a rotating set of addresses, and the two measurements were taken at different moments

Signals detected:
  - header x-hcdn-request-id: c9f8e7dc73402d834ff11d4b5f692c2b-srv-edge4
  - header x-hcdn-cache-status: DYNAMIC
  - header x-hcdn-upstream-rt: 0.075
  - server: hcdn

The contacted address is a datum observed during the capture and can be
verified in network/network.har (serverIPAddress field). The DNS records and
the signals can be verified in network/dns-lookup.txt and
network/http-headers.txt.

==================================================================
                    FILE INVENTORY
==================================================================

ACQUISITION FILE
-----------------
logs/acquisition-log.at-report.txt
  Size: 42.92 Kb
  MD5:    f6c3fdd1bf8025e6554b822b3db69187
  SHA1:   620bad9ca88f59fd9a654a1bad4022f3f17f4302
  SHA256: 1de4b782e8e9216623dedb365dde8e3c06834861b8095ee8ec9c1c88b5ffa9e4
  SHA512: 8cd53ab444338d6f7764327757269620e641fe6e0fbe555383026f97129c7be73c4d26020ea30b160b05e8af000f439abf08de85b7f4b18ac7a2be27cf0cc227
  Snapshot of the log at report time. The full log (logs/acquisition-log.txt) continues until the bundle is closed and is covered by the signed manifest.

HTML CODE
-----------
resources/site-structure/certo.acquisizioniforensi.com/dom-snapshot.html
  Size: 6.63 Kb
  MD5:    1bd73b0e15085b1984dabd0276f115af
  SHA1:   b2a4954558f39f4d27940ca3c83c0c5ba1fef19d
  SHA256: 37b0f0311ed5361cf453642a5956a9ae8c59baa0d9335e9c162d99ee9f5791ed
  SHA512: 3f5d1b01c22005ed489bb808f879928e76df6c0f5f437599482045783962578bbb47e8b7a182bc322f60b6184188d24a3f326e07411e1d6f60eb56fc03d752e9

HTTP HEADERS
-----------------
network/http-headers.txt
  Size: 1.59 Kb
  MD5:    c0219fb97f9cbf3287b71055e5ecd699
  SHA1:   98b383873330300a3c521a766acbe768a2e244d8
  SHA256: 779026c5e07497e189e12a5c24dd4cb9bcb6594add3617ee021fbe53622eb373
  SHA512: f11ddd74efc725df5c0cb5cfc27246876bf39001923e1670ed126e8e880e1fb835518e92ba13eb939c43d31934394ded50bb0b12b78629149e3334b4fe4811ed

EXTRACTED LINKS
-------------
reports/links.txt
  Size: 912 Bytes
  MD5:    c7194d60987d391d9d80b72fda510e28
  SHA1:   dce71235e6d9f1b76568ff5cb271c3df063b2674
  SHA256: 4cbfed9dc2ad8f48df2cb658ab40a2d7064e80e71a0c01adcab84feff8dadebb
  SHA512: 12044d0570495b73d456e353ea814e4f7f6b6a6acf8d95480b9a185d17fc41984b6dcbf8c3725867eeb1a88c34c05540ae254f5c3d5b0c5e020bdc8799e1f86d

COOKIES
------
reports/cookies.txt
  Size: 1.03 Kb
  MD5:    dc84a6ff97328156200e143bfb132043
  SHA1:   0be0eb5633228e61008c86d189ef540f32ed0e21
  SHA256: 008fa553471759b2e212aa834d13b7f4b6bf092decb0d77bf2db9d71f0dd696f
  SHA512: 835995b42ad525807969a8a0ba1b32f1a3e69b23cf71bb8d7b22ee3601e58fcba55ffe72388029b0b1721c64fda242ff448d8874e003e32209430c6b0eaba05d

HAR NETWORK ARCHIVE
-----------------
network/network.har
  Size: 30.86 Kb
  MD5:    73429eb813205876a9c82e80d30e2653
  SHA1:   0e73be45366a11a0ca93aa44fec284c6fd262862
  SHA256: 256f6b070b275ea9730c7ed501046c274f03af7e1b042f76f4c7d1ae1529873f
  SHA512: a8b51572bea7a5ac85e9740bfbeba4f7d5638a3921398d8125318353bf78ee100544a66e5daa9603dbfcd118f52cf1aea8d31a2e4e425455080ac76fae940690

