Two years of a timeline. Twenty thousand pages mapped. One investigator.
Capture entire websites and Facebook timelines as court-ready evidence
Elite Assisted Capture scans the target, shows you everything it found, then on your confirmation preserves each page or post as court-ready evidence: hashed, timestamped, and filed into your case. You approve the list once and stop clicking.
Built by a former RCMP OSINT analyst and a founder court-qualified as an expert witness in the Supreme Court of British Columbia.
Runs in your browser, in your session. Nothing is captured until you confirm.
Discovery on every plan, including Free. Capture on Elite Assisted Capture.
Discovery on ELITE and above. Capture on Elite Assisted Capture.
Nothing is hidden from the count. Pages blocked by robots.txt, and posts whose date could not be read, are shown to you rather than dropped.
Why investigators trust Forensic OSINT
- 12,000+ Chrome extension users
- Trusted by LE and government agencies worldwide
- 38+ years of combined law-enforcement experience behind the product
- SHA-256 on every artifact, on every paid plan
Manual capture doesn’t scale. Evidence requirements don’t care.
A capture that stops at “12 more replies” is an incomplete exhibit.
Every post is switched to All comments and every comment and reply is expanded, including threads that load while the capture is still running. On a two-year timeline that is the difference between an exhibit and nothing.
Capturing one Facebook post properly means opening it, switching to All comments, expanding every collapsed reply, capturing, and closing it without missing anything. Now do that for two years of posts. Or for a website with thousands of pages. That work wasn’t being skipped because investigators are careless. It was being skipped because it wasn’t possible.
Hours of clicking, per subject
A single timeline can hold hundreds of posts. Each one needs the same careful sequence, every time.
One collapsed thread can hurt you
A missed reply chain is missing evidence, and our own in-product warning says so bluntly. That is exactly why every post is switched to All comments, why expansion keeps running through the capture, and why the run ends by telling you to verify.
Work that was being skipped
Elite Assisted Capture does the full sequence on every post and every page, with human-like pacing, exactly the same on post four hundred as on post one.
Discovery first. Capture only what you approve.
Discover
Point it at a Facebook timeline and pick a date range, or at a website and set the scope. Discovery reads. On a timeline it scrolls and hovers each post’s date link, which is what makes Facebook surface the permalink and the full timestamp, exactly as you would with a mouse. It opens no posts, clicks nothing, and preserves nothing yet. You watch live counts as the list builds.
Review and confirm
See every post or page it found, with dates, sources, and provenance. Uncheck anything out of scope. Nothing is preserved until you confirm, and every run files into a case you choose first.
Capture, without the clicking
Each item is opened, expanded, and preserved as a full-page capture with MHTML, metadata, and SHA-256 hashes. Pause, skip, or stop at any time. It keeps everything already saved.
Start a long run and walk away. Capture keeps the window visible while it works, because a screenshot taken behind another window is not the page as it appeared, and it pauses and resumes on its own if you lock the machine or step into another tab.
One workflow. Two engines.
Website Crawl & Capture
Discover a site’s pages, select which to capture, then preserve each as a full page.
- Reads the sitemap, follows links, and can render JavaScript, up to 8 pages in parallel
- Treats a site’s robots.txt as a lead rather than an instruction, surfacing pages it asks automated visitors to stay away from
- Review every URL in a tree with provenance badges: sitemap, crawled, robots.txt, added by you
- Discovers up to 20,000 pages in one pass, then captures in scoped batches: by path such as /blog, by include and exclude patterns, or by unchecking in the review tree
- Each captured page preserved as a full page, up to 500 screens deep
- Nothing on the page is clicked before capture, not even a cookie banner, because a click mutates the evidence. Dismissing them is opt-in, not the default
- Network idle awaited, every page hashed and filed
Discovery complete: 1,284 pages found
- /products/…SITEMAP
- /aboutSITEMAP
- /blog/2025/…CRAWLED
- /contactCRAWLED
- /team/staff…CRAWLED
- /admin/loginROBOTS.TXT
The pages a site asks crawlers to avoid
Most sites keep a robots.txt file: a short list of pages they are asking search engines and other automated visitors to stay away from. For an investigator that is not an instruction. It is a lead.
