Shorenet Trawler: Web and social media evidence capture for Windows.
Trawler is the evidence capture application for investigators. Browse as normal and it records what each website sent, with a recording of the screen alongside it, then seals both so any later change shows. The traffic shows what was online; the recording shows what was displayed.
What Trawler does
- Captures as you browse. Anything you open in the capture browser, including Facebook, Instagram, X, TikTok, LinkedIn and YouTube, and content you are logged in to. Each capture profile has its own isolated browser.
- Has the traffic witnessed. A witness service we operate witnesses the traffic on its way, holding no keys to read the encrypted content. Like any network relay it sees where the traffic is going. The detail.
- Seals the capture. Built so any later change to the evidence shows when the capture is checked (see the validator, below).
- Builds the case. Mark exhibits, and for Instagram and Telegram turn captures into structured records of accounts, posts, messages and media, and how they connect.
- Produces a report written for court. An exhibit index, a plain-English verification panel for each exhibit, a continuity record and a digest of every file in the package.
What web and social media evidence capture covers, and who uses it. Platform by platform, in the FAQ.
Built for the other side to check
A Trawler case package carries the sealed evidence (one file per exhibit), the report and stills from the rebuilt pages, and the other side will be able to check it with an independent validator, with no Shorenet server, account or cooperation. The validator will be free and openly licensed, published before live casework. Evaluation participants receive it first. The traffic can also be exported in the standard format Wireshark reads, so an expert can examine it with tools they already trust.
Shorenet is not yet on general release, and the validator is not published yet. Teams can test it first in a free evaluation.
What you need
- A Windows computer. 64-bit Windows 10 or 11, with administrator rights to install Trawler (not to use it).
- A supported browser. Chrome, Edge, Firefox or Brave.
- An internet connection while capturing. Every capture goes through our witness service, so another VPN holding the connection has to be paused first.
Your evidence packages are kept on your own computer, and Trawler sends no captured page content. It does contact us to work (licences, updates, starting and ending captures, timestamps). Activation sends your computer’s name with the licence, and on a computer with a TPM security chip, an enrolment sends our server the certificate and public keys that identify this computer’s chip (a unique identifier for the chip). With an online licence it checks the certificates of the sites you captured with the authorities that issued them; and diagnostics are off unless you switch them on. What Trawler sends, and to whom, in full.
What it does not do
- It shows what a website sent, not that the content is true. A faithful record of false information is still a record of false information.
- It does not identify a person. Who wrote a post, or controls an account, remains investigative work.
- It does not capture native mobile apps. Telegram on the web is supported today; WhatsApp is in development.
- We run the witness service. It is independent of whoever captured the evidence, not of us. What trusting our witness service means.
Evaluate Trawler.
We are opening a small evaluation programme for Trawler before general release. Platforms that want the same engine inside their own product can talk to us about Shorenet Keel.