Web archives can recover useful evidence, but an archived replay is not automatically a complete or original copy. Start with the Wayback Machine for historical captures, then test the specific replay before drawing conclusions.
First decide which job you are doing
- Find an existing historical capture: You are looking for evidence that an archive collected before your investigation. Search the exact URL in the Wayback Machine, review the calendar, and compare more than one capture around the relevant period.
- Create a new preservation capture: You are documenting what a public page shows now. A new capture can support a current observation, but it cannot prove what the page showed before the capture was made. Wayback Machine Save Page Now generally saves one page, not an entire site or a promise of future crawls.
Find and check an archived page
- Record the exact live URL, visible claim, access time, and timezone before following redirects or changing the page state.
- Search the exact URL in Wayback Machine first. Check captures immediately before and after the claimed change, not only the nearest convenient date.
- Open each candidate capture and record its archived URL and capture timestamp. Keep that timestamp separate from any publication or updated date printed on the page.
- Test whether the replay contains the evidence you need. Check missing JavaScript, images, video, styles, comments, or files; inspect redirects, error captures, soft 404s, and the final URL.
- Inspect asset dates where they matter. An incomplete replay may pull a missing link from another archived date or even the live web, so one page view can contain mixed-date material.
- Use a cautious secondary public archive only as an additional coverage check. Record which service produced each capture and do not merge separate snapshots into one implied record.
- If the page is still live and collection is lawful and safe, create a new preservation capture. Use a controlled local/browser capture only when interaction or replay adds evidence that a simple snapshot would miss.
- Compare old and current evidence, state the narrow change you can show, and list what remains uncertain.
How to read archive evidence
- Capture time is not publication time. A Wayback timestamp records when its crawler captured a URL. A date printed inside the page is a separate claim that needs its own verification.
- A replay can be partial. Missing scripts, media, styles, or interactive elements can change what appears on screen. Preserve source HTML or files where available and describe gaps.
- Redirects and errors matter. A calendar entry can represent a redirect or server/client error rather than the expected article. Confirm the requested URL, final URL, status, and visible content.
- No capture is not proof of nonexistence. Crawlers may not have discovered a page, the page may have required a password or form, collection may have been blocked, or a site owner may have requested exclusion.
Tool-to-task map
- Wayback Machine: First choice for finding existing capture history and comparing archived dates. Use Save Page Now separately when you need a new capture of a currently public page.
- Secondary public archives: Use as corroborating coverage when Wayback is missing or incomplete. Availability, replay quality, policies, and permanence can differ, so keep each archive URL and limitation separate.
- Local/browser capture and replay: Use only when a fresh capture you control or an important interaction is needed. Browsertrix collections can group crawls and uploads for combined replay and WACZ export; its documentation also describes browser-based interactive capture for missing content. Keep collections private unless sharing is deliberate.
- urlscan.io: Use only when a public or safely shareable suspicious URL needs rendered-page and network context. It is not confidential archival storage. urlscan states that unlisted scans can be seen by vetted Pro users, while private scans have retention limits. Never submit sensitive URLs, tokens, personal data, or private investigation leads.
Evidence-recording checklist
- Exact requested URL and any final or redirected URL.
- Archive service, archived URL, capture timestamp, and timezone.
- Page-visible publication or update date, recorded separately.
- Replay status, redirect chain, error page, or soft-404 warning.
- Missing or differently dated scripts, images, video, styles, and downloads.
- Local screenshot, PDF, WARC, or WACZ filename and hash when retained.
- Access date, operator, query steps, and any login, location, or personalization limits.
- Narrow comparison result, corroborating source, unresolved gaps, and confidence wording.
Fictional worked example
Hypothetical only: The dates and wording below are invented to illustrate the method, not observations from a real capture. An analyst is checking the reserved example address https://www.example.com/notice. A Wayback replay URL contains the capture code 20260401143000, meaning the URL was captured on April 1, 2026 at 14:30:00 UTC. The page itself displays “Published March 28, 2026”; the analyst records that as a page-visible publication claim, not as the capture time. A September 13, 2026 live observation contains different wording. One old image is missing, so the analyst reports only that the preserved text differs between the April capture and September observation and does not claim the missing image changed. A second source is still needed before explaining why the wording changed.
Before you publish
Show the old evidence, current evidence, exact timestamps, archive source, and known replay limits. Do not infer authorship, intent, truth, or deletion timing from one capture. If a sensitive claim depends on a partial replay, seek another capture, original document, contemporaneous report, or direct source.
Related reading
- Wayback Machine profile
- Wayback Machine vs Archive.today vs Perma.cc
- Evidence preservation and historical web stack