A post is deleted hours after it is published. A government page is quietly rewritten. A video documenting abuse is removed by a platform’s moderation system before anyone has downloaded it. For journalists, any of these can mean losing the evidence behind a story, and the proof needed to defend it if it is challenged.
This guide explains why online evidence disappears and sets out a practical workflow to capture it in a way that can be checked later. It draws on open standards and on tools that journalists and investigators already use.
Why online evidence disappears
Digital content is fragile. A 2024 Pew Research Center analysis found that 38% of webpages that existed in 2013 were no longer accessible a decade later, and that a quarter of all pages that existed at some point between 2013 and 2023 had vanished. Social media is especially volatile: nearly one in five tweets in the study’s sample was no longer publicly visible within months of being posted, and for tweets written in Turkish or Arabic the share exceeded 40% within three months.
Platforms can also remove material at scale. In its 2020 report “Video Unavailable”, Human Rights Watch documented how social media companies’ takedowns, increasingly automated, can erase content that investigators, researchers and journalists could have used as evidence of serious crimes. The report also noted that it is unclear how long removed content is kept by the companies.
Access can change as well. As the Global Investigative Journalism Network (GIJN) has noted in guidance first published by the BBC Academy, a public post can later be set to “friends only,” and if you make allegations based on something that is later deleted, it becomes your word against the poster’s.
Why a screenshot is not enough
A screenshot is a useful first reaction, but on its own it shows little about where the content came from, when it was captured or whether it has been altered. Researchers at Stanford’s Starling Lab, working with investigative newsrooms, have described a simple screenshot as insufficient for legal or historical proof and have been developing authenticated web-archiving workflows instead.
The international benchmark for this kind of work is the Berkeley Protocol on Digital Open Source Investigations, launched in December 2020 by the Human Rights Center at UC Berkeley School of Law and the UN Human Rights Office. It sets professional standards for identifying, collecting, preserving, verifying and analysing online information, and it is available in English, Arabic, French, Spanish, Mandarin and Russian. Its full text is published by the UN. Two ideas from it are useful for any newsroom: show that a digital item has remained unchanged since it was collected, and document the chain of custody, meaning who held the material and what was done to it.
The Protocol was written for war-crimes and human-rights investigations, not for everyday reporting. Most stories do not need court-grade procedure, but the same habits make your evidence far easier to defend.
A practical workflow
1. Capture quickly, and capture more than once
Do not rely on a single method. Combine a public archive link with a copy you control.
- Submit the page to a public archive. The Internet Archive’s Save Page Now and Perma.cc each give you a stable link to a snapshot. A tutorial from Aarhus University’s Centre for Digital Methods and Media notes that a free Internet Archive account unlocks extras such as a screenshot and saving outlinks, and that the service respects site owners’ crawling rules retroactively, so a saved page can later become unavailable. For that reason it recommends keeping local copies as well.
- Record dynamic and logged-in content in your browser. Archiving social media is imperfect, and Columbia University Archives advises that the most reliable approach is to capture feeds manually while logged in. ArchiveWeb.page does this in Chromium-based browsers, keeps everything on your device and exports standard WARC or WACZ files.
- Automate when there is volume. Bellingcat’s Auto Archiver takes a list of URLs and archives posts, videos and images, saving a screenshot and metadata with each. Nieman Lab reported that it had preserved more than 150,000 pages and posts and had been adopted by newsrooms and NGOs.
- Check the status of older tools. Rhizome’s hosted Conifer service, long recommended for capturing social media, announced it would stop accepting new captures in June 2026. Its developers at Webrecorder point users to ArchiveWeb.page and the Browsertrix platform instead. Training materials that still mention Conifer are out of date.
2. Save a copy in an open, verifiable format
Prefer WARC or WACZ files to image files. The WACZ format bundles the captured web data, indexes, metadata and verification information into a single ZIP file, and its hash-based checks make the archive tamper-evident. Webrecorder’s developers have explained on their community forum that because the archived data in a WACZ file is hashed and signed, removing or modifying any part of it invalidates the hash.
