Can a Forensic Examiner Prove What a Website Sent?

A forensic examiner handed a packet capture and the matching TLS keys can establish a great deal: that the traffic decrypts, that a secure session was recorded, and, for a full handshake, that the genuine certificate holder signed it. What the examiner cannot establish from that capture alone is that the website sent the content. The reason is a property of TLS, not a failing of any tool.

Network capture is often treated as the gold standard for web evidence, because it records the traffic itself rather than a picture of a screen or a file written by archiving software. That is a real step up. It is also where an important limit is easiest to miss.

What the examiner can establish

Given the capture and the session keys, an examiner can:

• Decrypt the traffic, and show it decrypts consistently, with every record’s authentication tag checking out.
• Show the capture records a secure session to a particular address, as recorded by the capturing machine.
• Show, for a full handshake, that the certificate holder signed that handshake. In a full TLS handshake the holder of the certificate’s private key signs it; that holder may be the site’s content-delivery network, and the finding assumes the certificate was validly issued. It shows the signature was made at some point, not when, and not that this particular connection is the one it signed.
• Show that nothing has changed since sealing, if the capture was signed or timestamped when it was made.

What the examiner cannot establish

The keys that protect the traffic after the handshake are symmetric: both ends derive the same keys, so the client holds the key that protects the server’s responses. That is how the client reads them at all.

It follows that anyone holding those keys can produce records that look exactly like the server’s, with valid authentication tags. The collecting machine holds them. So a capture made on the collector’s own machine cannot distinguish “the server sent this” from “the collecting machine produced this”. No amount of scrutiny of the file closes that gap, because the file is exactly what an honest capture and a fabricated one would both look like.

Two further limits are worth knowing:

• Resumed sessions carry no server signature. A browser that resumes an earlier session skips the certificate step, so even the “reached the genuine site” finding applies only to connections that begin with a full handshake.
• Hardening the device raises the cost, not the ceiling. Sealing the capture as it is made, and tying each connection to the browser that made it, would make fabrication harder and more detectable (we are building these). But these are the device vouching for itself, so they are engineering assurance, not cryptographic proof.

What closes the gap

The gap exists because the only party that saw the traffic is the party making the case. Closing it takes a witness outside the collector’s control: a relay in the network path that signs the encrypted traffic as it passes, from the network side, without ever holding the keys.

With that witness, the examiner has a second record of what arrived from the server’s side, independent of the collector, and fabrication would take more than the keys. That is far harder than editing a file, though not impossible, and it applies only to connections that begin with a full handshake; resumed connections carry no server signature and are reported separately. The relay still has to be trusted for what it signed, and it is independent of the collector, not of whoever operates it. The full comparison of methods is in Screenshot, HAR, WARC or PCAP: what does each actually prove?

What this means in practice

For an examiner asked to rely on web evidence, the useful questions are:

1. Who captured it, and on whose machine?
2. Was there any witness to the traffic other than that machine?
3. Did the connections begin with full handshakes, or were they resumed?
4. Can I verify it myself, with my own tools, without asking the party who produced it?

If the answer to the second question is no, the capture can prove a great deal about the session, and nothing independent about the content.

The fourth question applies to us as much as anyone. Shorenet’s validator and its format specification are committed to publication under an open licence before live casework; until they are published, an examiner has to obtain them from us.

Where this matters in casework: law enforcement and litigation.