So those pages are put in front of you rather than quietly dropped. And because a site will often list a page there that it links to from nowhere else, that file can hand you pages no amount of crawling would ever have reached.
- Finding them sets nothing off. Discovery reads the list. It does not open the pages.
- They arrive in your review tree badged ROBOTS.TXT and left unchecked. Include them one by one, or all at once, or not at all. That is your call and only yours.
- If you do include them, they are captured last, on purpose. A page like this is sometimes a honeypot: a trap put there to spot automated visitors and block whoever opens it. Leaving them to the end means that if one does get you blocked, everything else is already captured, hashed, and filed.
- Low-profile mode leaves them out altogether. If you have asked the run to keep its head down, steering around known traps is part of that.
Facebook Timeline Capture
Give it a date range: 30 days, two years, or everything. Discovery maps every post in scope. Capture opens each one, switches to All comments, and expands every comment and reply, including ones that load while the capture is running.
- Date ranges from 1 day to All time, or custom start and end
- Post types read from each post’s own link: videos and reels identified, and anything the link does not prove is labelled unknown rather than guessed
- A posting-cadence grid, month by month and year by year, so busy stretches and silent gaps are visible before capture starts
- Every comment thread expanded, and expansion keeps running through the capture
- A stitched timeline overview shot spans the whole discovered range
- Posts from other profiles are detected and dropped from the list

Discovery reads the site while it maps it.
While it maps a site, Elite Assisted Capture is also reading it. The Intelligence tab collects what investigators actually pivot on, and every plan, including Free, can run discovery and export the results.
- Email addresses
- Social accounts
- Phone numbers
- Postal addresses
- Crypto addresses
- IBAN / bank accounts
- SWIFT / BIC
- Payment accounts
- Tracking IDs
- Organizations and people
- Company registrations
- VAT / tax IDs
- Regulator licenses
- Documents
- Tech stack
- Subdomains
- Shared infrastructure
- External sites
Subdomain discovery via certificate-transparency logs and the Wayback Machine
Shared-IP clustering with public-DNS-only resolution
One-click CSV and JSON export: a forensic artifact of what was discovered

Nothing is sent to a third-party service until you click a pivot. In a court-ready tool, that has to be your decision, not a default.
Run discovery free, today.
Install Forensic OSINT, point it at any website, and run a full discovery and Site Intelligence sweep on the Free plan. Export the results to CSV. You only need Elite Assisted Capture when you want those pages preserved as evidence.
Built for volume
Defaults on the Elite Assisted Capture plan.
Assisted capture you can defend on the stand
Every design decision assumes opposing counsel will ask about it.
Wrong tab? It waits.
Before every single shot it checks the target tab is active. If not, it pauses and resumes. It never saves a wrong-tab screenshot.
Wrong page? It refuses.
If the page navigates mid-capture, the capture is discarded, not saved incorrectly.
Hashed as it’s written
SHA-256 over every screenshot, image, and MHTML file, computed as it is written.
Time, on the record
UTC and local time, timezone, browser, OS, and app version, burned into the image and reprinted in the report.
One capture at a time
Within a browser profile, simultaneous captures are blocked by design. Each capture is pinned to its own capture ID, so two captures can never share one.
It counts your runs for you
A live panel tracks how many captures you have run today and escalates its warning as the count climbs. Volume is what draws scrutiny, and you should always be able to see yours.
It watches your account hygiene too
A burnt research account is a unit-level loss, not an inconvenience. Before a Facebook run the extension shows a live detection-risk panel: how many captures you have already run today, and whether the account has been warmed up in this browser session at all. If it has not, it says so plainly and gives you a one-click way to go and behave like a person first.
General best practices are kept alongside it, in the product, at the moment they matter.

What opposing counsel will ask
- Who decided what was collected?