DNS QUERY
---------
network/dns-lookup.txt
  Size: 232 Bytes
  MD5:    66c2b1155edb3c8621df4d37d4825c8b
  SHA1:   a6266f51477514974bd93778ba35a7616709200e
  SHA256: d83c7a86b533e2def656e0d7712c1797357a7d854e7b34ee49a83e515cadb447
  SHA512: 73511383c9a3c7d9793e6be3a48d674b118c20130bef333d7eb346b4fd14077c9ab5b5207a11c14da8f551e229a4cfeda0272408dbfcb24b3fb78d17fe8c2a68

VIDEO RECORDING
-------------------
evidence/video/recording_2026-09-28T15-34-06-662Z.webm
  Size: 4.19 Mb
  MD5:    e5ed33c4d3aa94f4bab6e32c276e0380
  SHA1:   5c650082f7ea27f4d1e0c0954dd79b1d372f0013
  SHA256: 711748ca40702a0a0af1348f3a38304c28161c83854550a039b28b8fae3bc6ae
  SHA512: bf6ba49e7c7444646ccd2e16af00864eaf2395c5fb07485bdb4a57cb96cd8e1faca7bb7e5eb487fb146e36b3b9f84ed0c05ff74b41789cc1b25b5092fc8066ec


SCREENSHOTS
----------
reports/screenshots.txt
  Size: 6.71 Kb
  MD5:    5ac3454c82708eb647694b217bbffb4b
  SHA1:   662f6b598376a24174301cba9f861c4473a53da9
  SHA256: 81a14860b84b33aa25e060b525d19ee20a2cea962926c199e7b8e804b15ddfac
  SHA512: 02a6e1d54e9ff47fc3ffc8eb50e17156bf5adc1d41542fa558dc9d99baaffb3fab4130daa9877f0d0cdbca7df0ce87eaea4439b6ad7d4fa5e30c3c6650f940b5

DOWNLOADED RESOURCES
-----------------
reports/downloads.txt
  Size: 11.31 Kb
  MD5:    d6e6cac0c1b2a8f7282a0015ad0c22e8
  SHA1:   4a4a0dd2104f8954d9715ff4217c377f07f5a8fc
  SHA256: 61f5f3effe134c3315acc8de9f410e4a737d7f33d66849a406bee674561abca4
  SHA512: 643e5b61cb2011158758d82db4f3e5ba9e66a30faef6d79ec81d098c1d60df5c3186da4784010401dbcdfbfe7d959079bb001a7fc738c33d80c7b6b5eefc6322

SYSTEM INFORMATION
------------------------
reports/system-info.txt
  Size: 6.63 Kb
  MD5:    0c5fe1fb67325fde23959fa873213ae9
  SHA1:   25dd7f46040e792fc987db8c0094b14f27670c68
  SHA256: 9261308f58c47194b274958a8dc3e352ad42e0373eaeaf916be3fe73019ff039
  SHA512: 86ec4a3ce01f445ae318f1dbb2f731f027f5b4dd851e07299ca98d6f9ea6f7bdc01a98602ed31e3050165d9fc39eafbcd07e219cc17e02d1bda64af9e6fc888b

TRACEROUTE
----------
network/traceroute.txt
  Size: 1.02 Kb
  MD5:    c7ed502bec7e7a56ff6f0fa1ef518bc4
  SHA1:   767f41bcc9edc59011cc94b0aa64f470231eb31c
  SHA256: 240442f340439dea2e8cef7cdb4c3c4ebc08b25a008d63ff29af62aebff4c671
  SHA512: a66af6359b6bff72e38fe7fc662dbf83a3378f8de9b4159eaedaf4e64bf0f89385b497b38118c61c2432e5388cd062f62f566b8b087d08a722f0ed738c369559

WHOIS
-----
network/whois.txt
  Size: 873 Bytes
  MD5:    8515c7ec8bd117ae4236dc3d394b03d1
  SHA1:   5ad0b608852e87d2990043df4e286de1ca07318f
  SHA256: af4bbe6d40cc0f76c450ce4f61e1fe97dbda99b86e01877059e218e87664fc92
  SHA512: 43045134780e9c554aec5d8fb448195d66ed92243fdace5806cf5e7a1d12eeea688a9735144c439f0fb72253f79c08898510d770ab5a0e060841e08b4b74ec2f

