Web and social media evidence FAQ: Questions buyers ask us.
What Shorenet captures, what you get, where your data goes and what you need. If your question is not here, ask us.
Exhibit 12 · sealed
Social media post with replies
@community.example
Road closed again. Third time this month.
- Captured 21 August 2026, 07:55 UTC
- SHA-256
241de60b…8e0e7a9b - Timestamped by DigiCert (RFC 3161)
- Witnessed by the Shorenet relay
Verified · independently witnessed
What you get
What do I actually get from a capture?
A case package you can hand over as it is: the sealed evidence (one file per exhibit), a PDF report written for court, stills from the rebuilt pages, and a validator so whoever receives it will be able to check it offline. The validator is not published yet: Shorenet is pre-deployment.
What is in the report?
An exhibit index, a plain-English verification panel for each exhibit, a continuity record, and a digest of every file in the package. For criminal cases in England and Wales it can draft a witness statement under section 9 of the Criminal Justice Act 1967 and, for a qualified expert, a CrimPR Part 19 declaration. Validating the method under the Forensic Science Regulator’s Code stays with your organisation; we provide validation material.
Can my expert use their own tools?
Yes. The traffic can be exported in the standard format that network tools such as Wireshark read, so it can be examined with software they already trust.
What it captures
What can it capture?
Traffic from anything you open in the capture browser, with pages rebuilt readably for ordinary websites: pages, posts, profiles, comments and listings, on any site, including Facebook, Instagram, X, TikTok, LinkedIn and YouTube. It works with Chrome, Edge, Firefox and Brave on Windows. Its evidence is the web traffic itself, not a picture of the screen; a screen recording can run alongside as a guide to what you saw.
Can I capture content I’m logged in to?
Yes. Each capture profile has its own isolated browser, and logins persist between sessions. Whether you are entitled to access that content is for you to decide: Shorenet gets you into nothing you couldn’t already see.
What about video?
Video can be rebuilt from YouTube captures, clearly labelled as a reconstruction and never presented as more complete than it is.
What about Telegram and WhatsApp?
Messaging apps add a second layer of encryption inside the web connection, so reading them takes a dedicated module for each service. Telegram (web) is supported today. WhatsApp is in development.
Does it do more than save pages?
Yes. For Instagram and Telegram today, with more platforms to follow, Shorenet turns what you capture into structured records: the accounts, posts, messages and media, and how they connect. Records build up across captures, so you can follow a network from one account to the next.
Does Shorenet collect data from platforms?
No. Shorenet creates no accounts, does no automated browsing, and never resells data. Your investigator browses; Shorenet records what their own browser receives, and witnesses it.
Are the records evidence?
They are an interpretation to help you read the evidence, not a substitute for it. Every record links back to the exact captured data it came from. Extraction improves with updates, and when an update changes how an earlier capture is read, the change is shown; the sealed evidence itself never changes.
Is a decrypted message still proven?
Yes. The relay witnesses the encrypted traffic, and the decrypted messages are cryptographically tied to it: a wrong key simply fails the app’s own integrity check. Turning them into a readable conversation is reconstruction, which quarantines anything uncertain.
What can’t it capture?
Native mobile apps, and desktop apps outside the capture browser. And nothing that was deleted before you captured it.
Your data
Where do my captures go?
They stay on your machine. Your evidence packages stay on your own computer; your traffic passes through our relay encrypted and we never see the content. The application sends us only licence checks, capture start and end times, update checks and revocation-list fetches.
What does the relay see and keep?
It cannot read the content of encrypted pages or hold the keys. Like any network relay or VPN, it routes your traffic to where it is going, but it does not record where you browsed. It signs fingerprints of the traffic, keeps a small signed record of the session (a few hundred bytes, no content or destinations) for seven days, and deletes the rest when the session ends.
Will websites see my organisation’s address?
No, they see the relay’s address, and that applies to all of the computer’s traffic while capturing. Whether your activity needs authorisation, for example as covert surveillance, is unchanged.
Where is the relay?
Wherever you need it. The relay is your exit to the internet, so it can run in the location you choose, and your captures reach websites from there.
What does the app send to Shorenet?
Only what it needs to work: licence checks, capture start and end times, update checks and revocation-list fetches. Never captured content.
Proof and verification
Can I prove what a website or server actually sent?
For pages you capture, yes. Our relay witnesses what was sent, without being able to read it, and the capture is sealed. For connections that begin with a full handshake, the website’s own signature ties that traffic to the site; resumed connections are reported separately. We operate the relay, so it is independent of you, not of us. How that compares with screenshots, archives and network captures. Social media evidence: what it proves, and how to preserve a post.
Can it prove a post existed after it was deleted?
Only if you captured it first. Nobody can witness a page after it has changed, which is why you capture as soon as something matters. What you can do if it is already gone.
Is it court-admissible?
Admissibility is for the court. What you get is a record the other side can test for itself, a report, and for criminal cases in England and Wales the option of a Criminal Justice Act 1967 s.9 witness statement or, for a qualified expert, a CrimPR Part 19 declaration.
What does the other side see if I hand it over?
The decrypted capture session, including anything you were logged in to while capturing. Use dedicated investigation accounts, and treat the package as you would any sensitive disclosure.
Can I capture illegal content?
Be careful. Capturing some material, such as indecent images of children or terrorist content, is itself an offence outside authorised roles. Check your authority before you capture it.
Does it give me chain of custody?
The report includes a continuity record and a digest of every file in the package, and the evidence stays on your own machine. The seal shows nothing changed after sealing, including by the person who captured it.
Is it tamper-proof?
No evidence is tamper-proof, and we don’t claim it. A capture is tamper-evident: it is sealed with post-quantum and classical signatures, so any change after sealing, including one by the person who captured it, shows when anyone checks it.
Can a website later deny what it sent me?
It can dispute it, but the other side’s expert can check the capture themselves instead of taking either side’s word. It shows what the site sent to your session; pages vary by account and location, so it does not prove everyone saw the same thing.
Who can check a capture?
By design, anyone holding it, including the other side’s expert, with no Shorenet server, account or cooperation: the validator travels in the package and uses published cryptographic standards. The validator is not published yet, because Shorenet is pre-deployment; it will be released under an open licence before live casework.
What if Shorenet stopped trading?
Captures you already hold would remain checkable. The evidence and every signature over it live in the package, not on our servers.
Does it detect deepfakes?
No, and we don’t claim to. Shorenet proves what a website sent, not whether what it shows is real. Often, what matters is that something was published, and that is what it proves.
Using it
What do I need?
A 64-bit Windows 10 or 11 computer, administrator rights to install it (not to use it), and an internet connection while capturing.
Does it work alongside a VPN?
Not while capturing. Every capture goes through the relay, so another VPN holding the connection has to be paused first.
Facebook, Instagram, X, TikTok, LinkedIn, YouTube, Telegram, WhatsApp and other names used on this page are trademarks of their respective owners. Shorenet is not affiliated with, endorsed by or sponsored by any of them.
How do I get it?
We’re opening a small evaluation programme before general release. If your team relies on evidence of what was online, talk to us.