- The investigator. Discovery produces the list, the investigator reviews and confirms it, and nothing is captured until they do. The discovery list exports to CSV as a record of what existed before capture ran.
- Was this collected by an automated tool?
- A tool performed the mechanical steps. The investigator set the scope, reviewed the discovered list, approved each item, and could pause or stop at any point. That distinction is why we call it assisted capture, not automated capture.
- How do you know it was not altered?
- SHA-256 on every screenshot, image, and MHTML file, computed as it is written.
- How do you know when it was collected?
- UTC and local time, timezone, browser, OS, and app version, burned into the image and reprinted in the report.
And what we put behind it
If a capture made during your subscription is challenged or excluded because of a defect in our chain of custody, hash verification, or report format, at any point, even years later, the Court Confidence Guarantee applies.
- A sworn expert declaration from one of our co-founders, a qualified expert witness in digital forensics with over 20 years of law-enforcement experience, at no cost to you.
- Our legal counsel engaged at our expense, up to $10,000 USD for agencies, to provide technical and evidentiary support to your team. They defend the integrity of the platform; you keep your own representation for the matter itself.
- Your subscription refunded.
- A 60-day pilot for teams of five or more, refunded in full including deployment fees if it does not fit your workflow. Single-tenant deployments are operational within 14 business days or we add free days to your term.
- These cannot be waived or weakened in procurement. They are standard on every annual subscription and appear in the quote and the master service agreement.
Never save a wrong-tab shot. Never silently abort.
And when a run finishes, it tells you to verify. That check is a reconciliation, not a file-by-file review: discovery exported the approved list before capture ran, so you are confirming the run produced an item for every line you approved. Anything it could not capture is reported on that same list rather than quietly dropped.
Watch it work
Pick a run. It opens right here, and you can switch or replay as often as you like.
Discovery on a website
Point it at a domain and the page list builds itself while you watch.
- Reads the sitemap and follows links, up to 8 pages at once
- Collects emails, social accounts, tracking IDs and subdomains in the same pass
- Discovery never captures anything. You confirm the list first
Website discovery runs on every plan, including Free.
Scan on any plan. Capture on Elite Assisted Capture.
Not the same as continuous capture.
Continuous Auto-Capture documents pages as you browse them. Elite Assisted Capture works the other way around: it finds everything first, shows you the list, and then works through it while you watch. One is a record of where you went. The other is a sweep of somewhere you have not been yet.
| Capability | Free & Essential | ELITE | Elite Assisted Capture |
|---|---|---|---|
| Facebook posts per assisted run | Not included | Discovery only | Unlimited within your date range |
| Comment and reply expansion through capture | Not included | Not included | Included |
| Website discovery and crawl | Included | Included | Included |
| Pages discovered per run | Up to 20,000 | Up to 20,000 | Up to 20,000 |
| Site Intelligence with CSV and JSON export | Included | Included | Included |
| Facebook timeline discovery by date range | Not included | Included | Included |
| Assisted capture of every approved page or post | Not included | Not included | Included |
| Full-page, MHTML, and SHA-256 evidence from each run | Not included | Not included | Included |
| Get started | Choose this plan |
Elite Assisted Capture
RECOMMENDED- Facebook posts per assisted run Unlimited within your date range
- Comment and reply expansion through capture Included
- Website discovery and crawl Included
- Pages discovered per run Up to 20,000
- Site Intelligence with CSV and JSON export Included
- Facebook timeline discovery by date range Included
- Assisted capture of every approved page or post Included
- Full-page, MHTML, and SHA-256 evidence from each run Included
ELITE
- Facebook posts per assisted run Discovery only
- Comment and reply expansion through capture Not included
- Website discovery and crawl Included
- Pages discovered per run Up to 20,000
- Site Intelligence with CSV and JSON export Included
- Facebook timeline discovery by date range Included
- Assisted capture of every approved page or post Not included
- Full-page, MHTML, and SHA-256 evidence from each run Not included
Free & Essential
- Facebook posts per assisted run Not included
- Comment and reply expansion through capture Not included
- Website discovery and crawl Included
- Pages discovered per run Up to 20,000
- Site Intelligence with CSV and JSON export Included
- Facebook timeline discovery by date range Not included
- Assisted capture of every approved page or post Not included
- Full-page, MHTML, and SHA-256 evidence from each run Not included
Elite Assisted Capture sits one tier above ELITE. Current pricing is on the plans page.
