[Millennium]

If I needed to preserve a Web page to use as evidence in court, what would be the best way of going about it? I've thought of printing and saving PDFs (and I've done these), but I understand that these probably won't be considered very strong evidence. I've started using freezepage.com to go through the process manually, but this is taking a long time and I can't be sure that the data won't change before I am finished. I've also submitted the site to the Wayback Machine (which I know has been used as evidence in court before) so that they'll crawl it, but that will likely take a few days and I can't be sure that the data won't be gone before then.

Are there any more reliable ways of preserving data, given that I'm looking to maximize the chance of the preserved copy being admissible in court as evidence? I would greatly appreciate any advice people have on this.

[Socially Awkward Solo]

Just out of curiosity can you tell us what the kerfuffle is about?

[olePigeon]

Google Cache?

[dcmacdaddy]

Originally Posted by Millennium

If I needed to preserve a Web page to use as evidence in court, what would be the best way of going about it? I've thought of printing and saving PDFs (and I've done these), but I understand that these probably won't be considered very strong evidence. I've started using freezepage.com to go through the process manually, but this is taking a long time and I can't be sure that the data won't change before I am finished. I've also submitted the site to the Wayback Machine (which I know has been used as evidence in court before) so that they'll crawl it, but that will likely take a few days and I can't be sure that the data won't be gone before then.

Are there any more reliable ways of preserving data, given that I'm looking to maximize the chance of the preserved copy being admissible in court as evidence? I would greatly appreciate any advice people have on this.

Why would the PDF's be in-admissible? It has a time- and date-stamp of the file creation and you can usually embed a time- and date-stamp into the file when printing it.

Or, make the PDF and then e-mail it to yourself. That would provide you with a legally verifiable time- and date-stamp of when the file was sent. Courts can and do accept e-mails provided by an ISP as evidence so, if you can get an e-mail of a PDF of a wesbite, you should be able to verify at least the delivery of the file in question. I would think this would give more legal weight to the substance of the PDF.

My $.02

[TETENAL]

Print it? Why wouldn't a printout count as evidence?

If it was really really really really important, I would maybe have a notary print and sign it for me.

[sabrejim]

Don't worry about it. If the data changes just make a local copy and edit it and then print it out.

[starman]

It's impossible to preserve a web site because you can alter any form that you save the page in.

There needs to be some kind of unalterable timestamp on the data. Without it, I could make a PDF of anything and say it's true.

[Dork.]

1) Talk to a lawyer. A real one, not an Internet lawyer.

2) I wonder if you could write a statement about your situation, include the PDF in your statment, then get the whole thing notarized. That would establish a date for your statement, and also put your assertions on record that you swear them to be true.

3) Talk to another lawyer. If you're bothering to do this, then you probably want to do it right, and you ought to be able to spend a little cash and get advice.

[Oisín]

Originally Posted by dcmacdaddy

Or, make the PDF and then e-mail it to yourself. That would provide you with a legally verifiable time- and date-stamp of when the file was sent. Courts can and do accept e-mails provided by an ISP as evidence so, if you can get an e-mail of a PDF of a wesbite, you should be able to verify at least the delivery of the file in question. I would think this would give more legal weight to the substance of the PDF.

This would prove the date—but not the contents: he might have edited the PDF file and changed the contents of the file before e-mailing it.

I’d say Tetenal’s solution is more or less the only option that’s bulletproof.

Edit: Or better yet, follow Dork.’s advice

Or perhaps made a video recording of the site as it is now, and burn it to a (non-RW) CD. That way, you can’t change the date (or contents) afterwards. Then again, how would it show up if you’d changed the date on your system before burning the CD?

Edit again: I’d like to join the group of those who are curious as to what the reason behind all this may be.

[Socially Awkward Solo]

Originally Posted by starman

It's impossible to preserve a web site because you can alter any form that you save the page in.

There needs to be some kind of unalterable timestamp on the data. Without it, I could make a PDF of anything and say it's true.

Can't you do the same with a photo? Even when people show printed photos as proof the judge doesn't ask them for negatives does he?

[Millennium]

Originally Posted by starman

It's impossible to preserve a web site because you can alter any form that you save the page in.