SSL/TLS CERTIFICATES
-------------------
tls/ssl.txt
  Size: 1.54 Kb
  MD5:    431756e8c815c46893620c8540ca0ecc
  SHA1:   8f015841a313988efd08aeb2e4b7766e14fcd167
  SHA256: 81ed2384d2efcba8064a84205ea52794bdc66c7476256eaa1254d4f74e550256
  SHA512: 4f95315aa0452104d185cf9b81f829633252424dd0b6aa02776e68e9568023ebbe75ade83b1461914ff8efc26dcd7f2a3cf22a32cb0d791d07ad185c8ced6c0d


==================================================================
                  ACQUISITION OPERATOR
==================================================================

Identification of the subject who performed the acquisition, for
chain of custody purposes (ISO/IEC 27037 §6.5). Data retrieved
from the /app/auth-app endpoint associated with the API key used.

-- Identification data --
Name:               Giovanni
Surname:            Carrieri
Username:           giovannicarrieri
Account ID:         1
Email:              email@acquisizioniforensi.it
PEC:                n/d

-- Professional data --
Business name:      Giovanni Carrieri
Tax code:           [omesso]
VAT number:         07669810728



==================================================================
                  DECLARED FORENSIC SCOPE
==================================================================

Reference best practices: ISO/IEC 27037:2012 §6.4 (Justifiability),
NIST SP 800-86 §3.1, ACPO Good Practice Guide for Digital Evidence.
The operator declared in advance the object, the scope and the
acquisition method BEFORE starting. This declaration is an integral
part of the evidence and is reported here for forensic completeness.

Scope mode:         Domain and subdomains
Initial URL:        https://certo.acquisizioniforensi.com/demo/
Object:             Sample page acquisition
Method:             Viewport and full-page screenshot + DOM HTML snapshot + Referenced resources + Network HAR + Session video + WACZ replay archive + Timestamp Public TSA RFC 3161 (Sectigo/DigiCert/GlobalSign)
Declared moment:    2026-09-28 17:33:58 (UTC+02:00)

-- Scope statistics --
Logical pages visited:         1 (recommended limit: 10)
In-scope navigations:          0
Out-of-scope navigations:      0
Blocked navigations (operator refusal): 0
Auth-flow navigations (login/OAuth):    0

------------------------------------------------------------------
                  LOGICAL PAGES VISITED (1)
------------------------------------------------------------------

For each visited page the forensic artifacts are collected in the
dedicated sub-directory (pages/NNN_domain_path/). Hybrid strategy:
  - viewport + DOM: captured real-time at the moment of the visit
  - fullpage: captured post-hoc at the end of the acquisition,
    by navigating again to the URL (temporal drift noted).

#001 [ IN  ] https://certo.acquisizioniforensi.com/demo/
         First visit:      2026-09-28T15:34:02.543Z
         Last visit:       2026-09-28T15:34:44.585Z
         Trigger:          initial
         Sub-directory:    pages/001_certo.acquisizioniforensi.com_7e721598/
         Artifacts:
            - pages/001_certo.acquisizioniforensi.com_7e721598/screenshot-viewport.jpeg (real-time @ 2026-09-28T15:34:10.242Z)
            - pages/001_certo.acquisizioniforensi.com_7e721598/page.html (6591 bytes, real-time @ 2026-09-28T15:34:10.087Z)
            - pages/001_certo.acquisizioniforensi.com_7e721598/screenshots-fullpage/ (4 sections, post-hoc @ 2026-09-28T15:34:49.447Z, drift 42s)

------------------------------------------------------------------
End of forensic scope section.
------------------------------------------------------------------


==================================================================
                    SSL/TLS CERTIFICATES
==================================================================

SSL/TLS CERTIFICATES SUMMARY
---------------------------
tls/ssl.txt
  Size: 1.54 Kb
  MD5:    431756e8c815c46893620c8540ca0ecc
  SHA1:   8f015841a313988efd08aeb2e4b7766e14fcd167
  SHA256: 81ed2384d2efcba8064a84205ea52794bdc66c7476256eaa1254d4f74e550256
  SHA512: 4f95315aa0452104d185cf9b81f829633252424dd0b6aa02776e68e9568023ebbe75ade83b1461914ff8efc26dcd7f2a3cf22a32cb0d791d07ad185c8ced6c0d