Already on ELITE? You already have Facebook timeline discovery. Elite Assisted Capture is the one step that turns what you find into evidence.
Inside the extension it reads: “Your plan can scan this site and export the results. Upgrade to Elite Assisted Capture to capture each page as court-ready evidence.” This page is that upgrade.
Facebook is the first social platform on this tier, not the only one planned. Instagram and TikTok are next, and platforms we add are included on this tier at no extra cost as they ship. That is deliberate: pricing starts low now because the tier is still growing.
Buying for a team? Volume pricing is available for 20+ licenses, and every team gets a 60-minute live training session plus further group sessions through the year at no charge.
If you run the section
Analyst hours back
A long timeline captured by hand is days of repetitive clicking from someone you hired for judgment. Assisted Capture cuts their part down to scoping the run and confirming the list.
The same result from every analyst
The two-hundredth post is captured exactly like the first, and your newest analyst captures it the same way as your most experienced one. Consistency stops being a training problem.
The cost of a gap
A missing reply thread found at trial can cost the exhibit, and the rework lands on your section. Complete capture the first time is cheaper than either.
Questions investigators actually ask
Yes, and it is worth being precise about what reading involves. On a website, discovery reads the sitemap and follows links. On a Facebook timeline it scrolls and hovers each post’s date link, because hovering is what makes Facebook reveal that post’s permalink and its full timestamp; it holds the hover briefly, reads them, and releases it. That is the same gesture you would make with a mouse. It opens no posts, clicks nothing, likes nothing, writes nothing, and captures nothing. You review the full list and nothing is preserved until you confirm it.
Point Elite Assisted Capture at the site or the timeline and set the scope. Discovery maps up to 20,000 pages in a single pass, quickly, because it only reads. Capture is the slow part, so you run it in scoped batches rather than one enormous job: limit a run to a path such as /blog, filter by include or exclude patterns, or simply uncheck what you do not need in the review tree. Each captured page is preserved up to 500 screens deep. Facebook runs are bounded by your date range, up to All time.
Yes, and it keeps expanding during the capture. Each post is switched to All comments and every comment and reply is expanded, including threads that load while the capture is running. When the run finishes, it prompts you to verify the captures before relying on them.
Every plan, including Free, can run website discovery and export the Intelligence results. ELITE adds Facebook timeline discovery. Capturing the discovered pages and posts as evidence requires the Elite Assisted Capture plan.
The two halves are nothing alike. Discovery is quick because it only reads: one real run mapped 6,700 pages in 3 minutes 9 seconds, about 2,123 pages a minute, and discovery is free on every plan. Capture is the slow half, because each page is opened, expanded, and preserved in full, so a large timeline with complete comment expansion can be a multi-hour job. Run discovery first and you will know the exact size of the work before you commit any time to it.
Less than people expect, because it is a reconciliation rather than a file-by-file review. Discovery exports the approved list to CSV before capture starts, so verifying is confirming the run produced an item for every line you approved, and reading the short list of anything it could not capture, which is reported rather than dropped. You then open the captures you actually intend to rely on and confirm the comments, replies, and media you need are there. That same exported list is what you hand over as the record of what existed before capture ran.
Every screenshot, image, and MHTML file gets its own SHA-256 hash. UTC and local time, timezone, browser, OS, and extension version are recorded and burned into the capture. Captures run one at a time, each pinned to a single capture ID.
Switching tabs pauses the run and it resumes when you return. Locking the workstation pauses every run and it resumes exactly where it left off when you unlock, and minimising the window does the same. Simply walking away without locking does not pause anything, which is deliberate: long runs are meant to be left alone. If the page navigates somewhere else mid-capture, that capture is discarded rather than saved wrong.
