C.E.R.T.O.
C.E.R.T.O.
Capture a web page exactly as it appears in that moment — with everything it is made of — and seal it before it can change or vanish.
C.E.R.T.O.'s Web pages module performs the forensic acquisition of websites and web pages: it captures a page in the exact state it appears — text, images, code, resources and network traffic — and seals it as digital evidence before it can change or vanish. It is the tool designed for court-appointed and party experts, lawyers and law enforcement who need to freeze online content — a defamatory post, a copyright infringement, an e-commerce page, a review — with a full chain of custody and technical validity.
A repeatable, documented procedure: from time synchronisation to cryptographic sealing, every step leaves a verifiable trace inside the bundle.
Multi-source NTP sync (Google/Cloudflare/pool) with documented offset and roundtrip: the capture window is anchored.
Built-in forensic browser with declared object and scope (domain, domain+subdomains or free navigation); every in-scope page becomes an exhibit.
Passive traffic capture via Chrome DevTools Protocol (Network domain, no request interception) — no page alteration.
For each page: viewport screenshot, full-page screenshot (scroll-and-stitch) and a DOM snapshot after JavaScript execution.
Self-contained WACZ/WARC packaging (ISO 28500): the navigation replays offline, byte for byte, with ReplayWeb.page.
Session-aware completeness engine: compares seen vs captured resources, recovers the missing ones and declares the unrecoverable.
Complete W3C HAR, DNS, WHOIS, traceroute and X.509 certificate chains (leaf + intermediates + root) for every host contacted.
Quadruple MD5 + SHA-1 + SHA-256 + SHA-512 (FIPS 180-4) hash of every file, inventoried in file-hashes.json.
manifest.json signed with Ed25519 (RFC 8032) bound to the device + double RFC 3161 timestamp (inner anchor on the manifest, outer seal on the tag-manifest).
Everything is packaged into a BagIt 1.0 bundle (RFC 8493) with a CASE/UCO description and verify.sh / verify.bat verifiers.
A single acquisition produces dozens of coordinated artefacts, each with a precise forensic role. They are organised into clearly-named folders inside data/.
The visible screen during navigation (one frame per page), as JPEG watermarked with C.E.R.T.O., version, acquisition ID, URL and timestamp.
pages/NNN_…/screenshots/
The whole page recomposed with scroll-and-stitch, beyond the fold, with the background flattened to white for colour fidelity. Generated post-hoc for each page.
pages/NNN_…/screenshots-fullpage/
The DOM serialised after JavaScript execution (post-hydration), as actually rendered by the browser — not just the static source.
pages/NNN_…/html-snapshots/
Web Archive Collection Zipped (ISO 28500): WARC + indexes, self-contained. Replays the whole navigation offline with ReplayWeb.page — it is the sealed media.
evidence/ReplayWebPage.wacz
Video recording (WebM) of the forensic browser during the acquisition, with system audio: the dynamic proof of what the operator saw and did.
evidence/video/
W3C HTTP Archive: complete record of requests/responses, real headers, timing and payload. Plus requests/responses/resources in JSON and statistics.
network/network.har
DNS resolution, WHOIS registry query (domain owner and registration data) and a map of the network hops from client to host.
network/dns-lookup.txt · whois.txt · traceroute.txt
The full X.509 chains (leaf + intermediates + root, in PEM and human-readable) of every host contacted during the acquisition, with certificate details.
tls/certificates/
All active cookies with metadata (HttpOnly, Secure, SameSite, expiry) and the session storage / local storage snapshot at capture time.
network/cookies-detailed.json · evidence/javascript-state/
Recording of clicks, scrolls, inputs and keystrokes during navigation (chain of custody of the operator's actions).
evidence/interactions/user-interactions.json
The complete site-structure: every resource (CSS, JS, fonts, images) saved and organised by host, with the provenance metadata of each.
resources/site-structure/
A report that honestly declares how many resources were seen, captured, recovered via session and how many remain unrecoverable, with the percentage.
network/completeness-report.json
The report in PDF and TXT (operator, scope, IP, NTP, SSL, inventory, forensic statements) with its own RFC 3161 timestamp (report.tsr).
reports/report.pdf · report.txt · report.tsr
The list of every file with its quadruple of cryptographic hashes, the basis for an integrity check repeatable by anyone, even offline.
hashes/file-hashes.json
The bundle does not need C.E.R.T.O. to be validated: anyone, even years from now, can verify its authenticity with standard tools. The BagIt 1.0 structure and the interactive dashboard make it self-explanatory.
data/tsa.tsr and outer seal on tagmanifest-sha256.txt.tsr. Free cascade Sectigo→DigiCert→GlobalSign; optional qualified eIDAS InfoCert.Forensic web page acquisition, evidence validity, the WACZ format and bundle verification: the most common questions.
Register for free and download C.E.R.T.O. Desktop for Windows and macOS from your client area.