DIGITAL EVIDENCE PRESERVATION
A screenshot is an allegation.
We capture public digital content the way evidence is supposed to be captured — hashed at acquisition, documented end to end, and delivered with a certificate describing exactly how it was obtained.
MODLAN Systems, Inc. performs regulated investigative services only in jurisdictions where it holds the required licences. Inquiries from other jurisdictions are referred.
CERTIFICATE OF DIGITAL ACQUISITION
What every capture includes
- 01
- Examiner name, title, and qualifications
- 02
- Acquisition date and time, stated in UTC
- 03
- Source path, publicly accessible
- 04
- Collection method — unauthenticated, public source
- 05
- Tool name and version
- 06
- Cryptographic digest for each item and for the full set
- 07
- Underlying page data, not only the rendered view
- 08
- Errors encountered during acquisition
- 09
- Attestation language provided by counsel.
METHOD
Method
- 01Identify
The specific content and the investigative question it answers.
- 02Acquire
Captured from the public source without authentication, using a recorded tool and version.
- 03Hash
A cryptographic digest computed over each item and over the full collection set at the moment of acquisition.
- 04Document
Examiner, date and time in UTC, source path, method, and any errors encountered.
- 05Review
A licensed investigator reviews relevance and context before anything is reported.
Captured, not screenshotted.
A screenshot preserves what a page looked like. A forensic capture preserves the underlying data, the time it was taken, the path it came from, and a digest that will show if a single byte changes afterwards. The second one is what answers a challenge.
WHAT WE DO NOT DO
- Represent an archived copy as a live capture. Archive-sourced material is labelled as such, with the archive's own timestamp.
- Capture from private or login-protected areas.
- Alter, enhance, or annotate captured content. Analysis is delivered separately from the preserved original.
- Guarantee admissibility.
QUESTIONS
Common questions
A screenshot has no acquisition record, no hash, and no underlying data. It invites an authentication fight your opponent is likely to win.
The preserved items, the hash values, and a certificate of acquisition describing how each item was obtained.
It is prepared to support authentication of the capture. Whether a court admits a given exhibit depends on the matter, and we do not promise outcomes.
Standard turnaround is stated at engagement and confirmed in writing.
CONTROLLED INTAKE
Discuss the assignment without transmitting sensitive evidence.
Public consultation channels are for business-purpose intake only. Claim files, medical records, credentials, claimant-identifying data, and evidence belong in an approved secure workflow.