There needs to be some kind of unalterable timestamp on the data. Without it, I could make a PDF of anything and say it's true.

Exactly the problem, thus why I started looking into more reliable methods.

People have been asking what the situation is, but I'm going to need to get permission from a few people before I say much. For now, I'll just say that someone has done something truly nasty to a good friend of mine, and he's been bragging. I want to get a reliable snapshot of this so that I can give it to the authorities.

[TETENAL]

Originally Posted by Millennium

I'll just say that someone has done something truly nasty to a good friend of mine, and he's been bragging. I want to get a reliable snapshot of this so that I can give it to the authorities.

If that is the case then just go to the police now and show them. I would get a printout with URL and date & time anway.

[itai195]

Probably best to ask a lawyer if you're really concerned. AFAIK, the rules for admissibility of electronic documents isn't that different from any other document, even though they are more easily altered.

[Socially Awkward Solo]

Originally Posted by Millennium

For now, I'll just say that someone has done something truly nasty to a good friend of mine, and he's been bragging. I want to get a reliable snapshot of this so that I can give it to the authorities.

Found a Sidekick did he?

[starman]

That's tough, Mil. I don't think you need to say any more than that except was the nastiness in text or a photo?

SWG: Good point, but it's much harder to alter a photo than change the date on a PDF.

[Socially Awkward Solo]

Originally Posted by starman

SWG: Good point, but it's much harder to alter a photo than change the date on a PDF.

Well yes and no.

At any rate for crime scenes isn't there only ONE type of camera that can be used to document evidence? Some special one that is tamperproof or something.

[zerostar]

Did your friend give the Sidekick back yet?!?!?!

EDIT:

/beaten to it

[Socially Awkward Solo]

Originally Posted by zerostar

Did your friend give the Sidekick back yet?!?!?!

/beaten to it

From the same joke 3 posts ago?

[zerostar]

Originally Posted by Socially Awkward Solo

From the same joke 3 posts ago?

yeah thats what I meant, didn't see your post at first...

[chris v]

what about The Wayback Machine?

[Millennium]

Originally Posted by TETENAL

If that is the case then just go to the police now and show them.

I can't; depending on which department has jurisdiction on this, I'm either in the wrong state or on the wrong continent. To answer the question about what form it takes, it's text.

[wataru]

Originally Posted by chris v

what about The Wayback Machine?

RTFT.

[chris v]

Originally Posted by wataru

RTFT.

oh hello.

[Millennium]

Originally Posted by chris v

what about The Wayback Machine?

I've already submitted it there, but it will probably be a few days before they can crawl it. Although I don't think this guy is going to be smart enough to take his stuff down, I can't be completely sure. Right now he seems to think he's invincible, but he has friends who are more savvy than he is, and I'm worried that one of them will knock some sense into him before the Wayback Machine can take effect.

[starman]

Can you call the ISP that hosts the site? Social engineer your way in there.

[besson3c]

Millenium,

wget the website so that you have a snapshot of the entire site, and tar the directory preserving timestamps. Then, if the site changes, wget it again and use diff to find out exactly what has changed on the site, or do an md5 checksum check on the tarball. The creation date on Unix timestamps should be solid evidence. AFAIK, you can't tamper with these creation dates.

[TETENAL]

Originally Posted by besson3c

AFAIK, you can't tamper with these creation dates.

[besson3c]

Originally Posted by TETENAL

Yeah, so what? How will changing the time affect the creation dates?

Edit: I get it.. changing the date before running the wget.. okay

[Socially Awkward Solo]

If you take a picture with a camera of the screen does the negatives or EXIF data count as a time stamp?

[besson3c]

Okay, well this is a stretch, but you could find some sort of public machine or perhaps the Unix server of a host that you don't have admin access to to reset the clock, then do the wget + tar + md5.

That's how our IT security departments handle confidential information (minus the wget part, since in our case it would be verifying files hosted locally on one of our servers, and we also PGP sign stuff we pass on).

[besson3c]

Originally Posted by Socially Awkward Solo

If you take a picture with a camera of the screen does the negatives or EXIF data count as a time stamp?

Sounds like the same problem I ran into, you could reset the camera's clock prior to taking the shots.

I think some sort of machine that can be proven you don't have admin access to would be your best bet.

