Handing Pixel Evidence to Counsel, a Report, a HAR File and the Checksum That Ties Them Together

Say a company’s general counsel gets a letter claiming its website shared visitors’ data with an ad network without consent. The first question is simple and nobody inside can answer it from memory: what does the site actually send, today, and when? Screenshots of a browser’s network panel are hard to read, easy to dispute and impossible to repeat.

PXTA’s output is built for this hand-off. One audit produces three files that belong together.

The Report

report.html is one file with nothing loaded from anywhere else: no scripts, no fonts, no images from other servers. It opens the same in any browser years later and can be attached to an email or filed as it is. Each finding is a sentence a non-engineer can read, with the evidence under it: the request’s full address, every decoded field, the flagged one highlighted, the time to the millisecond, the consent state, and the command that reproduces it.

The Method section says how the audit was done, so the other side can repeat it. It lists the browser and version, the user agent PXTA presented, the timings, whether robots.txt was followed, the email addresses whose hashes were looked for, and what a browser-based audit can’t see.

The Raw Capture

requests.har holds every request every page sent, in all three passes, in the HAR format that browsers, proxies and forensic tools already read. Each entry is labelled with its pass, whether it came from the page, an iframe or a worker, and whether it was sent while the page loaded, while PXTA scrolled and typed, or as the page was left.

The Checksum

The report prints the SHA-256 of requests.har. If anyone later questions whether the capture was edited, hashing the file again settles it. findings.json carries the same checksum, along with every finding in a form a script can check against the HAR.

What It Doesn’t Claim

PXTA reports traffic. It draws no legal conclusion, and the report says so. Whether a request breaks a wiretap law, a privacy statute or a consent rule depends on the law, the site and the visitor, and that’s counsel’s call. What PXTA gives counsel is the record: what was sent, to whom, from which page, and whether the visitor had said yes, said no, or hadn’t been asked.

Run it more than once. An audit dated before a fix and another after it is a better record than either alone.