Free tool · Evidence Snapshot

Preserve that page before it disappears.

Paste the address of the infringing page. In about two minutes an evidence package lands in your inbox: full-page screenshot, page source, SHA-256 hashes, who hosts it, an Internet Archive snapshot and a Bitcoin-anchored timestamp. Screenshots get deleted and disputed — packages get preserved.

Evidence Snapshot New capture Free · 3 a day
Page to preserve
Where to send the package

Free for rights holders: 3 captures a day, 10 a month. The capture runs from Lawyerd's infrastructure as a logged-out visitor; nothing is sent to the site owner, and your details stay with Lawyerd.

At a glanceEvidence Snapshot by Lawyerd
~2 minutesfrom pasted URL to your inbox
SHA-256 on every fileany later edit is provable
Third-party proofInternet Archive copy · Bitcoin timestamp
Free, no account3 captures a day · 10 a month
§ 01 · How it works

How the capture works

  1. 01

    Paste the URL

    Any public page: a clone site, a counterfeit listing, an impersonating profile, a defamatory post. Add the email the package should go to.

  2. 02

    We capture and seal it

    Raw source and a full browser render, network context, SHA-256 hashes, an Internet Archive request and a Bitcoin-anchored timestamp, all in one run.

  3. 03

    The package lands in your inbox

    One email with a download link for the ZIP and a verification page for the capture, ready to forward to management, counsel or the host.

Under the hood

Two fetches, one sealed record.

  • Raw HTTP fetch
  • Headless browser
  • DNS · RDAP
  • SHA-256 manifest
  • OpenTimestamps
  • Wayback SPN2

The pipeline fetches the page twice: once as raw HTTP (the source exactly as the server sent it, plus every response header) and once in a headless browser that renders scripts and takes the full-page screenshot. In parallel it records the network context — DNS records, the hosting provider and its abuse contact, the registrar and the domain's registration date (for scam pages, "this domain is 12 days old" is half the case) — and asks the Internet Archive for an independent snapshot of the same page.

Every artifact is hashed with SHA-256. The hashes, URLs, timestamps and network data go into a manifest, and the manifest's own hash is anchored in the Bitcoin blockchain through OpenTimestamps — a public, vendor-independent proof of when the record existed. The email delivery adds one more independent layer: the message's DKIM signature and server timestamps in your own mailbox.

Pages behind logins or paywalls are captured the way a logged-out visitor sees them, which is usually the login wall itself; for those, counsel can preserve the page manually. Captures run for lawful preservation purposes only; every capture is reviewed.

§ 02 · The package

What lands in your inbox

One email, one ZIP. Every file is hashed with SHA-256 at capture time, so any of them can later be proven byte-identical to what was captured.

Preserve a page now ↑
evidence.zip 6 files · download link in the email
  • JPG screenshot.jpg Full-page screenshot of the rendered page, exactly as a visitor saw it. SHA-256 ✓
  • HTML raw.html The source exactly as the server sent it. SHA-256 ✓
  • HTML rendered.html The DOM after scripts ran in the capture browser. SHA-256 ✓
  • JSON headers.json Every HTTP response header: server, redirects, status. SHA-256 ✓
  • JSON manifest.json The machine-readable record: URLs, times (UTC), IPs, host, registrar, domain age, and the SHA-256 of every file. SHA-256 ✓
  • OTS proof.ots OpenTimestamps proof anchoring the manifest hash in the Bitcoin blockchain. SHA-256 ✓
Next to the ZIP
  • WEB Wayback snapshot An independent Internet Archive capture requested in parallel: third-party corroboration. Third party
  • WEB Verification page lawyerd.net/evidence/v/… with the capture record, the hashes and fresh download links. Lawyerd
§ 03 · Admissibility

Will it hold up?

Honest answer: web evidence lives or dies on authentication, and rules differ by jurisdiction. This package is engineered for exactly that fight.