[starman]

Originally Posted by besson3c

AFAIK, you can't tamper with these creation dates.

You can. Trust me.

[starman]

Originally Posted by Socially Awkward Solo

If you take a picture with a camera of the screen does the negatives or EXIF data count as a time stamp?

And what are you taking a picture of? A web site or a phony web site?

[besson3c]

Originally Posted by starman

You can. Trust me.

Really? How would one do that, aside from setting the clock ahead of time prior to the initial write? Besides, with an md5 or sha signature, if something has been changed there would be ample evidence of this from the different signature alone.

[Socially Awkward Solo]

Ok I know this is what my buddies who write scripts do, don't know if it is the right thing though.

What they do is print out the script, seal it in an envelope and mail it to themselves and when they get it they keep it shut. Apparently by the postage stamp it proves the date or something.

[starman]

Originally Posted by besson3c

Really? How would one do that, aside from setting the clock ahead of time prior to the initial write? Besides, with an md5 or sha1 signature, if something has been changed there would be ample evidence of this from the different signature alone.

*sigh*

Who's to say the data ITSELF isn't bogus?

Guys, you're throwing around a lot of good ideas, but there are a few things missing.

1) You can't prove the data came from THAT system on THAT day.
2) You can't prove the data itself wasn't altered.
3) You can't prove that you yourself made the data up on a server that looked like the original.

You talk about doing a wget. Well, so, I do a wget, modify the dates and the data, THEN tarball it. Now who's to say it's legit?

There's NO WAY IN HELL to prove that data came from an ISP without getting data from the ISP itself and someone from the ISP signing off on it.

THAT is the solution to the problem.

[starman]

Originally Posted by Socially Awkward Solo

Ok I know this is what my buddies who write scripts do, don't know if it is the right thing though.

What they do is print out the script, seal it in an envelope and mail it to themselves and when they get it they keep it shut. Apparently by the postage stamp it proves the date or something.

That doesn't help in this case. Even if you email it to yourself, how do you know the file's legit?

[Socially Awkward Solo]

Originally Posted by starman

That doesn't help in this case. Even if you email it to yourself, how do you know the file's legit?

Well email is a bit different than a stamp from the postal service.

[Big Mac]

Originally Posted by itai195

Probably best to ask a lawyer if you're really concerned. AFAIK, the rules for admissibility of electronic documents isn't that different from any other document, even though they are more easily altered.

I think itai195 is right here, but it's something an experienced litigator would know about. I would just go the PDF route and perhaps have someone else across the country or in a different country entirely do the same so that there will be two identical copies. It's pretty likely that opposing counsel will not try to deny the authenticity of the copy anyway.

[besson3c]

Originally Posted by starman

*sigh*

Who's to say the data ITSELF isn't bogus?

It doesn't, but it would put the liability on the company to prove that their files from this date have a different crypto signature, and to explain what has changed. Once they say "page x has changed, and here's how", Millenium could apply those changes to his copy and see if the crypto signature matches. If nothing more, it gives him some additional leverage.

1) You can't prove the data came from THAT system on THAT day.

That will be the hardest part, but if he is willing to find a third party that provided him with a computer that they would defend in a court, and claim that they didn't provide him with access to set the clock, this would work, wouldn't it?

2) You can't prove the data itself wasn't altered.

Unless there is a flaw with the scheme I've described above, I think you could.

3) You can't prove that you yourself made the data up on a server that looked like the original.

Why not? Wget would only fetch the publicly crawable files. These same files would be accessible in any search engine, and are free to download and do crypto signature checks on and whatnot.

You talk about doing a wget. Well, so, I do a wget, modify the dates and the data, THEN tarball it. Now who's to say it's legit?

The dates I addressed (finding a third party to provide a server), but any changes in data would have to be explained, and they would have to match your copy, like I said. If you change a single letter in a file and run a checksum on it and make that exact same change to your own copy and run the same checksum tool, there should be an exact match.



This is exactly what crypto technologies are for, and they do hold up in the courts.

[TETENAL]

Originally Posted by besson3c

Really? How would one do that, aside from setting the clock ahead of time prior to the initial write?

http://www.skytag.com/filebuddy/en/s...ots/infow.html

I know you hate GUI tools, but I'm sure you can do it via the command line as well.

