The Moment Your Archive Is Tested
A regulator asks a broker-dealer to produce the fee disclosure page that was published on customer-facing property between two dates last quarter. A plaintiff serves a preservation notice on a retailer whose promotional page changed six times before the complaint was filed. A defendant offers a screenshot in court and opposing counsel calls a witness to explain who took it and when.
These moments have a common structure. Someone outside the organisation demands proof of what a webpage said at a specific point in time. The organisation’s response is only as good as the archive it built before the request arrived. What compliance teams often discover in that moment is a gap between what they believed they had preserved and what they can actually produce.
The gap has three sources. Static captures were substituted for a real archive. The storage did not stop anyone from altering the file after capture. And the automated systems that ran the website kept overwriting the material even after the duty to preserve had attached. Each source is fixable, but only in advance. By the time the request lands, the version of the page that mattered is often gone.
This article walks through what a defensible archive looks like from three vantage points – the regulator’s, the court’s, and the legal hold’s – and what happens when the archive does not meet the standard.
Why Static Snapshots Fail the Test
Website archiving used to be simple. A team could screenshot a page, save the file to a shared drive, and reasonably claim to have preserved what customers saw. That model has quietly collapsed. Modern webpages are assembled at request time from a content management system, third-party scripts, personalisation engines, and session state. A page rendered for one user is not the page rendered for another. A page rendered on a mobile device is not the page rendered on a desktop. A page rendered this morning is not the page rendered yesterday afternoon.
A static snapshot – a screenshot, a PDF, an HTML export – records one visible state at one moment. It captures none of the underlying behaviour. Interactive elements are frozen or absent. Expandable disclosures may or may not be triggered. Content loaded after the initial render is often missed altogether. Third-party scripts that materially shape the page are invisible in the output. The result is a picture of the page, not a preservation of it.
The picture also loses metadata. A screenshot is an image with no embedded proof of when it was taken, from which environment, by which system, or against which server. A PDF exported from a browser preserves fragments of that information at best. When those files sit on a shared drive alongside other screenshots, none of which carry authentication data of their own, the file’s existence is not evidence of what was on the website – it is evidence of what somebody saved to a folder.
A defensible archive avoids this from the beginning. Rather than rendering a page and photographing the result, it records the full HTTP transaction – every request, every response, every header, every byte of the response body, timestamped at the moment of capture. That record is stored in the WARC format, standardised as ISO 28500, and replayable by any conformant tool. When the archive is queried, the reviewer does not see a picture of the page. They see the page, interacting exactly as it did on the capture date, with the metadata that proves it.
What Regulators and Courts Actually Look For
Regulatory examinations and courtroom challenges have different procedural shapes but they test the same three properties in an archive.
Authenticated capture. The archive must carry proof of when it was made and by which system. A capture without a recorded timestamp is not evidence of the timing; it is a file whose timing is disputed. Modern archives record the capture time down to the second, generate a cryptographic hash of the captured content at that moment, and preserve both alongside the archive.
Under United States Federal Rules of Evidence 902(13) and 902(14), added in December 2017, electronic records generated by a reliable process and copies whose integrity can be shown through digital identification qualify as self-authenticating. A written certification by a qualified person, referencing the process and the hash values, replaces the foundation witness who used to be required. The Advisory Committee notes name hash value comparison as the mechanism: identical hash values for the original and the produced copy establish that they are exact duplicates. A SHA-256 hash recorded at capture and stored with the archive is what makes a Rule 902 certification writeable.
Screenshots on a shared drive carry none of this. Authenticating them means calling as a witness the person who took them, who must reconstruct the circumstances from memory. That is possible when the witness is available and the timing is not in serious dispute. It is not possible when the material is old, the person has moved on, or the opposing party is willing to press the question.
Immutable storage. The archive must be preserved in a way that prevents anyone – including the archiving organisation itself – from altering it after the fact. Broker-dealers subject to United States Securities and Exchange Commission Rule 17a-4(b)(4) must retain business communications, including website content within the scope of communications-with-the-public rules, for at least three years, the first two in an easily accessible place. The 2022 amendments to Rule 17a-4(f), effective in May 2023, allow two pathways: preservation on non-rewriteable, non-erasable media (write-once, read-many, or WORM), or an electronic recordkeeping system that maintains a complete, time-stamped audit trail of every modification and deletion.
Neither pathway is satisfied by files on a network share. Standard storage lets anyone with access modify or delete the file, and it produces no audit trail of who did what. WORM-configured storage produces a file that cannot be altered once written. A full audit-trail system produces a record of every attempted modification, whether it succeeded. Either satisfies the rule; neither can be added to an archive after the fact.