3. Fingerprint the file and keep a log
A cryptographic hash is a fixed fingerprint of a file; if even one bit changes, the hash changes. Generate a SHA-256 hash of each file as soon as you save it and store it in your log. On macOS or Linux, run shasum -a 256 followed by the file name; in Windows PowerShell, run Get-FileHash with the file name and -Algorithm SHA256.
For each item, log the original URL, the account name or handle, the date and time you captured it (with time zone), the tool and method you used, who captured it and where the file is stored. The Berkeley Protocol also recommends keeping an untouched original and doing your analysis on a separate working copy, an approach the open-source Digital Evidence Toolkit describes as it applies the Protocol’s criteria of authenticity, chain of custody and working copies.
4. Capture the context, not only the post
GIJN’s guidance suggests saving not only the page you need but the pages that connect to it and those it links to, and, where relevant, domain registration information and connected social media account pages. Profile pages, follower counts, timestamps, comments and replies can all matter later, particularly if you want to show how content changed over time.
5. Store it safely and protect people
Keep at least two copies in separate places, one of them offline or on encrypted storage. GIJN also suggests sending a copy to your legal team, since this dates the item on the email system. The Berkeley Protocol treats safety as part of the method: it sets out measures to protect the digital, physical and psychosocial safety of investigators and of the witnesses, victims and first responders, including citizens, activists and journalists, who document abuses. Graphic material takes a toll, so plan for breaks and support, and think carefully before circulating files that could identify a source or a victim.
Choosing a tool
| Tool | Best for | Limits to know |
| Wayback Machine – Save Page Now | Fast, free, public capture of a single page, with a stable archive link you can cite. | Saves one page at a time and respects robots.txt, including retroactively. Captures are public by design. |
| Perma.cc | Permanent, citable links from a library-backed service; archives can be downloaded as WARC files. | Only freely accessible pages (no paywalls). Free individual accounts are capped, so check current terms. |
| ArchiveWeb.page | Interactive capture of social media, logged-in pages and dynamic content, stored locally; exports WARC or WACZ. | Chromium-based browsers only. Manual and time-consuming for full accounts, since comments must be opened by hand. |
| Bellingcat Auto Archiver | Batch archiving of posts, videos and images from a list of URLs, with screenshots and metadata. | Needs technical setup (Docker or Python); a more user-friendly interface was announced in 2025. |
Limits and risks to keep in mind
- Public archives are public. A snapshot saved to the Wayback Machine can be seen by anyone, including the people you are reporting on. For sensitive or pre-publication material, capture locally first and think before submitting anything to a public service. This is our editorial advice rather than a rule from the sources above.
- Preserving is not verifying. An archived copy shows what was online at a given time; it does not show that the content is genuine. The Berkeley Protocol treats preservation and verification as separate phases, and you still need to corroborate what you have captured.
- Not every page can be captured. Platforms can block automated crawlers, and library guides to the Wayback Machine caution that some technical features of a page may not be captured. Test your archive by opening it, and if it looks wrong, try another method.
- Legal and privacy rules differ by country. Collecting and storing personal data can raise data-protection questions. Check your newsroom’s legal guidance, especially if the material involves private individuals.
Sources and further reading
- Berkeley Protocol on Digital Open Source Investigations – UC Berkeley Human Rights Center and OHCHR
- When Online Content Disappears – Pew Research Center, May 2024
- “Video Unavailable”: Social Media Platforms Remove Evidence of War Crimes – Human Rights Watch, September 2020
- How to Save Online Evidence and Why It Matters – Paul Myers, via GIJN (originally BBC Academy). Some of the software it mentions is dated, but the principles hold.
- Authenticated Web Archives – Stanford Starling Lab
- ArchiveWeb.page – Webrecorder
- Auto Archiver – Bellingcat
- Save Page Now tutorial – Centre for Digital Methods and Media, Aarhus University
- Perma.cc – Harvard Library Innovation Lab
Tool features, account limits and service status change often. Check each tool’s current documentation before relying on it. This guide is general information for journalists and is not legal advice.