A plain screenshot compared with an Evidence Snapshot package
What the record shows Phone screenshot Evidence Snapshot
Provable capture time No Yes: UTC record + Bitcoin anchor
Proof nothing was edited No Yes: SHA-256 on every file
Server, host and domain age No Yes: Recorded at capture time
Page source, not just pixels No Yes: Raw and rendered HTML
Independent third-party copy No Yes: Internet Archive snapshot
Signed declaration of the procedure No From counsel, on request

A bare screenshot is trivially challenged — no provable time, no provable integrity. This package answers both challenges with cryptography and independent third parties, and under frameworks like US FRE 902(13)–(14) records of this kind can be self-authenticating with a proper certification. When a dispute demands a human voice behind the procedure, Lawyerd counsel provides a signed declaration describing how this exact capture was made — the step that decided cases like Weinhoffer v. Davie Shoring.

Full jurisdiction-by-jurisdiction breakdown — US FRE 901/902, eIDAS, Ukraine & CIS practice, and the six properties that make a capture defensible: are screenshots admissible in court? →

The package is a forensic-grade preservation record, not a notarial act or a guarantee of admissibility; every package email carries the same note.

§ 04 · Common questions

Questions people ask before preserving

How do I save a web page as evidence?

Do not rely on a plain screenshot from your phone — it proves little. Use a capture that records the page content, the exact time (from independent sources), the server that hosted it, and cryptographic hashes that prove nothing was edited afterwards. This tool does all of that automatically: paste the URL above and the package arrives in your inbox in about two minutes.

Are screenshots admissible in court?

Often yes, but admissibility turns on authentication — can you show when the capture was made and that it was not altered? Rules differ by jurisdiction (e.g. US FRE 901 and 902(13)–(14) allow self-authenticating electronic records with a proper certification). A screenshot with SHA-256 hashes, independent timestamps and a documented capture procedure is dramatically easier to authenticate than a bare image; where needed, Lawyerd counsel can add a signed declaration describing the procedure.

Why is a plain screenshot not enough?

Anyone can edit a screenshot in a minute, and the other side knows it. A bare image carries no capture time you can prove, no record of which server delivered the content, and no way to show it was not altered. Evidence-grade preservation adds exactly those layers: independent timestamps, network context and cryptographic hashes fixed at capture time.

What exactly is in the evidence package?

A full-page screenshot of the rendered page; the raw page source as served and the browser-rendered HTML; all HTTP response headers; DNS records, hosting provider and abuse contact, registrar and domain registration date at capture time; an Internet Archive (Wayback Machine) snapshot request; a manifest.json with SHA-256 hashes of every file; and an OpenTimestamps proof anchoring the manifest hash in the Bitcoin blockchain. Delivered by email with download links valid for 90 days, plus a verification page for the capture.

What is a SHA-256 hash and why does it matter for evidence?

A SHA-256 hash is a cryptographic fingerprint: change a single byte of the file and the fingerprint changes completely. Because your package records the hash of every artifact at capture time — and anchors the record itself in the Bitcoin blockchain via OpenTimestamps — anyone can later verify that the screenshot or HTML you present is byte-identical to what was captured, and when.

Is the Wayback Machine enough as legal evidence?

On its own, often not: in Weinhoffer v. Davie Shoring (5th Cir. 2022) an archive.org page was ruled inadmissible for lack of authentication. Wayback snapshots are strongest as one layer of a package that also carries hashes, capture metadata and a person who can describe the procedure. This tool requests a Wayback snapshot alongside its own capture, so the two corroborate each other.

Can it capture pages behind a login or paywall?

No — the capture browser visits the page like a logged-out visitor, so the package shows exactly what that visitor sees, often the login or paywall itself. For content behind logins, geo-walls or aggressive bot protection, request a manual preservation by counsel — reply to any package email or use the contact form.

How much does it cost?

The tool is free for rights holders: up to 3 captures per day and 10 per month per email address. Counsel services on top of it — signed declarations of the capture procedure, takedown notices to the host, tracked removal — are engagements with Lawyerd.

§ 05 · Next step

Preserved. Now remove it.

Fixing the evidence is step one — the package even tells you who hosts the content and where their abuse mailbox is. Step two is a notice under the right statute, followed up until the content is actually gone. That is Lawyerd's core practice.

  • 01Preserve the page: free, this tool
  • 02Find who hosts it: free abuse-contact lookup
  • 03Notice, follow-up, verified removal: Lawyerd counsel
Counsel-led takedown

Hand the package to counsel.

Send the capture link or the URLs. Counsel reviews every intake personally and replies within one business day.

Have counsel handle the takedown