One run per Chrome profile, and profiles are independent. A second Chrome profile is a separate browser context with its own copy of the extension, its own storage, and its own capture budget, so two profiles run two sweeps side by side on one machine. Keep both windows visible rather than stacked: a window fully covered by another stops producing frames, and a capture needs a live frame. Inside any one profile it stays one capture at a time, each pinned to its own capture ID, and each profile keeps its own captures until they sync to your case.
It works at the pace of a person reading, because a person reading is exactly what it stands in for: one request at a time, one capture at a time, unhurried scrolling and dwell times, and no platform API or scraping backend. That restraint is the point. Hammering a site is what actually creates a terms-of-service problem, and it is not how a lawful review of one subject behaves. The extension also shows a live detection-risk panel: it counts your captures for the day, warns you as the count climbs, and tells you when an account has not been warmed up before a run. Use the same lawful, authorized account you would use to read the timeline by hand.
Discovery records every item it finds, and that list exports to CSV, so you have a persisted record of what existed before capture ran. Items it cannot parse or that you skip are reported, not silently dropped, and you can capture them by hand. When a run finishes, it prompts you to verify the captures before relying on them.
Yes. Pause and resume, skip individual pages or posts, or stop entirely. Everything already captured stays saved.
Sites change constantly, and a change can temporarily affect a specific capture feature until we ship a compatibility update. That is the nature of every capture tool, ours included. In practice a fix usually ships within a day or two, and when someone is against a deadline we have several times issued that client a pre-release build the same day so they could finish the work in front of them. Meanwhile discovery still records what it found, and you can capture affected items by hand.
We avoid that term on purpose. Electronic evidence is authenticated by a person who can testify to what was collected and why, so describing a collection as having run on its own invites the obvious question of who the witness was. Platform terms that restrict "automated means" are aimed at bulk scraping: harvesting data to resell, to feed marketing, or to stand up a competing service. That is not this. Elite Assisted Capture exists for lawful investigations, criminal and civil, where an investigator examines a defined subject within a defined scope and preserves what they are already entitled to see. Assisted Capture is the accurate description: discovery proposes a list, you review and approve it, and capture runs only on the items you kept. You make every collection decision and you remain the witness to it.
Closer to the opposite: the human is the loop. "Human in the loop" normally describes a person reviewing decisions an autonomous system already made. Nothing here makes those decisions. There is no AI and no model anywhere in the capture path. The investigator sets the scope, discovery reports what it found, the investigator approves the list, and only approved items are captured. If your policy requires human review of automated collection, this meets it at a stronger point in the process: the review happens before anything is collected, not after.
Continuous Auto-Capture documents pages as you browse them. Elite Assisted Capture maps the whole target first, shows you the list, and then works through every item you approved. One records where you went. The other sweeps where you have not been yet.
Yes, both. Elite Assisted Capture is available in on-premise and single-tenant cloud deployments as well as the managed cloud. Capture itself never runs on our servers in any deployment: it runs in the investigator’s browser, in their session. The deployment choice governs where your cases and evidence are stored, which is usually the part a procurement or policy review cares about.
Every team starts with a 60-minute live training session, and we arrange further group sessions free of charge through the year as your people change and the product grows. Training videos are available on demand for anyone joining later. There is no separate onboarding fee.
No. It runs in your browser, in your session, and captures only what you can already see. No credentials are collected and no part of the capture itself runs on our servers.
Capture happens on the investigator’s machine, never on our servers. What happens next is your deployment choice. Captures are held locally in the browser until they sync, and they sync to the environment you bought: our managed cloud in Azure USA, a single-tenant cloud dedicated to you, or your own on-premise install where nothing leaves your network at all. Reports are generated and stored in that same environment. If your matter has a residency, retention, or legal-hold requirement, tell us before you buy and we will confirm in writing which deployment meets it.
The next timeline does not have to cost you a week.
Elite Assisted Capture is available now.
Or start with a free discovery scan on any plan.
Built for lawful investigations.

