TrueScreen Forensic Browser

Capture web pages, video and files as legal evidence

TrueScreen Forensic Browser lets you capture and certify any web page, online video or downloaded file with full legal value, straight from your desktop.

REC 03:23 · session videoSHA-256 d66c5ee8…711139HTTP traffic · captured✓ eIDAS qualified timestampsISO/IEC 27037 forensic standardGEO-ROUTING · 80+ countriesTrueScreen Forensic Browser during a certification session

Why it wins

Why professionals choose TrueScreen Forensic Browser

Screenshots can be challenged. Forensic Browser evidence is built to withstand it.

01

Evidence that holds up in court

Every capture is sealed with a qualified timestamp and a certified digital seal, issued under eIDAS and recognized internationally. The opposing party cannot dispute when the content existed or whether it was altered.

02

Prevented and detectable

The browser acquires content in a hardened forensic environment where page manipulation is actively prevented. If the package is altered after capture, the tamper-evident hash chain makes any modification mathematically detectable.

03

No technical skills required

Browse like you normally would. Click Certify, navigate to any website, and end the session. All forensic data is collected automatically in the background: no setup, no configuration, no expertise needed.

Capture modes

Three ways to capture, one certified package

Web pages, video and downloaded files, all sealed in one certified evidence package.

Web page acquisition

Take on-demand snapshots of any page. Each one preserves the rendered screenshot, the live page source code and a full MHTML web archive, so the page can be reopened and verified exactly as it appeared.

Continuous video and audio

Record your session as continuous video at 20 fps with synchronized audio captured directly from the browser, ideal for dynamic content, web video and livestreams that a still screenshot cannot prove.

Media and file download

Download and certify videos and files directly from the page. Each download is fingerprinted with SHA-256, bound to the acquisition chain and sealed with a certified timestamp, proving exactly what was captured and when.

Feature overview

Forensic capabilities at a glance

Everything the Forensic Browser captures, verifies and certifies in a single session.

Page snapshots

Rendered screenshot, live page source code and a full MHTML web archive for every page you certify.

Continuous video recording

Session video at 20 fps with synchronized audio captured directly from the browser.

Certified media download

Videos and files fingerprinted with SHA-256 and bound to the acquisition chain.

Full network capture

Packet capture (PCAP) and complete HTTP logs, openable in Wireshark.

Geo-routed acquisition

Capture from 80+ countries, with the point of observation verified and written into the record.

Verified timestamps

Dual timestamps independently verified against multiple time servers, with drift monitoring.

Hardened environment

Developer tools disabled, code injection blocked, application integrity verified at startup.

Tamper-evident hash chain

Every acquisition step cryptographically linked: any alteration is mathematically detectable.

Network transparency

VPN, proxy and Tor connections automatically detected and logged in the report.

Virtual machine detection

Virtualized execution environments identified and recorded with the evidence.

Qualified electronic seal

eIDAS-compliant qualified timestamp and certified digital seal on every package.

Certified report and archive

A certified PDF report plus the complete original evidence archive, ready for legal use.

Use cases

Preserve what matters before it disappears

Web content is volatile. Forensic Browser makes it permanent.

01

IP and brand protection

Capture trademark violations, counterfeit product listings and unauthorized use of your brand assets before infringers take them down.

02

Defamation and online harassment

Preserve defamatory posts, threatening messages and cyberbullying evidence from any website or social media platform.

03

Legal proceedings and litigation

Collect certified web evidence for contract disputes, regulatory investigations and compliance audits with full chain of custody.

04

Fraud investigations

Document fraudulent websites, phishing pages and scam listings with verified timestamps and network forensics that prove their existence.

05

Content monitoring

Certify published articles, terms of service, privacy policies or pricing pages at a specific point in time to prevent future disputes.

06

Insurance claims

Capture online listings, damage reports and third-party statements as certified evidence to support or verify insurance claims.

07

Social video before it disappears

Download and certify a social video or livestream before it is deleted, with its own hash and a certified timestamp.

08

Certified document download

Preserve a downloaded document, invoice or report with cryptographic proof of its source and the exact time of capture.

