C.E.R.T.O.
C.E.R.T.O.
Capture a web page exactly as it appears in that moment — with everything it is made of — and seal it before it can change or vanish.
C.E.R.T.O.'s Web pages module performs the forensic acquisition of websites and web pages: it captures a page in the exact state it appears — text, images, code, resources and network traffic — and seals it as digital evidence before it can change or vanish. It is the tool designed for court-appointed and party experts, lawyers and law enforcement who need to freeze online content — a defamatory post, a copyright infringement, an e-commerce page, a review — with a full chain of custody and technical validity.
A repeatable, documented procedure: from time synchronisation to cryptographic sealing, every step leaves a verifiable trace inside the bundle.
Multi-source NTP sync (Google/Cloudflare/pool) with documented offset and roundtrip: the capture window is anchored.
Built-in forensic browser with declared object and scope (domain, domain+subdomains or free navigation); every in-scope page becomes an exhibit.
Passive traffic capture via Chrome DevTools Protocol (Network domain, no request interception) — no page alteration.
For each page: viewport screenshot, full-page screenshot (scroll-and-stitch) and a DOM snapshot after JavaScript execution.
Self-contained WACZ/WARC packaging (ISO 28500): the navigation replays offline, byte for byte, with ReplayWeb.page.
Session-aware completeness engine: compares seen vs captured resources, recovers the missing ones and declares the unrecoverable.
Complete W3C HAR, DNS, WHOIS, traceroute and X.509 certificate chains (leaf + intermediates + root) for every host contacted.
Quadruple MD5 + SHA-1 + SHA-256 + SHA-512 (FIPS 180-4) hash of every file, inventoried in file-hashes.json.
manifest.json signed with Ed25519 (RFC 8032) bound to the device + double RFC 3161 timestamp (inner anchor on the manifest, outer seal on the tag-manifest).
Everything is packaged into a BagIt 1.0 bundle (RFC 8493) with a CASE/UCO description and verify.sh / verify.bat verifiers.
A single acquisition produces dozens of coordinated artefacts, each with a precise forensic role. They are organised into clearly-named folders inside data/.
The visible screen during navigation (one frame per page), as JPEG watermarked with C.E.R.T.O., version, acquisition ID, URL and timestamp.
pages/NNN_…/screenshots/
The whole page recomposed with scroll-and-stitch, beyond the fold, with the background flattened to white for colour fidelity. Generated post-hoc for each page.
pages/NNN_…/screenshots-fullpage/
The DOM serialised after JavaScript execution (post-hydration), as actually rendered by the browser — not just the static source.
pages/NNN_…/html-snapshots/
Web Archive Collection Zipped (ISO 28500): WARC + indexes, self-contained. Replays the whole navigation offline with ReplayWeb.page — it is the sealed media.
evidence/ReplayWebPage.wacz
Video recording (WebM) of the forensic browser during the acquisition, with system audio: the dynamic proof of what the operator saw and did.
evidence/video/
W3C HTTP Archive: complete record of requests/responses, real headers, timing and payload. Plus requests/responses/resources in JSON and statistics.
network/network.har
DNS resolution, WHOIS registry query (domain owner and registration data) and a map of the network hops from client to host.
network/dns-lookup.txt · whois.txt · traceroute.txt
The full X.509 chains (leaf + intermediates + root, in PEM and human-readable) of every host contacted during the acquisition, with certificate details.
tls/certificates/
All active cookies with metadata (HttpOnly, Secure, SameSite, expiry) and the session storage / local storage snapshot at capture time.
network/cookies-detailed.json · evidence/javascript-state/
Recording of clicks, scrolls, inputs and keystrokes during navigation (chain of custody of the operator's actions).
evidence/interactions/user-interactions.json
The complete site-structure: every resource (CSS, JS, fonts, images) saved and organised by host, with the provenance metadata of each.
resources/site-structure/
A report that honestly declares how many resources were seen, captured, recovered via session and how many remain unrecoverable, with the percentage.
network/completeness-report.json
The report in PDF and TXT (operator, scope, IP, NTP, SSL, inventory, forensic statements) with its own RFC 3161 timestamp (report.tsr).
reports/report.pdf · report.txt · report.tsr
The list of every file with its quadruple of cryptographic hashes, the basis for an integrity check repeatable by anyone, even offline.
hashes/file-hashes.json
On a post, the defamation or the threat is often not in the content: it is in the comments below.