tls/certificates/certo.acquisizioniforensi.com-ssl-ca-3.crt (Domain: certo.acquisizioniforensi.com)
  Size: 1.56 Kb
  MD5:    631edc349f55429c4abc9ceccaf1c5da
  SHA1:   80af2dde065d356f51ad450f100f7524b084bc7c
  SHA256: 4dadd67f1de699b79466b1e672187e6caef5e0fdab4404d649ad8188a1b2d9a1
  SHA512: f845abec9558949a7eb9bb0462b635f518f0bfb2d050f28e86f3a5c21ea5922b6dc251f8e9cea7c1ff95e4d6ce764cd9dad58842827477a1ad05408cf5eae58e

tls/certificates/certo.acquisizioniforensi.com-ssl-ca-4.crt (Domain: certo.acquisizioniforensi.com)
  Size: 1.89 Kb
  MD5:    118ecd744d864b32ffdb48b2e29f1d7f
  SHA1:   4de9627fe9ace4acce27eaa1a0837cd3db55704b
  SHA256: 22b557a27055b33606b6559f37703928d3e4ad79f110b407d04986e1843543d1
  SHA512: b819e7965412dbeecc6417b1e57356d9b10e8e2feb0db1165947e7e1b7d882de226afb8457475f5107393a981d902c7f405500cadb6f61bd2acbca5d8c7cc1f4

tls/certificates/certo.acquisizioniforensi.com-ssl-intermediate.crt (Domain: certo.acquisizioniforensi.com)
  Size: 944 Bytes
  MD5:    0219dc33c83dd130f3cb543c19dc9f66
  SHA1:   2390ec3f597a48a8dd034f02f9bbb310d853804c
  SHA256: a1809226d01db1ae8df803a73a31a97330a924e3059c42b4be599449c43c5119
  SHA512: b501a9f44f7fdcb5472d40c7869e1631fd5420fd8234a134b660f490c9342f8a43cad765c8f21764de31f9e302568d15988341eccba171d8b1fd75e19af49ce6

tls/certificates/certo.acquisizioniforensi.com-ssl-leaf.crt (Domain: certo.acquisizioniforensi.com)
  Size: 1.30 Kb
  MD5:    217a8b42127d340bfb01a52479c6a453
  SHA1:   46f11d505f4ec27a3ba1c005bf97ea6f8d593375
  SHA256: 9b2cd775506f4f988e4f5fdfe63c286ed3dcd4f93888b67b313609d0903ee330
  SHA512: 6767cb317c6bb93219adb1f4993a1e716654ee48c3fe1cf5713c5619ccda58bb960cfa498abd5fedb3e8905bc6fc32a741197ee612b32e1827c4fb766525c68a

tls/certificates/certo.acquisizioniforensi.com-ssl-root.crt (Domain: certo.acquisizioniforensi.com)
  Size: 981 Bytes
  MD5:    b035ba33898506a8f62b70fcad8052d7
  SHA1:   b0142f2314de900906b27522a80b245f7fc5676d
  SHA256: 2681e97e939cab7cde4fad1dc733fc7c99e39a203190e8f298e1c02ab431b1e9
  SHA512: 3828bdfed624db29d2cf337f054b3b58c31f6d6018123dae0fb96402a1d314320578b8257e973d868f375ad84f617e300520c0e9173262f32158d48854a37628

tls/certificates/certo.acquisizioniforensi.com_51fc280e.crt (Domain: certo.acquisizioniforensi.com)
  Size: 1.30 Kb
  MD5:    3a275e1bf3e8a430362febe40fddeca3
  SHA1:   22f9e54ace80df0aac6f4731b83cf4a6f916636b
  SHA256: 381d20d36ca97da0b4e2aa0c96e167906b31a3f3ab4c9b0a2de21e84c36ce269
  SHA512: c5fac7653f4cf2f69fb93782d192882f3b98a2285e836367981566c386a4ae9c61c7f768beaf3766023bd929611dbc8220533db6a1ca816f5c574a48cff654df

tls/certificates/certo.acquisizioniforensi.com_51fc280e_chain.crt (Domain: certo.acquisizioniforensi.com)
  Size: 6.63 Kb
  MD5:    73e0ca5fcdd2d10ffbcb834cebf239da
  SHA1:   28f237ee425f0406a419351eef54fdd44ce5a15d
  SHA256: 2f894e91124fe1898ad710c2e877ecd162348086831ff03e7e7f350a5fb7acae
  SHA512: 313195620734789ba3b0c5d9c12fb060e018176e26155040b00a23e81c0920ffd694d45a6b83a3131d7495fa75182ca18e34a5d666529b3b7752d2be84643fc6