How it works

From web page to certified evidence in four steps

STEP 01

Open and sign in

Launch the app on macOS or Windows. Log in with your email, Google, Microsoft or API key.

Forensic Browser sign in screen

STEP 02

Start a certification session

Click Certify and choose your mode: page snapshots, or continuous video with audio. Then browse normally.

Starting a certification session

STEP 03

Evidence captured automatically

While you browse, the app captures everything in the background: page content, downloaded files, full network traffic, timestamps and environmental metadata. No manual action needed.

Evidence captured automatically in the background

STEP 04

Sealed and certified

End the session and everything is packaged, hashed and sealed with a qualified timestamp and certified digital seal. Download your certified report from the TrueScreen platform.

Evidence sealed and certified

Geographic acquisition

Capture from any country in the world

Geo-restricted pages, localized results and region-specific ads can look completely different depending on where they are viewed from. TrueScreen Forensic Browser routes your acquisition through a country you choose and certifies exactly what a user there would see, with the point of observation verified and written into the record.

Point of observation selected on a world map POINT OF OBSERVATION · VERIFIED

Choose the country

Pick from 80+ countries before you start. Your session is routed through that location, so you capture the content as it genuinely appears there, not as it looks from your own network.

Verified point of observation

The exit location is checked through the session itself and recorded in the certified report. Where the evidence was observed from is proven, never merely claimed.

Authenticity preserved

The encrypted connection stays end-to-end with the website, so nothing is altered in transit. If routing drops during capture, the session is suspended and the event is flagged in the record.

Built for scrutiny

Why this evidence stands up to scrutiny

Every common objection is already addressed by the forensic data collected.

Cross-examination record · 8 objections answered
Answered by the record

“When was this captured?”

Every session carries dual timestamps independently verified against multiple time servers, with continuous drift monitoring. The exact moment of capture is provable, not just claimed.

“Were you using a VPN?”

The browser automatically detects and logs VPN, proxy and Tor connections. Your network environment is documented and transparent.

“The page could have been modified”

Developer tools are permanently disabled, code injection is blocked, and application integrity is verified at startup. Page manipulation is prevented at capture time.

“How do we know this was the real website?”

Full DNS resolution, server IP identification, TLS certificate chains and hosting provider data are captured for every site visited.

“Prove the connection was genuine”

Full network traffic and complete HTTP logs are captured, documenting every request and response during the session.

“This could have been run in a virtual machine”

The application detects VMware, VirtualBox, Parallels, Hyper-V and QEMU/KVM environments, logging the execution context.

“Could you have edited the evidence afterwards?”

Every acquisition step is cryptographically linked to the previous one in a tamper-evident hash chain. Any alteration of the package after capture is mathematically detectable, with no need to trust the operator.

“Show the raw network traffic”

A full packet capture (PCAP) is recorded alongside complete HTTP logs, openable in Wireshark, documenting every request and response at the network level.

Deliverables

What you receive after every session

A complete evidence package ready for legal use, audits or compliance.

Certified evidence package// sealed

Certified PDF report

A professionally formatted report with all captured data, forensic metadata and certification details. Ready to attach to legal filings, insurance claims or compliance records.

Original evidence archive

The complete evidence package, sealed with a qualified timestamp and certified digital seal.

screenshotsvideo + audiodownloaded filespage source codeMHTML archivesPCAPHTTP logs

Qualified electronic seal

eIDAS-compliant qualified timestamp and certified digital seal, recognized internationally as legally binding proof of existence and integrity.

✓ eIDAS QUALIFIED TIMESTAMP✓ CERTIFIED DIGITAL SEAL

Standards

Built on trust and compliance

EU trust mark

eIDAS compliant

Internationally recognized digital seals and qualified timestamps for cross-border legal validity.

ISO logo

ISO/IEC 27037

International standard for forensic acquisition, identification and preservation of digital evidence.

European Union flag

EU data centers

Secure European cloud infrastructure with certified data residency.

GDPR shield

GDPR compliant

Full data protection, privacy by design and data sovereignty.

FAQ

Frequently Asked Questions

Everything professionals ask before their first certification session.

