Evidence Collector is a screenshot tool developed to assist professionals in the collection, documentation, and preservation of digital evidence in a technically reliable manner.

The extension was designed to create authentic records of the user's own browsing experience, maintaining the integrity of the evidence through cryptographic methods widely recognized by the forensic community.

Evidence Collector acts exclusively on the content displayed on the screen and the audio from the user's computer, similarly to a camera or a screen recorder. The extension does not bypass protection mechanisms, does not access restricted content, and does not collect third-party information beyond what is explicitly displayed to the user at the time of capture.

⚙️ Features

📸 Capture Visible

Captures the visible area of the current page in high resolution and generates a PDF document with complete metadata (URL, date, time, browser). Each capture is accompanied by an integrity verification file (SHA-256 hash and digital signature) that allows subsequent verification that the evidence has not been tampered with.

⏺️ Record Screen

Starts real-time screen recording, capturing navigation video in WebM format with high-quality codec. Allows documenting complete interactions with web pages, including scrolling, clicks, and multimedia content playback. The recording captures exactly what is being displayed on the browser screen. Each generated file is accompanied by an integrity verification file (SHA-256 hash and digital signature).

📄 Full Capture

Performs automatic sequential captures of the page during scrolling, generating a multi-page PDF document with all visible content. The user can configure the scrolling speed (slow, medium, or fast) and the time interval between each capture (recommended: 1-5 seconds). Ideal for long pages such as timelines, news feeds, or extensive documents. Each capture records complete metadata and the generated file is accompanied by integrity verification (SHA-256 hash and digital signature).

🆔 Capture Profile ID

Automatically extracts unique identifiers from social media profiles and online platforms. Important: The user must be logged into the social network or service and have the target profile's main page open. The feature identifies URL patterns and page elements to extract profile IDs from Facebook, Instagram, Twitter/X, LinkedIn, TikTok, YouTube, and other platforms.

🌐 Open Multiple URLs

Allows opening multiple URLs automatically. The user enters a list of addresses (one per line) and the extension opens each URL in a new background tab. Useful for bulk verification or preparing multiple pages for evidence collection.

💬 Expand Comments (beta)

Automatically expands all comments and replies on social media posts (Facebook, Instagram, TikTok, YouTube). The system detects the platform and applies pre-configured selectors to click buttons like "See more", "See all replies", and "Show replies". Allows automatic scrolling and interval configuration. Ideal for complete evidence collection on posts with many hidden comments. Includes visual selection mode for custom domains.

🔗 Extract Links and Emails

Scans the current page and extracts all links (<a> elements) and email addresses found, presenting them in organized, separate lists. Links and emails can be individually copied to the clipboard. Displays the total count of links and emails found. Useful for documenting connections between pages, identifying external references, or mapping contacts during investigations.

📊 Generate Report

Compiles all screenshots taken in the current session into a single structured PDF document, including index, complete metadata for each capture, and technical section on applied forensics methodology. The consolidated report also receives its own integrity verification file.

🔐 Validate Signature

Verifies the Evidence Collector signature of files generated by the extension. The user enters the SHA-256 hash and digital signature (obtained from the -hash.txt file) and the tool validates whether the signature matches the provided hash. This verification adds an extra layer of security that, together with the SHA-256 hash and other metadata, helps reinforce impartiality in the evidence collection process.

📥 Download WebM (Automatic Button)

When the extension is active, it automatically detects videos playing on the page and adds a floating "📥 Download WebM" button over each video. Clicking this button captures and saves the video content in high-quality WebM format, accompanied by an integrity verification file. Important: The capture takes the same time as the video playback in real-time for download. This feature is especially useful for preserving evidence of videos that may be removed or altered later.

🕓 Timestamp (FreeTSA)

Adds temporal proof to hash verification files through the FreeTSA service (RFC 3161). The user selects the -hash.txt file generated by the extension, and the tool sends the SHA-256 hash to the FreeTSA service, receiving a digitally signed timestamp that proves the file existed at that specific moment. The timestamp file (.tsr) is saved along with the hash file, providing additional temporal proof for forensic and legal purposes.