==================================================================
                    USER INTERACTIONS
==================================================================

USER INTERACTIONS REPORT
------------------------
reports/interactions.txt
  Size: 3.83 Kb
  MD5:    5545e543ba30975c5ff8a1f411b3fe98
  SHA1:   2a14d800275278a18fbd29024382fe673863e874
  SHA256: 654610170d1e88b5c1bb87e13ef5a02c51e777212117208c98849dc4d2b82e7b
  SHA512: 7aa2766202e74bfd3198b72cb4b497043ebb84c554cb08386ccaedacd0c4be744ff25e253a65cace08e5c5e918609c176e8521c2c765507193bfc834d89ed944

evidence/interactions/user-interactions.json (Raw data)
  Size: 12.29 Kb
  MD5:    1493065bbe0a9ec951f35363b885da8e
  SHA1:   43ab385849f453e042832f95bedc0498d1d382c2
  SHA256: 87ac5f656f7bd478923a22bbdb1e81681088a69456f49de80fd1e33248bab6fa
  SHA512: c95224c0b71c9c154b1c3fd647f8694b2113917a9a91a2e45cc40bc726eabfe08e92b8186469e961f7541415ccf1e105a109e2b5d78ee44b5549e877004bd079


==================================================================
                    WACZ ARCHIVE
==================================================================

WEB ARCHIVE (WACZ)
-----------------------------
evidence/ReplayWebPage.wacz
  Size: 1002.40 Kb
  MD5:    76ccd4f550f11821b26deb3b7b20844d
  SHA1:   bddda2755645e4b5740a67b8265cbf230dcd603d
  SHA256: 61e6c906ee5b1dbd91ed65db7287a6cf0527436cfe9831a894f114922e81768b
  SHA512: c53a2cc04b6dd0a94d3e4608cfc8422ba0431405b1c32d8643094e5ac2dd8204c5a14b99da439fa8be0d91b9ed9c9a30e8337490c6918df01db761c8d39ac507


==================================================================
                    VIDEO RESOURCES
==================================================================

1 video file(s) reassembled from DASH/fMP4 fragments.

evidence/video-resources/video_completo_1.mp4
  Size: 496.64 Kb
  MD5:    2a3480a466021368eb4ea749a3cca821
  SHA1:   4337cbb12311cdfc79ddbdc2125c4375bed1b92e
  SHA256: 0817cc7f06c1782289bd234a7fef6ac2299ba7aa33b2247eeb57d765c2534dd1
  SHA512: 5def33f2374a188457876bd12bd61e70908269e37d2fd6f78d1d4c2ea44020edc897c11e72801d84dfac01944d3253bc37587d176af5553bcd72d59ad07d70ac



==================================================================
                    REPORT METADATA
==================================================================

Report Version: 3.3.1 - 2026-09-28

==================================================================

======================================================================
                    TOOL ATTESTATION
======================================================================

C.E.R.T.O. app version: 3.3.1
Binary type: directory
Binary path: <app>/app.asar
Source files hashed: 1
Binary size: 1446 bytes

Binary SHA-256: a89dc7b018f31d3ffd446cb51fcbb61f37b443d71470ffa531545c1bbb310288
Binary SHA-512: 406954cd4c137edceae68766ec66b3b9f65ddc1e47d1e1cadab95a7525230ae02a3e81fe308e5244b60f937c82026255dbb6f7c2ccf2b7db664e6d060af64db1
Binary MD5:     2b80af9ae555b992124d454b90e8744b

Runtime versions:
  Electron: 39.8.10
  Chrome:   142.0.7444.265
  Node.js:  22.22.1
  V8:       14.2.231.22-electron.0

Platform: darwin/arm64
Electron executable path: /Applications/CERTO.app/Contents/MacOS/CERTO
Attestation computed at: 2026-09-28T15:18:59.917Z
Meaning: this block proves which exact build of the tool produced
the acquisition. If the hash differs from a reference build, the package
was generated by a different version of the software.


