Page Vault Alternative: Forensic Web Evidence Capture

Updated on September 3, 2026

Teams look for a Page Vault alternative for three recurring reasons: the cost of collection on high-volume matters, the constraints of a cloud-only workflow, and evidence that has to hold up outside the United States. The tools in this space look similar in a demo. They differ in what they actually hand you when the capture itself is challenged.

This page compares what Page Vault produces with what a forensic acquisition produces, using each vendor's published documentation. It is not a feature checklist: the questions that decide a motion are narrower than a feature list, and there are five of them.

If you are surveying the whole category rather than replacing one specific tool, our guide to forensic web capture software covers five platforms side by side.

What to look for in a Page Vault alternative

Web capture tools are usually compared on convenience: how many clicks, how good the PDF looks, whether it expands a comment thread on its own. Those matter for daily work. None of them is what opposing counsel attacks. Five questions do the real work.

• What is preserved beyond the rendered image. A screenshot records what the page looked like in one browser at one moment. It does not record what the server sent.
• Who is inside the chain of custody. If the person with an interest in the outcome performed the capture, that person may have to testify about it.
• What the integrity proof actually proves. A hash proves a file has not changed since it was hashed. It says nothing about whether the file matches what was published.
• Where the data resides, and under whose jurisdiction. This is procedural in a domestic matter and substantive in a cross-border one.
• What the evidence is worth in another country's courtroom. Authentication standards do not travel automatically.

A web capture becomes evidence when three questions have an answer: what the server actually served, who observed it, and what proves it has not changed since. Tools differ in how many of the three they answer without putting the collecting party on the stand.

What Page Vault captures and how it is authenticated

Capture methods and output formats

Page Vault operates in two modes. Page Vault Browser is cloud-based software the legal team drives itself, running a remote browser session so the capture takes place on the vendor's infrastructure rather than the user's machine. Page Vault On Demand is a managed service: the firm submits URLs and the vendor's team performs the collection.

Outputs are full-page PDFs with metadata in the header and footer, e-discovery load files, and video for social media content. The platform expands comment threads, scrolls long feeds automatically and handles profiles on the major social networks. Recent additions include scheduled captures and a browser extension for submitting URLs.

Hashing and affidavit authentication

Every capture produces an SHA-256 hash of the output file, along with metadata: the URL requested, the timestamp of collection, the IP address of the capturing browser and its version. On request, Page Vault provides a sworn affidavit describing the collection process.

The authentication theory is Rule 901(b)(9) of the Federal Rules of Evidence, which allows evidence to be authenticated by describing a process or system and showing that it produces an accurate result. It is a well-established route, and for a domestic matter with an unremarkable capture it is usually sufficient.

How the commercial model works

Page Vault sells software as a per-seat subscription and the managed service on a per-capture basis. That structure is worth understanding before you compare it to anything else: per-seat pricing rewards a small number of heavy users, while per-capture pricing makes cost scale directly with the volume of a matter. Firms tend to reach for an alternative at the point where a single case generates hundreds of captures, or where the number of people who occasionally need one exceeds the number of seats it makes sense to buy. Current figures are published on each vendor's own site.

Where the two approaches differ

File integrity is not source authenticity

An SHA-256 hash is a strong integrity proof and a weak provenance proof. It demonstrates that the file in evidence is byte-identical to the file that was hashed at collection. It cannot demonstrate that the file corresponds to what the web server transmitted, because the hash is computed after the capture, on the capture's own output.

The gap only matters when someone decides to exploit it, which is precisely when it matters most. If opposing counsel argues that the page was staged, that a proxy altered the response, or that the rendering does not reflect what a normal visitor received, the hash is silent on all three. Answering requires artifacts recorded during the acquisition, not derived from it afterwards.

Who has to testify

Page Vault's remote browsing design deliberately keeps the individual lawyer out of the collection: the capture executes on the vendor's infrastructure, and the vendor can attest to it. This is a genuine strength over an ordinary screenshot, where the person with a stake in the case is also the only witness to how the image was made.

It also creates a dependency. The affidavit is only as useful as the willingness and availability of the party that signs it. A certification carrying its own evidentiary weight does not require the provider to appear, explain its process, or remain in business.

