Forensic evidence system

We preserve our own evidence

Governments scrub pages. Publishers paywall articles. The Wayback Machine is a shared resource that can be pressured. This archive maintains its own forensic copies of every source it cites, with cryptographic proof of when each capture was made.

0 Sources preserved

0 RFC 3161 timestamps

307 Watchlist pages monitored

0 Scrub alerts

How It Works

Every source cited in this archive is captured in up to three forensic formats the moment it is first referenced. These captures are stored independently of the original publisher.

WARC

Full web archive captures preserving HTTP headers, response bodies, and request metadata exactly as the server returned them. The same format used by the Library of Congress and Internet Archive.

wget --warc

PDF

Rendered page snapshots that capture visual layout, images, and text as a human would see them. Useful for court submissions where visual fidelity matters.

Chromium headless

HTML

Cleaned article text extracted from the original page, stripped of ads and navigation. Lightweight, searchable, and diff-friendly for detecting content changes.

monolith

Chain of Custody

Every capture is cryptographically anchored to prove it existed at a specific point in time and has not been altered since.

SHA-256 hashes: Each artifact (WARC, PDF, HTML) is hashed immediately after capture. The hash is recorded in the evidence index before any further processing. Any bit-level change to the file would produce a completely different hash.
RFC 3161 timestamps: Hashes are submitted to an independent timestamping authority (TSA) that returns a signed token proving the hash existed before a specific time. This is the same standard used in EU electronic signatures and legal proceedings.
GPG-signed commits: The evidence manifest is stored in a Git repository where every commit is GPG-signed. This creates an immutable, cryptographically verifiable history of all captures.

The full manifest is public: Public manifest repository

What We Monitor

The evidence system runs 24/7 with five automated processes capturing evidence across multiple dimensions.

Source Preservation

Every 6 hours

Every URL cited in any incident record is captured in WARC, PDF, and HTML formats with cryptographic timestamps. New sources are captured automatically when incidents are published.

Government Page Watchlist

Every 6 hours + 24-hour change detection

307 government pages monitored for scrubbing: ICE, DHS, DOJ, DOD, CENTCOM, EPA, FEMA, USAID, CDC, FDA, OSHA, State Department, courts, and more. Changes are detected and documented with before/after diffs.

Social Media Monitor

Every 15 minutes

Trump's Truth Social and X/Twitter accounts, plus administration officials (Hegseth, Rubio, Miller, Homan, Bondi) and government agency accounts (ICE, DHS, DOD). Posts are captured individually with PDF screenshots. Deleted posts are detected and flagged.

Video Archiving

Daily at 2:00 AM

Press conferences, strike briefings, congressional hearings, and other video evidence cited in incidents. Archived with full metadata, thumbnails, and subtitles. Videos disappear from YouTube — our copies don't.

Court Filing Capture

Daily at 4:00 AM

Court documents from CourtListener, PACER, Supreme Court, and federal circuit courts. Legal filings can be sealed or removed — our copies are timestamped and permanent.

Dead Link Detection

Weekly

All 1,100+ source URLs are checked for liveness. Dead links are flagged on incident pages so researchers know when a source has been taken down, with preserved copies available.

Scrub Log

When a monitored page disappears or changes substantially, the system logs it here.

Subscribe to the scrub alert RSS feed for real-time notifications when government pages are altered or removed.

No scrubbing detected yet. The system monitors 307+ government pages, social media accounts, and data sources.

Evidence Browser

All 0 captured sources, grouped by domain.

No evidence captures yet.

Verify It Yourself

Don't trust us. Verify independently. Every claim this system makes is checkable with standard open-source tools.

Clone the manifest repository

git clone https://git.argand.org/nicweyand/warcrimes-evidence-manifest.git

Verify file hashes
Confirms no artifact has been modified since capture.
```
sha256sum -c hashes.sha256
```
Verify RFC 3161 timestamps
Confirms the TSA signed the hash before the claimed time.
```
openssl ts -verify -data digest.bin -in timestamp.tsr -CAfile cacert.pem
```
Check Git commit signatures
Confirms every commit was signed by the project maintainer.
```
git log --show-signature
```

Storage and Redundancy

Evidence is stored across multiple independent locations. No single server, provider, or jurisdiction holds all copies.

Primary vault (SX65 datalake): 80TB ZFS RAIDZ2 storage. Full evidence archive: WARCs, PDFs, HTMLs, video, court filings, social media posts, timestamps, and hash manifests.
Public-facing server (VPS): PDF and HTML snapshots served directly alongside the archive at trumpswarcrimes.com. Accessible to anyone visiting an incident page.
Off-site backup: Full vault replicated to geographically separate local storage via encrypted rsync.
Trusted partners (planned): We are seeking trusted organizations willing to host mirror copies of the evidence vault. If you represent a legal organization, news archive, or human rights group and want to help preserve this evidence, contact us.