OSINT.devosint.dev
Sign up
SingleFile · dev-docs

Evidence Capture Workflow with SingleFile

A repeatable SingleFile workflow using evidence IDs, timestamps, SHA-256, original/derived separation, contextual notes and independent preservation.

status
Published
slug
evidence-capture-workflow
published
Aug 22, 2026
SingleFile

Evidence Capture Workflow with SingleFile

SingleFile becomes much more useful when it is placed inside a repeatable evidence process.

The goal is not merely to save a page.

The goal is to make the saved artifact understandable later.

1. Preserve before deep analysis

If a public page is volatile and relevant:

  1. record the URL;
  2. save the page with SingleFile;
  3. capture the current time;
  4. optionally take a screenshot;
  5. continue analysis.

This reduces the risk of discovering later that the source changed while you were interpreting it.

2. Give the artifact an evidence ID

Example:

EV-0042

Then use a predictable filename such as:

20260822T010000Z_EV-0042_example-com_terms.html

The exact naming convention matters less than consistency.

3. Calculate an integrity hash

For important artifacts, calculate SHA-256 after capture.

Record:

filename
hash algorithm
digest
capture time

A matching hash later supports the claim that the stored file bytes have not changed relative to the recorded digest.

It does not prove that the original page was true or authentic before capture.

4. Keep source and interpretation separate

A useful evidence note contains:

Source:
https://example.com/terms

Captured:
2026-08-22T01:00:00Z

Method:
SingleFile

Observation:
The page identifies Example Ltd as the service operator.

Interpretation:
This is first-party evidence of the operator identity declared by the site at capture time.

Limitations:
Registry verification still required.

This prevents the artifact from silently becoming a conclusion.

5. Preserve the original capture

If you later:

  • edit;
  • annotate;
  • convert;
  • extract text;
  • redact;

create a derived artifact.

Keep the original SingleFile HTML unchanged.

Example:

original/EV-0042.html
derived/EV-0042_excerpt.png
notes/EV-0042.md

6. Add independent preservation when the finding matters

SingleFile is investigator-controlled local capture.

For high-value public evidence, you may also want:

  • Wayback Machine or another third-party archive;
  • ArchiveBox for recurring owned archival;
  • Hunchly for case-oriented evidence capture and reporting.

These layers solve different trust and preservation problems.

7. Understand what the file cannot prove

A SingleFile capture does not automatically prove:

  • publication date;
  • authorship;
  • factual truth;
  • complete server-side history;
  • every network request;
  • every dynamic browser state.

Use precise language:

The locally preserved page representation contained X at the recorded capture time.

That is stronger than overclaiming.

8. Sensitive pages

Before preserving a page, consider whether it contains unnecessary personal or confidential information.

Local capture can reduce the disclosure risk of submitting a page to a public archive, but you still need:

  • access controls;
  • retention rules;
  • protected backups;
  • proportionate collection.

Practical checklist

For important captures:

  • exact URL
  • UTC timestamp
  • SingleFile artifact
  • screenshot if visual state matters
  • evidence ID
  • SHA-256
  • observation note
  • interpretation note
  • limitations
  • backup
  • independent corroboration when needed

The strongest feature of SingleFile is not complexity.

It is that disciplined capture can be made easy enough to use consistently.

References

last published Aug 22, 2026