Legal presumption does not cross borders on its own

Rule 901(b)(9) sets a standard for admissibility in United States federal courts, and state rules generally track it. Outside that system it has no automatic effect. A European judge assessing a Page Vault capture is not applying Rule 901: they are evaluating an unfamiliar private document under local rules of proof, and the outcome depends on the jurisdiction and the judge.

The reverse also applies, which is the honest version of this comparison: a European qualified timestamp is not self-authenticating in a United States court either. What differs is the default. In the European Union, Regulation 910/2014 attaches a presumption of accuracy to a qualified timestamp regarding the date, the time and the integrity of the data, in all Member States. The party challenging it carries the burden. Absent that presumption, the party producing the evidence carries it.

What forensic-grade web acquisition preserves

Beyond the rendered image

Page Vault records the visible content of the page together with the URL, the IP address, the timestamp and the browser version. A forensic acquisition preserves the same visible content and adds the material an expert is asked for when the capture itself is contested: the original HTML source as received and the HTML as rendered after scripts executed, the MHTML archive, the cookies in play during the session, the browser fingerprint, the DNS resolution of the domain, the hosting data for the resolved IP, the operator's geolocation, and whether a VPN or proxy was in the path.

Each of those answers a specific objection. The two HTML versions answer whether client-side code changed what was displayed. The DNS resolution answers whether the domain pointed where it should have. The proxy status answers whether anything sat between the browser and the server.

Network traffic and TLS verification

Recording the session's network traffic in PCAP format documents the actual exchange between browser and server, not a reconstruction of it. The TLS handshake can then be examined for interception, and the server's certificate saved as a PEM file can be checked against public Certificate Transparency logs, which are maintained independently of both parties. That comparison is the closest thing available to third-party corroboration that the connection reached the real server.

Video with a continuous audit trail

Some content cannot be proved with still images: a video that plays, a feed that changes as it loads, an interface that only reveals something after several actions. Continuous recording at 16 frames per second with audio documents both the content and the operator's interaction with it. Actions are logged against two clocks, the local system time and time verified against four independent NTP servers, so that the sequence can be reconstructed rather than asserted.

Cross-border matters, and where the data lives

For a purely domestic United States matter, this section is optional. For anything touching the European Union it is often decisive.

Jurisdiction over the data

The CLOUD Act allows United States authorities to compel a United States provider to produce data it controls, regardless of where the servers sit. Geographic residency in Europe does not remove that exposure when the controlling company is American. The distinction is between where data is stored and which legal system can reach it, and only the second one is a guarantee. TrueScreen S.r.l. is a European company operating on European infrastructure, so both answers are the same.

Evidence a European court recognises on sight

Data packages are digitally signed, sealed with an official digital seal and stamped with a qualified timestamp, both internationally recognised. In the European Union that combination carries the presumption described above, so the certification is treated as reliable unless challenged, in every Member State, without the provider having to explain itself first.

How TrueScreen Forensic Browser works

The Forensic Browser is a desktop application for macOS and Windows rather than a cloud service, which changes what can be guaranteed about the machine performing the capture. Developer tools are permanently disabled, dangerous command-line flags are blocked at launch, injection of external libraries is detected, and all browsing data is cleared before each session begins so that nothing from a previous session influences what the server returns. The operator attests to the integrity of the system at the start.

Capture runs in two modes. Screenshot mode records the viewport or the full page along with the complete forensic package described above. Video mode records the session continuously, with audio and with snapshots taken on demand during the recording. In both modes the package is signed on the device, uploaded, sealed and timestamped, and the resulting certification can be verified by anyone through our public verification tool, without an account and without contacting us.

That last point deserves emphasis in a comparison of this kind. Independent verifiability means the recipient of the evidence does not have to take the vendor's word for anything, which is a different posture from an affidavit.

Comparison at a glance

Neither column is a verdict. Which differences matter depends on the matter itself: a routine domestic collection makes different demands than a capture that will be contested, a case that reaches into the European Union, or a situation where the collecting party would rather not become a witness.

For a comparison with a tool built around continuous website monitoring rather than one-off collection, see PageFreezer and TrueScreen compared. For the authentication rules themselves, our guide to FRE 901 works through what each subsection requires.