Web forensics questions
Questions about specific online sources
Every online source presents different access, loading, identity and completeness challenges. The collection method should preserve the evidence in context and explain what the authorized account and browser were able to observe.
How do you preserve evidence from webmail?
Access the mailbox only with appropriate authority, preserve the message in its folder or thread context and obtain original message data or attachments where the service permits. Record the account role, displayed headers, time settings, search or filter used and any export limitations.
How do you acquire evidence from a web-based CRM?
Run the acquisition from an authorized workstation and account that can reach the CRM through the required network, VPN, proxy and authentication controls. Preserve the navigation path, records, activity history, conversations, exports, session video and available network context while documenting the account role and CRM timezone.
How do you acquire CCTV footage from a web portal?
Use the authorized portal and account, document the camera, site, date range, timezone and playback controls, then preserve the web context and download the original footage where available. Record the export action, file properties and hash because a screen recording alone may not retain the native video quality or metadata.
How do you preserve online video or streaming evidence?
Document the page, publisher, title, URL, playback state and relevant time range, then acquire the media or authorized stream where technically and legally possible. Preserve supporting page and network context and distinguish the continuous acquisition recording from the source video itself.
How do you acquire evidence from an online marketplace?
Preserve the listing together with seller identity as presented, price, variants, availability, media, reviews, product identifiers and relevant purchase or communication context. Marketplaces personalize results and change inventory frequently, so record the account, location and collection time.
How do you preserve evidence from a cloud document portal?
Document the authenticated account, document location, visible version or revision state, permissions and relevant activity, then export or download the native or platform-generated file when authorized. Preserve the portal context separately from the exported file and note features the export does not include.
How do you preserve messages from a workplace chat interface?
Use an approved account and scope, preserve the workspace, channel or conversation context, participants, timestamps, replies, reactions, attachments and relevant navigation. Search results and exports can omit edited, deleted or threaded content, so report the collection method and any platform limitations.
How do you acquire evidence from a dark-web service?
Use an isolated, authorized and risk-assessed environment, document the access route and source address and avoid unnecessary interaction or downloads. Preserve visible content and available technical context while accounting for anonymity, instability, malicious content and operational-security requirements.
How do you preserve an AI chatbot conversation?
Record the service, account and model information shown, conversation URL or identifier, prompts, responses, attachments, displayed settings and acquisition time. Because outputs can vary and services may edit model behaviour, preserve the complete conversation context rather than copying only a selected answer.
Continue exploring
More web-forensics questions
Browse all seven question sets or move from a concise answer to the detailed guides and acquisition workflows linked above.
How do you acquire social-media evidence?
Use an authorized account where necessary, identify the post or profile, preserve the URL and surrounding conversation, expand relevant replies or media and record the acquisition process. Personalized feeds, deleted content, private messages and platform timestamps require careful scope and limitation notes.