Shorenet Research
Notes on making digital evidence provable.
Working notes from the people building Shorenet: how evidential capture is constructed, what each part of the proof chain does and does not establish, and where the honest limits are. Written for forensic examiners, expert witnesses, and engineers who need to interrogate the method rather than take it on trust.
Every page here is permanent and revised in place rather than reissued. Each carries a version number and a revision history, and section anchors stay stable so citations keep resolving.
Our standing rule: state the boundary before opposing counsel does. Where a claim is engineering assurance rather than cryptographic proof, these pages say so.
Start here: What does a screenshot actually prove? The notes below are listed in reading order, each building on the one before.
Foundations
-
What Does a Screenshot Actually Prove?
The industry solved the easy half of the problem, and the easy half is now cheap
-
Unchanged Is Not the Same as Accurate
A hash proves a web capture has not changed since it was saved. It does not prove the capture shows what the website sent.
-
Screenshot, HAR, WARC or PCAP: What Does Each Actually Prove?
Different evidence answers different questions. Only some of them answer “what did the server actually send?”
-
Can a Forensic Examiner Prove What a Website Sent?
Why a network capture on the collector’s own machine has a trust problem, and what closes it
-
How to Prove an Online Post Existed, and When You Can’t
The honest answer depends almost entirely on whether anyone captured it before it changed