======================================================================
                    MANIFEST INTEGRITY
======================================================================

Manifest file: hashes/file-hashes.json
Number of included files: 111
Total size of included files: 13939503 bytes
Manifest size: 19273 bytes

Manifest SHA-256: d2bd3e2b541bcbcd9368c2346e7cc4ec7d24df960d1d8e126d6f0143dc939444
Manifest SHA-512: f7cec12d62a9dd47e4f32ca94899e37e3a40979e4bb18cfdff60d0e4b4b984abd5bd906c3988927ba1ae30e6e488c2c4ca12a770da0ee73b6f87734f05ac1659

INTEGRITY CHAIN:
  1. Each acquisition file → SHA-256 → hashes/file-hashes.json
  2. hashes/file-hashes.json → SHA-256 → this report (above)
  3. This report → RFC 3161 timestamp → reports/report.tsr
  4. Conclusion: the manifest hash, inserted here BEFORE the TSA signature,
     is cryptographically covered by the timestamp. Verification:
       sha256(hashes/file-hashes.json) == d2bd3e2b541bcbcd...
       openssl ts -verify -in reports/report.tsr -data reports/report.txt

EXCLUSIONS from the manifest:
  - reports/report.txt: this is the CURRENT file, including it would be recursive.
    Its hash is certified directly by the RFC 3161 timestamp.
  - reports/report.tsr/.tsq: artifacts of the timestamp itself.
  - hashes/file-hashes.json: the manifest itself (anti-recursive).
  - interactive.html: derived view of the manifest, not a primary artifact.
  - System files (.DS_Store, Thumbs.db, desktop.ini) and metadata/mysql.json
    (upload payload, not part of the acquisition).


======================================================================
                    EXPLICIT FORENSIC STATEMENTS
======================================================================

1. ISOLATED BROWSER ENVIRONMENT
   The Forensic Browser used for this acquisition runs in an Electron
   partition separate from the operator's personal browser. At startup:
     - Cookies: none pre-existing
     - localStorage / sessionStorage: empty
     - HTTP cache: empty
     - Browser extensions: none user-installable
     - User-agent: standard Chrome/142 with C.E.R.T.O. identifying suffix
   The browser's pre-acquisition state did not influence the capture.

2. POST-HOC FULLPAGE CAPTURE
   The scroll-and-stitch fullpage screenshot of each visited page is taken
   AFTER the user navigation ends, by re-navigating to every already-visited
   URL (hybrid strategy: real-time for viewport+DOM+HAR, post-hoc for the
   complete fullpage scroll). Forensically relevant consequences:
     - Post-hoc pages executed: 1 of 1 visited
     - Time elapses between the original visit and the fullpage capture (drift),
       documented in each page's pages/NNN_…/page-metadata.json (fullpageDriftMs field).
     - HTTP requests made during the re-navigation are SEPARATE from the
       official HAR (already frozen): they do not pollute the primary network
       evidence. The acquired site's server logs may however record requests
       beyond the main acquisition duration.
     - The real-time viewport screenshot and real-time HTML DOM snapshot
       remain the AUTHORITATIVE references for the "at time of visit" state.
       The fullpage is an additional visual representation at T+drift.

3. EXCLUSION OF THE INTERACTIVE DASHBOARD FROM THE MANIFEST
   The interactive.html file is a VIEW of the manifest (it reads the
   metadata and presents it in a navigable UI). It is NOT a primary forensic
   artifact:
     - Generated AFTER the manifest (it could not include itself)
     - Not signed by the timestamp (it derives from already-signed artifacts)
     - If modified, the change does NOT affect the evidence: the data is in
       the manifest and in the timestamped report.
   Always verify the primary artifacts (reports/report.txt + reports/report.tsr + manifest) as the
   authoritative source.

4. SCOPE-BOUNDARY ENFORCEMENT
   Declared mode: domain-and-subdomains
   Enforcement layers applied:
     - Client-side hooks (history.pushState/replaceState, anchor click)
     - Electron will-navigate event
     - setWindowOpenHandler for target="_blank"
     - did-navigate-in-page rewind for SPA pushState
     - webRequest.onBeforeRequest at the network level (mainFrame block)
   Any out-of-scope navigations blocked or authorized are recorded in
   metadata/scope-summary.json with a textual rationale.

5. MULTI-SOURCE NTP TIME SYNCHRONIZATION
   The system clock was compared against multiple NTP servers
   (time.google.com, pool.ntp.org, time.cloudflare.com) in parallel query.
   The consensus offset is the median of the measured offsets. The maximum
   deviation across sources is documented in the NTP_MAX_DEVIATION_MS field in
   metadata/data.json: if >100ms, synchronization is marked "warning".

