Digital Evidence and Timelines in Domain Name Disputes
Preserve screenshots, sources, timestamps and originals in domain investigations while respecting evidential limits.
What’s in this article?
Direct answer
A screenshot records content observed at a particular moment. It does not, by itself, prove the complete domain history or infringement. A useful technical file connects source, time, collection method, original version and the reviewer's explanation. Legal sufficiency remains a separate assessment.
Preserve context
Record the complete URL, observation time, time zone and visible redirects. If mobile and desktop versions differ, preserve separate observations. A cropped image should be an explanatory copy, not a replacement for the original. Use incident identifiers and versioned filenames so another reviewer can find the same material.
Preserve originals and keep annotations separately. A hash can help detect file changes; it does not independently prove when or lawfully how the material was collected. Document who collected and accessed the record.
Avoid technical overstatement
DNS data, certificates, registration records and page content answer different questions. A shared IP address or CDN does not conclusively identify a common operator. A certificate does not establish the trademark owner's permission. Separate observations from inferences and record plausible alternatives.
Current registration data should not be presented as definitive historical ownership. An absent archive capture does not prove that a website never existed. Explain the source's coverage and any gaps.
Safe collection
Do not enter personal details, passwords or payment data into suspicious forms. Downloads or active testing, if required, belong in an authorised security environment. Restrict originals containing personal data and minimise unnecessary disclosure in working copies.
Fictional handover test
One colleague collects ten observations. A second locates each finding using only the annex index. Missing dates, addresses and explanations are corrected. Duplicate copies must not be counted as separate incidents. This tests handover quality, not court admissibility.
Delivery checklist
- Defined scope and incident summary.
- Chronology with sources and time zones.
- Originals and an annex index.
- Collection method and access limitations.
- Unresolved questions for authorised review.
Versioning and handover chain
When sharing a record with another team, identify its version. Explain if the reviewer uses a compressed or annotated copy rather than the original. Tie retention to the investigation purpose and organisational policy; keeping everything indefinitely is not a default solution.
A later capture does not invalidate the earlier observation. Preserve before-and-after records and state the limits of what the comparison establishes. If an access block or technical error prevents a recheck, do not report that the content was removed. Separate the action taken by a provider from the limits of your own subsequent observation.
Questions
Is a technical report formal judicial evidence preservation? No. Counsel should determine whether a formal procedure is needed.
Should every available page be collected? Collect relevant context without accumulating unrelated personal data.
Official sources
Related guides
- Preparing UDRP Evidence: Building a File Around the Three Elements
- RDAP and Redacted Registrant Data: What Can an Investigation Establish?
- Typosquatting and IDNs: Prioritising Lookalike Domains
- Phishing Domains: Separating Registrar, Hosting and CDN Reports
Brand protection and monitoring
General information only. Rights, authority and current procedure require case-specific assessment. Fictional examples are not B10 client cases or claimed successes.