⛓️ Record Blockchain (OpenTimestamps)

Creates immutable temporal proof using the Bitcoin blockchain through the OpenTimestamps protocol. The user selects the -hash.txt file generated by the extension, and the tool submits the SHA-256 hash to OpenTimestamps public calendars, which will later be recorded in a Bitcoin blockchain block. A .ots (OpenTimestamps proof) file is generated and saved. After a few days, this file can be verified to confirm that the evidence existed before the blockchain recording, providing internationally recognized temporal integrity proof.

📐 Capture Area

Allows selecting a specific screen area with the mouse and capturing it in high resolution. The capture generates a PDF document with the selected area and its metadata (URL, date, time, dimensions). Useful for highlighting specific elements without capturing unnecessary adjacent information. Includes integrity verification file (SHA-256 hash and digital signature).

🌐 Export MHTML

Exports the complete page in MHTML format (complete web file), preserving HTML, CSS, images, and embedded resources in a single file. All extension visual elements are removed before capture to ensure evidence purity. The generated MHTML file includes integrity verification via SHA-256 hash and digital signature. Note: This feature is only available in Chrome.

✓ Verify Hash

Compares file integrity by uploading the original file (PDF, WebM, MHTML, etc.) and its respective -hash.txt file. The tool calculates the SHA-256 hash of the uploaded file and compares it with the stored hash, confirming whether the file remains intact or was modified after capture. Displays additional information such as source URL and capture date, allowing complete evidence integrity verification.

📋 Capture History

Maintains a record of the last 50 captures made during the session, displaying capture type, filename, source URL, date/time, and SHA-256 hash. Allows quick viewing of all collected evidence, facilitating capture management and organization. The history can be cleared when needed, but information remains in the generated files.

🔍 Keyword Search

Allows searching for specific terms on the current page with support for regular expressions (regex). The tool highlights all found occurrences and allows navigation between results. Useful for quickly locating specific information on extensive pages, such as phone numbers, email addresses, URLs, or any text pattern. Supports JavaScript/ECMAScript regular expressions for advanced searches.

📜 Auto Scroll

Automatically scrolls the page to the bottom at configurable speed (slow, medium, or fast). A floating button allows stopping the scroll at any time. Useful for loading dynamic content (lazy loading), expanding infinite feeds, or preparing long pages for full capture. Scrolling stops automatically when reaching the end of the page.

🕐 EPOCH Time Converter

Converts UNIX timestamps (epoch time) to UTC date and time. Accepts values in seconds or milliseconds and automatically detects the format. Displays the result in two formats: UTC ISO 8601 and human-readable UTC. Useful for investigations involving log analysis, API metadata, or system records that use UNIX timestamp format.

🔐 Password Generator

Generates strong passwords with options for length (8 to 64 characters), inclusion of numbers and safe symbols. Passwords follow rules designed for use in systems and files: no spaces, avoid ambiguous characters (such as 0/O and 1/l), no accents, cedilla, or symbols that often cause problems in forms or on the command line. Useful for creating passwords for compressed files, accounts, and other uses that require a strong password compatible with different environments.

⚖️ Integrity and Methodology

✔️ Native Browser APIs
Captures and recordings use official browser APIs, ensuring that the evidence faithfully represents what was being displayed to the user at the time of collection.

✔️ Integrity (SHA-256)
Allows verification that the file content remains unchanged since it was generated.

✔️ Evidence Collector Signature (HMAC-SHA256)
Additional security layer that reinforces the impartiality of the collection process, allowing confirmation that the file was generated by the extension.

✔️ Traceability
Metadata records technical information such as URL, date, time, and browsing environment in which the evidence was collected..

©️ Copyright and Conscious Use

Evidence Collector is a tool for recording the user's own browsing. The extension does not bypass protection systems, does not remove DRM, and does not access unauthorized content.