Why should I use Forensic Browser instead of a regular screenshot?
A regular screenshot can be edited, has no proof of when or where it was taken, and carries no metadata about the network environment. TrueScreen Forensic Browser captures the complete context: verified timestamps, network data, operator identity and page source code. The result is a sealed evidence package with qualified timestamp that holds up in court, not just an image file.
Will this evidence be accepted in court?
Yes. Every certification includes a qualified timestamp and certified digital seal compliant with eIDAS, recognized internationally. The forensic acquisition process follows ISO/IEC 27037 standards. Evidence is admissible in court across Europe and internationally.
Do I need technical expertise to use it?
No. The Forensic Browser works like any standard web browser. You navigate to a page, click Certify, and browse normally. All forensic data is captured automatically in the background. When you end the session, the evidence package is created, signed and certified without any manual steps.
What operating systems are supported?
TrueScreen Forensic Browser is available for macOS (.dmg installer) and Windows (.exe installer). Both versions include the same forensic capabilities and security architecture.
Can I use it with my existing TrueScreen account?
Yes. Forensic Browser uses the same account and credits as the mobile app and web portal. All certifications appear in your centralized archive on the TrueScreen platform, accessible from any device.
How is it different from a browser extension?
Browser extensions run inside a standard browser where the page can be manipulated before capture. Forensic Browser is a standalone application with a hardened environment: developer tools are disabled, code injection is blocked, and the application integrity is verified at every launch. This means the opposing party cannot argue that the captured content was altered.
What do I receive after a certification session?
You receive a complete evidence package: a certified PDF report, a JSON report with all forensic metadata, and the original evidence archive containing screenshots, video, page source code and network logs. Everything is sealed with a qualified timestamp and available for download from your TrueScreen archive.
Can I record a full browsing session as video?
Yes. You can choose between two modes: Page Screenshots (captures each page you visit) or Video Recording (continuous screen recording at 20 fps with synchronized audio). In video mode, you can also take on-demand snapshots at any point during the session.
Can I certify a video I find online?
Yes. The browser downloads the video, fingerprints it with SHA-256, and integrates it into the forensic acquisition package as certified evidence with its own hash and a qualified timestamp.
What if someone claims you edited the evidence afterwards?
Every step of the acquisition is cryptographically linked in a tamper-evident hash chain. Any alteration of the package after capture is mathematically detectable, so the evidence does not rely on trusting the operator.
Does it capture network traffic?
Yes. The browser records a full packet capture (PCAP), openable in Wireshark, together with complete HTTP logs and the TLS certificate chain of every site visited.
Can I record audio from the page?
Yes. In video mode the session is recorded at 20 fps with synchronized audio captured directly from the browser, so dynamic and audio content is preserved as it played.
Are downloaded files certified too?
Yes. Every file you download during the session is hashed and recorded with its provenance, then bound to the acquisition chain, proving exactly which file was obtained and when.
How do I save a webpage as evidence?
Open TrueScreen Forensic Browser, click Certify and navigate to the page. The browser records the rendered screenshot, the page source code, an MHTML archive, verified timestamps and the full network traffic, then seals everything with a qualified timestamp and certified digital seal. The result is a certified evidence package, not just an image. For the legal background, see our guide to the legal value of web page certification.
Do screenshots count as evidence in court?
A plain screenshot can be admitted, but it is easy to challenge: it can be edited, carries no verified timestamp and no proof of origin. A forensic capture strengthens admissibility because authenticity is supported by verified timestamps, a tamper-evident hash chain and a qualified electronic seal. Read our analysis of screenshot evidence admissibility in court.
How do you authenticate a website in court?
Authentication means proving the content is what you claim it is. In the United States this falls under Federal Rule of Evidence 901; in the European Union, qualified timestamps and seals under eIDAS provide legally recognized proof of existence and integrity. Forensic Browser embeds the supporting record automatically: DNS resolution, server IP, TLS certificate chains, network logs and hashes. See our FRE 901 authentication guide.

Stop losing evidence.

Join 20,000+ professionals who trust TrueScreen to turn volatile web content into certified digital evidence with full legal value.

macOS · .dmg installerWindows · .exe installer
TrueScreen Forensic Browser