Complete record. The archive must cover the relevant window with the pages that matter, in the format they were served. A regulator asking about disclosures published during a specific quarter is not interested in the current version of the site. The examiner wants the version that was live on the dates in question. If the archive skipped the page in question because a human triage decision judged it low-risk, or because a manual workflow simply missed it, the answer to the request is that the material does not exist.
Scheduled crawls remove the triage decision. The archiving system maps the site, identifies new and changed pages, and captures them on a schedule that does not depend on someone remembering to do it. For firms operating dozens of web properties under retention rules, this consistency is what separates an archive that can be produced without qualification from one that cannot.
When the Preservation Notice Arrives
A preservation notice – also called a litigation hold or legal hold – imposes a duty to preserve information relevant to reasonably foreseeable litigation. When the notice covers material that lives on a website, the duty covers the historical state of the site, not just the version that happens to be live when the notice is received. If the site changes after the notice and no preservation was in place before it, information within the scope of the hold ceases to exist in a way that is often irreversible.
Under United States law, the loss of information subject to a duty to preserve is called spoliation. Federal Rule of Civil Procedure 37(e), amended in 2015, sets out the framework. If electronically stored information that should have been preserved is lost because a party failed to take reasonable steps to preserve it, and the information cannot be restored or replaced through additional discovery, the court may order measures no greater than necessary to cure the prejudice. If the court further finds that the party acted with intent to deprive another party of the information’s use in the litigation, the sanctions escalate: the court may presume the lost information was unfavourable, instruct the jury it may or must make that presumption, dismiss the action, or enter a default judgment.
The consequences are not hypothetical. In the Epic Games antitrust litigation against Google, the court sanctioned Google in 2023 for its handling of an internal chat system that auto-deleted messages after a short period. Rather than centrally suspending the auto-delete when the duty to preserve attached, the company left the decision to individual custodians. The court found the resulting preservation strikingly short of what was required, issued an adverse-inference instruction permitting the jury to assume the destroyed material would have been unfavourable, and ordered attorney fees. The case is remembered because the sanctions influenced the outcome of the underlying merits, but the pattern – automatic deletion that continues after a hold attaches – is not unique to that dispute or that platform.
Websites carry the same pattern. Content management systems overwrite pages when marketing publishes an update. Rolling deployments replace the deployed HTML with new versions many times a day. Third-party services return different responses over time. If none of this is captured before it changes, the historical state disappears in the ordinary course. Once a duty to preserve has attached, that ordinary course becomes actionable.
What the courts consistently expect is that the party take reasonable steps in advance to preserve foreseeably relevant material, and that the party act promptly once the duty is triggered to suspend systems that would otherwise destroy it. For websites, that has three implications:
Archiving should happen routinely, on a schedule, so that pages within a potential dispute window are already preserved by the time the notice arrives. Retrofitting an archive after the notice is often impossible and always more expensive than doing it in advance.
The archive itself should be built in a form that survives its own custodian. WORM-configured storage or a full audit-trail system prevents the archive from being modified during the litigation, and provides an answer to any question about whether the material was altered after capture.
Suspension of routine deletion should extend to systems that shape the archive. If archived pages are subject to a retention policy that would delete them within the relevant window, the policy has to be paused for material in scope.
What This Looks Like When It Is Working
An organisation with a defensible web archive does not scramble when a request arrives. The archive is already there. The pages within the request window have been captured on a schedule, stored in WARC format with cryptographic hashes computed at capture, preserved on media that cannot be altered, and accompanied by audit logs that document each capture. A production is a query against material that already exists in a form both sides can replay.
The organisation without that infrastructure has a harder day. Marketing is asked what versions of a page were live in the window. IT looks for backups. Compliance canvasses the team for screenshots. The result is a partial reconstruction whose authenticity is contested and whose gaps are the material the requesting party most wants to see.
The distance between those two outcomes is the archive that was built before anyone knew it would be needed. Defensibility, in the end, is not something a party can add to a set of files after the request has been made. It is a property of the process that produced them, and that process is either in place or it is not.
About Aleph Archives
Aleph Archives captures websites and their subdomains as WARC files aligned with ISO 28500, on immutable storage with SHA-256 hash verification computed at the moment of capture. Captures are scheduled to remove the triage decision, replayable as an interactive rendering of the site as it appeared on the capture date, and accompanied by audit trails suitable for SEC and FINRA examinations, FRE 902 self-authentication, and preservation-notice production. Legal, compliance, and IT teams use the platform so that when the regulator’s request, the preservation notice, or the courtroom challenge arrives, the archive is already there.