Responsibility for respect for copyright, personality rights, and other applicable legal norms regarding the displayed and captured content lies exclusively with the user.

🔒 Security, Privacy and Permissions

Your privacy and security are top priority.

✅ Local evidence processing: Captures (PDF, WebM, MHTML, hashes and signatures) are generated locally in your browser, based on what is displayed on your screen. The extension does not send page content or evidence files to external servers. Some optional features, such as license validation and timestamp generation (FreeTSA / OpenTimestamps), may contact external services using only the minimum data required (for example, hashes or identifiers), and always as an explicit action initiated by the user.

✅ Required permissions: The requested permissions are strictly those needed for the tools to function:

storage: Store preferences and activation state
activeTab: Interact with the current active tab
tabs: Capture screen and manage tabs
downloads: Save generated files (PDF, WebM, hash)
contextMenus: Add options to the right-click menu
clipboardWrite: Copy links and extracted data
pageCapture: Export the full page as MHTML (when supported by the browser)
cookies: Access cookies only when strictly required for specific features (for example, timestamp or license validation)
scripting: Inject scripts into pages to enable capture features, always within the user's tab context.

👥 Target Audience

This tool was developed for professionals working with digital investigation, including:

✅ Digital forensics professionals
✅ Investigators and analysts
✅ Lawyers and technical assistants
✅ Auditors and compliance professionals
✅ Academic researchers
✅ Information security professionals
✅ Notaries that record notarial minutes

⚠️ Responsibility

Evidence Collector is provided as a technical support tool.

The use, storage, sharing, and presentation of the evidence generated are the exclusive responsibility of the user, who must ensure compliance with applicable legislation and the ethical principles of their profession.

For a screenshot to have technical weight in legal proceedings, it must be accompanied by guarantees that it was not manipulated after capture. Evidence Collector acts as a faithful recording instrument, using native browser APIs to ensure that the screenshot is an exact representation of what was displayed at the time, following digital forensics best practices.

Evidence Collector operates on the principle of self-fidelity, recording content exactly as it is processed and displayed by the browser at the time of interaction. It is essential to highlight the tool's limits:

❎ No Active Protection: The extension does not function as antivirus or security software.
❎ Malicious Content: It has no mechanisms to identify, block, or protect the system against viruses, malware, or malicious scripts.
❎ Data Injection: The tool records what is displayed, including content that may have been maliciously injected into the page. The extension does not validate the origin or security of the site's original source code. It is exclusively the user's responsibility to ensure the integrity and security of their browsing environment before starting the evidence collection procedure.
❎ Operator Responsibility: It is exclusively the user's responsibility to ensure that they are acting in compliance with applicable legislation, personality rights, and the ethical principles of their profession, including respect for copyright laws, the prohibition of unauthorized reproduction of protected works, and the non-capture or redistribution of content whose use is not authorized.

The legal validity of any evidence is determined by the court. Evidence Collector provides the professional with the technical integrity and preservation requirements that courts demand for evidence to be admitted and considered reliable, following international digital forensics guidelines.

🛠️ Functionality Warranty

Evidence Collector operates on top of web pages, native browser APIs and page code structures that are constantly changing. Layout updates, media player changes, security hardening, new browser versions or Manifest V3 changes may cause certain features to stop working partially or completely on specific sites or versions. No guarantee is given that the extension will work permanently, nor that it will remain compatible with all present and future browser or page versions. By using the extension, the user acknowledges these technical limitations and assumes 100% of the risk of non-functioning, including temporary or permanent unavailability of features in certain environments. Evidence Collector does not guarantee continuous updates or full coverage of ecosystem changes. Due to Manifest V3 restrictions and the browser environment itself, in some scenarios it may be necessary to reload the page (F5), disable and re-enable the extension, or restart the browser for certain features to work again.

🌐 Interface Language

Português (Brasil)
English (US)