GDE-073 |
Online video preservation | |||||||
SOCMINT | ||||||||
October 2026 | ||||||||
01
What it is
A video downloader for OSINT is a tool that saves a full-quality copy of an online video, with its platform metadata, so an investigator can verify, analyse and cite it after the post is edited or removed.
In an investigation the download is the first act of preservation, not a convenience. Posts are deleted, accounts are suspended and platforms re-encode or trim footage, so the copy you hold may become the only record. The standard tool is yt-dlp, a free command-line downloader that supports thousands of sites and can write the platform's own metadata, such as uploader, upload date and description, to a file beside the video.
Journalists, fact-checkers, human rights researchers and OSINT practitioners use the method to lock footage before analysis and to show later exactly what was captured, from where and when.
| When to use this guide
|
02
How do you use a video downloader to preserve evidence?
Record the post, download the best original with its metadata, hash it, then inspect and store the copy so every later check starts from the same file.
Four tools cover the workflow. Three are free and need no account; Hunchly is paid, with a free trial.
yt-dlp: Free, open source, no login. A command-line video downloader for thousands of sites that can save the platform's metadata as a JSON file beside the video.
FFmpeg: Free, open source, no login. yt-dlp needs it to merge separate video and audio streams, and its companion ffprobe reports the container, codecs, duration and any creation tags.
Wayback Machine: Free. The Internet Archive's Save Page Now feature captures a page on request and returns a permanent URL, giving an independent record of the post around the video.
Hunchly: Paid, with a free 30-day trial. A capture tool from Maltego Technologies that automatically records the URL, timestamp and hash of every page you visit during an investigation.
| Before you begin Stop at the login. yt-dlp and FFmpeg run on your own machine and need no account. Some platforms block anonymous downloads; if yt-dlp reports that a login is required, stop, and continue only with a dedicated research account under your organisation's policy, never your personal one. Legal considerations. Downloading can breach a platform's terms of service, and the footage remains under copyright. Preserving a copy for verification is different from republishing it, so take legal advice before publishing, and handle any personal data in line with GDPR or your local equivalent. |
Note the post URL, account name and the time you viewed it in UTC, and take a full-page screenshot. Submit the URL to the Wayback Machine Save Page Now form so a third party also holds the page. Treat the snapshot as a record of the post; it may not include a playable video.
Sites change often and outdated versions fail. Update yt-dlp with yt-dlp -U, or through the package manager you installed it with, and confirm FFmpeg is installed so separate video and audio streams can be merged.
Run yt-dlp -F URL to see every format available. By default yt-dlp selects the best video and best audio and merges them, which is the right master for most cases. Note the format IDs in your log.
Run yt-dlp --write-info-json --write-description --write-thumbnail -o "%(id)s.%(ext)s" URL. The .info.json file holds the platform's fields, including uploader, upload_date in UTC and timestamp, and naming files by video ID keeps them stable.
Before opening anything, run sha256sum on Linux, shasum -a 256 on macOS or Get-FileHash in Windows PowerShell, which uses SHA-256 by default. Record each hash with the capture time and work only on copies.
Run ffprobe -show_format -show_streams master.mp4 to record container, codecs, resolution, duration and any creation tags. Platforms usually re-encode uploads and strip camera metadata, so treat these tags as a record of the platform's processing, not of the original recording.
Keep the master, its .info.json and the hashes in read-only storage, and log the full command, the output of yt-dlp --version and the capture time. On longer investigations, Hunchly records every page you visit with its URL, timestamp and hash alongside the file.
|
03
Where a video downloader can mislead you
A clean download proves what a platform served at one moment, not who filmed the footage, when or where.
Upload date read as recording date: The upload_date and timestamp fields describe when the platform published the video, not when it was filmed. Old footage is often reposted as new. Verifying check: trace earlier copies with keyframe searches and establish the recording date from the content itself, such as weather, shadows or known events.
Video downloader metadata read as the original source: The account you downloaded from may be a reposter, so its metadata describes the copy, not the source. Verifying check: find the earliest available upload and compare duration, framing and watermarks before naming a source.
Platform-processed file read as the camera file: Re-encoding changes resolution, bitrate and creation tags, and a repost can drop the audio or trim the opening seconds. Verifying check: compare the duration of your copy with copies from other platforms and record any differences.
A finished download read as a complete one: Without FFmpeg, yt-dlp cannot merge separate streams and may fall back to a lower-quality single file. Verifying check: play the master end to end and confirm with ffprobe that it holds both a video and an audio stream at the expected duration.
Chain of custody: A downloaded video is only as defensible as the record of how it was captured. Posts vanish and platforms change their encoding, so keep enough for a colleague, editor or court to confirm that the file you analysed is the file the platform served, and that it has not changed since.
Hash the master video and its .info.json with SHA-256 immediately after download.
Archive the post page and keep a full-page screenshot with the capture time in UTC.
Record the exact yt-dlp command, its version and the format ID downloaded.
Store the master read-only and analyse working copies only.
Keep the ffprobe output with the hash it relates to.
Secure the metadata files, as they can contain personal information.
04
Go deeper
Take preservation further with the evidence preservation card and the archive and verification tutorials.
CARD · SOC-002 · SIGNAL TIER
Social media evidence preservation for investigators
Hunchly and Wayback Machine capture with SHA-256 hashing, locking the record before takedown.
METHODS · SIGNAL TIER
Archive recovery: deleted and ephemeral content
Wayback Machine, Archive.ph and other archives, used to recover deleted pages defensibly.
METHODS · SIGNAL TIER
Capstone: verifying crisis footage end-to-end
Geolocation, chronolocation, source tracing and satellite corroboration in one workflow.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.