But the comments are not in the page. They appear little by little as you scroll, they hide behind a “show more replies”, and the platform keeps only a handful on screen at a time. A tool that photographs the screen collects what is visible at that moment: the rest does not exist, and it does not even show up as missing.
C.E.R.T.O. queries the same data source the platform uses to build the page and preserves every response exactly as received, with its provenance envelope: queried address, method, status, moment of receipt. Comment text, author, like count and date are not read off the screen — they come from the service, as the service declares them.
Replies do not come with the list: every comment that has them carries its own continuation, which must be followed separately. C.E.R.T.O. follows them, and when a list runs out it says so — with the reason why.
Comments on posts and reels. Profile with the content grid, carousels included. Stories, isolating the selected item. Follower and following lists.
social/instagram/ · raw-api/
Comments. Profile. Timeline posts. Friend list, with each person's identifier and picture.
social/facebook/ · raw-api/
Comments on videos and photo posts. The video itself, downloaded as a standalone file with its own hash. Profile and published content.
social/tiktok/ · evidence/video-resources/
Posts with their replies, followed page after page to the end. Profile with published content, metrics and picture.
social/x/ · raw-api/
Comments and replies on videos and shorts, distinguished by level. Channel with every thumbnail at full quality. The film downloaded separately.
youtube-comments/ · raw-api/
Private Messenger and Instagram Direct conversations, extracted without having to scroll through them one by one.
social/messaging/
Every service response is preserved verbatim in raw-api/ with its provenance envelope. Anyone contesting the data can go back to the source, rather than trusting our table.
How many items the platform declares, how many were collected, through which channel, and why collection stopped. An incomplete collection is stated, not hidden.
Many platforms do not state an absolute date but a distance from now (“7 days ago”). The value is reported as received: converting it would be our interpretation, not a fact.
Hundreds of comments and dozens of authors: a printed list is no use to anyone.
The interactive.html dashboard included in the bundle presents comments and replies as real tables, where you can search and sort. It works offline, on a double click, even years from now and on a computer without C.E.R.T.O. installed.
On a traditional website the replay is faithful. On an application there is a limit, and it deserves an explanation.
The WACZ archive keeps resources under the address they were requested with, so the page reassembles as it was: structure, stylesheets, fonts, images. With X, Instagram, Facebook or TikTok things change — the limit is not ours, and no tool today gets past it.
On replay the site's own code is re-executed: it redraws the page from scratch and asks the service for data that is not in the archive — because nobody had asked for it at that moment. The result is a page that complains, not a false page.
Alongside the network capture, the archive holds the page as the operator saw it, with no executable code: it cannot rewrite itself because it has nothing to run. Next to the file sits a bilingual note explaining what each of the two is.
Video streams travel under signed, expiring addresses, and the player demands a live answer from the service: no archive can replay them, not even by keeping the bytes. C.E.R.T.O. downloads the film separately, as a standalone file with its own hash.
None of this diminishes the evidence. The content sits in the bundle three times over, by independent routes: in the service's raw response, in the frames captured during extraction, and in the page archive. Each has its own hash, and the three corroborate one another. An archive that does not replay is not an empty archive: it holds what went over the wire at that moment, address by address.
The bundle does not need C.E.R.T.O. to be validated: anyone, even years from now, can verify its authenticity with standard tools. The BagIt 1.0 structure and the interactive dashboard make it self-explanatory.
data/tsa.tsr and outer seal on tagmanifest-sha256.txt.tsr. Free cascade Sectigo→DigiCert→GlobalSign; optional qualified eIDAS InfoCert.Forensic web page acquisition, evidence validity, the WACZ format and bundle verification: the most common questions.
Register for free and download C.E.R.T.O. Desktop for Windows and macOS from your client area.