Skip to content

Evidence methods guide

WARC Capture and Response Metadata Review: Keep Record, Payload, and Capture Evidence Together

Review WARC record headers, response payload boundaries, capture associations, UTC dates, digests, segmentation, and truncation before treating an archive export as complete.

A WARC response record contains more than the bytes a reader sees. Its record header, content length, HTTP message boundary, target URI, capture date, record ID, concurrent records, payload digest, and truncation fields answer different questions. Start by separating record block from payload, then link request, response, metadata, revisit, and continuation records without assuming that one record is one capture. This guide is archive-format guidance, not a crawler, replay service, authenticity assessment, privacy decision, or permission claim.

Updated

On this page

Validate each WARC record boundary first

Record a neutral file ID, digest, byte offset, WARC version, WARC-Type, Content-Length, record ID, WARC-Date, and the end offset calculated from the block length. The International Internet Preservation Consortium, (opens in a new tab) specification says every record has a header and content block, and every record carries Content-Length. Do not scan for the next WARC line and call that a boundary when the declared block length disagrees.

The source dates in this guide use 22 October 2026 as retrieval evidence for documentation without a verified publication date. They are not publication claims. Where a verified publication date is available, it is recorded in the source ledger.

Validate each WARC record boundary first (table)
Boundary fieldRecordStop if
Record headerVersion and named fieldsHeader terminator is missing
WARC-TypeDefined type or extension typeReader maps an unknown type to response
Content-LengthDeclared octets and observed spanBlock extends beyond file
Record IDURI and uniqueness within the reviewA record cannot be linked
WARC-DateUTC value and precisionLocal display replaces source value
End markerRequired line endings and next offsetReader skips unexplained bytes

Keep compressed file framing and decompressed record framing separate. A digest or byte offset should say which layer it covers. If a parser repairs a header, retain the raw evidence and identify the repair rather than replacing the record.

Separate response block, HTTP message, and payload

In a response record, the content block can contain HTTP headers followed by a data object. The WARC specification distinguishes the block from the payload, and its Content-Type describes the archived HTTP message rather than simply copying the HTTP Content-Type header. Record the WARC block span, HTTP header terminator, HTTP message type, payload start, payload length if present, and any mismatch with an inner Content-Length.

Separate response block, HTTP message, and payload (table)
LayerRecordCannot infer
WARC blockOuter Content-Length and byte spanThat all bytes are payload
HTTP headersStatus, headers, and line endingThat headers are trustworthy application data
HTTP bodyPayload start and observed lengthThat body length matches outer block
Identified typeWARC-Identified-Payload-TypeThat MIME type proves content
CompressionOuter file and inner transfer stateThat one codec applies at all layers
TruncationWARC-Truncated and source noteThat a replay is complete

Synthetic response ledger

Separate response block, HTTP message, and payload code example, JSON
{"record_id":"urn:fixture:response-01","type":"response","target_uri":"https://example.invalid/fixture","warc_date":"fixture-UTC","block_length":"fixture-octets","http_status":"fixture-status","payload_offset":"fixture-offset","payload_digest":"fixture-digest","truncated":"not-recorded"}

Link a capture event without collapsing record types

The International Internet Preservation Consortium, (opens in a new tab) specification uses WARC-Concurrent-To to associate records from one capture event, while WARC-Refers-To links a metadata, revisit, or conversion record to the record it describes or transforms. Build an evidence graph with direction and relationship type. A request, response, revisit, metadata, and conversion record are not interchangeable snapshots.

Link a capture event without collapsing record types (table)
RelationRecordOpen question
Concurrent-ToPeer record IDs from one captureIs the association present on both sides?
Refers-ToRecord ID being described or transformedIs the referenced record available?
Target URIOriginal URI and normalized comparison keyWas a query or fragment changed?
RevisitTarget and prior record referencesWhich payload is actually stored?
ContinuationOrigin ID, segment number, total lengthWere all segments reassembled?
ConversionSource record and derived payloadWhat transformation occurred?

Keep dates, digests, and replay claims bounded

WARC-Date records when capture began and is expressed as a UTC timestamp. WARC-Block-Digest can cover the full record block, while WARC-Payload-Digest covers the payload. Record algorithm labels, digest scope, source record, and comparison result. A matching payload digest supports byte identity for that scope; it does not prove that the captured response was truthful, complete, or authorized.

Keep dates, digests, and replay claims bounded (table)
EvidenceSupportsDoes not prove
WARC-DateCapture timing as recordedWhen the source content was originally created
Block digestA digest for the full blockThe payload alone is unchanged
Payload digestA digest for the payload scopeHeaders and metadata match
Truncation fieldA recorded truncation stateUnrecorded truncation did not happen
Replay outputA rendering produced by a toolOriginal response semantics
Capture graphRecords can be associatedEvery related record was captured

Stop when archive evidence is incomplete

Stop conditions

  • Stop if record version, type, ID, date, Content-Length, or end offset is missing or contradictory.
  • Stop if the response block, HTTP headers, and payload boundary cannot be separated.
  • Stop if capture associations rely on target URI text without record IDs or relation types.
  • Stop if continuation segments, truncation, revisit references, or conversion sources are incomplete.
  • Stop if digest scope or algorithm is unknown, or a replay is treated as original payload evidence.
  • Stop before opening real payloads when target URIs, headers, or bodies expose private records.

Pair this worksheet with the data provenance log for capture and transformation history and the data card template for collection context. A valid WARC boundary does not prove content completeness, ownership, privacy clearance, or permission.

For a supported non-health collection, after the owner has authority to describe the scope and a controlled metadata packet, the qualified appraisal request path may be a preparation step. It does not crawl, replay, authenticate, assess web content, create a quote, match a buyer, or grant a license.

Sources

  1. International Internet Preservation Consortium: The WARC Format 1.1 (opens in a new tab)
  2. International Internet Preservation Consortium: The WARC Format 1.1, Annotated (opens in a new tab)

Use the appraisal path after the WARC evidence packet is organized.

It does not crawl, replay, authenticate, assess web content, create a quote, match a buyer, or grant a license.