[Oisín]

Originally Posted by TETENAL

http://www.skytag.com/filebuddy/en/s...ots/infow.html

I know you hate GUI tools, but I'm sure you can do it via the command line as well.

Yup, I was going to post that as well: touch lets you change more or less any property of a file, date/time of creation and last edit included.

[besson3c]

Originally Posted by TETENAL

http://www.skytag.com/filebuddy/en/s...ots/infow.html

I know you hate GUI tools, but I'm sure you can do it via the command line as well.

I don't hate GUI tools, what is with you? You are almost as relentless as Kevin!

Interesting, I didn't know this could be done using any tool on any Unix operating system. Thanks for teaching me something new! (Ditto for the guy who pointed out the touch command, I didn't realize that it can be used to change thse file attributes).

I guess this complicates my suggestions for Millenium, although the crypto signature would still reflect a difference in the files even if the only difference is the timestamp, AFAIK. However, you wouldn't have as much leverage to insist that your copy of their website files is the master copy, and come to think of it, unless these were static .html, .htm, or .shtml files, this probably wouldn't work anyway...

Oh well, crypto technologies probably represent your most legally sound route, but the logistics of proving that your files were originally valid sounds like it would be tough.

One possible route is to see if you could get the ISP of this company to be willing to act as a neutral party and take a tar snapshot of the website even prior to announcing to the company that you will take them to court or giving them any reason for them to want to cover their tracks. Providing you cna get a legally acceptable copy of their website files and a crypto signature, this should be your ticket.

[shunt]

A brick thru the window does wonders.

This legal shmegal crap is for the birds....take it to him.

You'll find out who your real friends are.

[davesimondotcom]

You could always use the old Poor Man's Patent trick.

Do besson's wget trick or any other method, then simply burn it to a CD, put that CD in an envelope, seal it (you could even have a notary notarize a note in the envelope if you are really anal), then address the envelope to yourself and send via US Mail.

The postmark acts as a proof of the date.

You could also email it to your lawyer and have it kept so that you don't get accused of breaking the seal to put the CD in in the time since the timestamp.

[Socially Awkward Solo]

Originally Posted by davesimondotcom

You could always use the old Poor Man's Patent trick.

Do besson's wget trick or any other method, then simply burn it to a CD, put that CD in an envelope, seal it (you could even have a notary notarize a note in the envelope if you are really anal), then address the envelope to yourself and send via US Mail.

The postmark acts as a proof of the date.

You could also email it to your lawyer and have it kept so that you don't get accused of breaking the seal to put the CD in in the time since the timestamp.

So I guess that backs up what I said.

[besson3c]

Originally Posted by davesimondotcom

You could always use the old Poor Man's Patent trick.

Do besson's wget trick or any other method, then simply burn it to a CD, put that CD in an envelope, seal it (you could even have a notary notarize a note in the envelope if you are really anal), then address the envelope to yourself and send via US Mail.

The postmark acts as a proof of the date.

You could also email it to your lawyer and have it kept so that you don't get accused of breaking the seal to put the CD in in the time since the timestamp.

The problem is, you can tamper with the files before mailing them to yourself... The only way to prove that the files have not been altered (that I know of) is with cryto signing technology, but it seems like we are sort of stuck with the chicken/egg problem here..

[davesimondotcom]

Originally Posted by Socially Awkward Solo

So I guess that backs up what I said.

Yep - I missed that particular post of yours.

[starman]

Originally Posted by Socially Awkward Solo

So I guess that backs up what I said.

No, it proves what I said.

Let's say I do this: I make up a phony document that has you saying "I love the PS3" and I mail it to myself, and then MacNN goes down in 2009. All that proves is that I mailed myself a phony document.

[davesimondotcom]

Originally Posted by besson3c

The problem is, you can tamper with the files before mailing them to yourself... The only way to prove that the files have not been altered (that I know of) is with cryto signing technology, but it seems like we are sort of stuck with the chicken/egg problem here..

I was thinking more about the proving the timeline problem but you are right about the potential editing of the documents.

----

What about getting a court order for the ISP that hosts the site to have a backup of the site made?