Evidence capture — ttfestival.nl (full site)

Forensic, timestamped capture of the official TT Festival website (ttfestival.nl), collected for the TT Festival privacy investigation. This is the public-facing event site that the app-promotion chain (gemeente Assen → app.ttfestival.nl → Appmiral) sits on top of.

This snapshot has two parts:

A complete site mirror — every page in the site’s own sitemap_index.xml (174/174 pages) plus all page assets, captured with GNU Wget. Because the mirror is large (~1.16 GB, mostly WordPress image size-variants), the bytes live in the companion private repo GraafG/tt-festival-app-evidence. This folder records the SHA-256 of every mirrored file in mirror-manifest.sha256 and the page-by-page coverage proof in meta/coverage-report.txt.
Light forensic artifacts for the key pages (kept here, public) — exact raw server responses, JavaScript-rendered DOM, full-page screenshots and response headers for the five pages most relevant to the investigation.

Snapshot summary

Field	Value
Captured (local)	2026-06-26 23:42 CEST (UTC+02:00)
Mirror started (UTC)	2026-06-26 22:24:23Z (see `logs/capture-start.txt`)
Capture host	Microsoft Windows 11 Pro
Sitemap pages	174 (`sitemap_index.xml` → 6 sub-sitemaps)
Mirror coverage	174 / 174 (8 emoji-slug pages curl-recovered — see below)
Mirror size	~1.16 GB / ~6,100 files (in the private companion repo)
Key pages with raw+DOM+screenshots	5
Server	Apache + WordPress (`/wp-json/` REST API advertised)
User-Agent used	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) ... Chrome/126.0.0.0 Safari/537.36`

Key pages captured (raw + rendered DOM + screenshots, here in the public repo)

#	URL	What it is	HTTP	Notes
1	https://ttfestival.nl/	Home	200	WordPress; advertises `wp-json` REST API.
2	https://ttfestival.nl/programma/ → `/artiesten/`	Programme / line-up	301 → 200	`/programma/` 301-redirects to `/artiesten/` (`X-Redirect-By: redirection`). DOM/screenshot are of the resolved `/artiesten/` page.
3	https://ttfestival.nl/info/huisregels/	House rules	200	Consent-by-entry to image/audio recording (see below).
4	App announcement post	200	“Download nu de TT Festival App 👇 app.ttfestival.nl” — the entry point of the app redirect chain.
5	https://ttfestival.nl/info/faq/	FAQ	200	Practical info / frequently asked questions.

Why this is evidence

House rules: entering the festival = automatic consent to image/audio recording, used for “openbare orde” and promotion. info/huisregels/ states verbatim:

“Tijdens het TT Festival kunnen beeld- en geluidsopnamen worden gemaakt waarop jij zichtbaar bent.” “…opnamen kunnen worden gebruikt in het kader van handhaving van de openbare orde en veiligheid, maar ook voor promotionele doeleinden.” “Door het terrein te betreden geef je toestemming voor het gebruik van dergelijk beeld- en geluidsmateriaal.”

Consent is presented as automatic on entry, and the same footage is used both for public-order enforcement and for marketing — relevant to how the event and its app treat attendees’ personal data.
The site is the on-ramp to the app tracking chain. The app-announcement page sends the public to app.ttfestival.nl (“Download nu de TT Festival App”). That host is the exact start of the redirect chain captured in ../appmiral.com_2026-06-26_232241/ (app.ttfestival.nl → ttfestival2026.deeplink.appmiral.com → Appmiral/AWS), tying the public event site to the third-party data processing documented elsewhere in this repo.
Full-site fixed point. Capturing the whole site (174/174 sitemap pages) preserves the surrounding context — programme, practical info, news posts — as it stood on the capture date, so individual quotes can’t later be dismissed as cherry-picked or be quietly edited away.

Full-mirror coverage & the 8 recovered pages

The site’s sitemap_index.xml lists 174 pages; all 174 are present in the mirror. Eight of them have slugs containing emoji or other multi-byte characters (e.g. “Nieuwe TT Festival app 📱”). GNU Wget on Windows cannot write those filenames, so it skipped them; each is live (HTTP 200) and was recovered directly with curl into mirror/ttfestival.nl/_recovered/ under a short, stable filename, with a filename → original-URL map in mirror/ttfestival.nl/_recovered/RECOVERED-PAGES.txt (private repo). The full audit — including which pages wget saved as slug.html vs slug/index.html — is in meta/coverage-report.txt.

Folder layout

ttfestival.nl_2026-06-26_234242/
├── README.md                 ← this capture log
├── SHA256SUMS.txt            ← SHA-256 of every file in THIS (public) folder
├── mirror-manifest.sha256    ← SHA-256 of every file in the full site mirror,
│                               which lives in the private companion repo
├── .capture-timestamp
├── raw/                      ← EXACT unmodified server responses (curl GET)
│   ├── home.html / .headers.txt
│   ├── programma.html / .headers.txt        (the 301 + resolved 200 headers)
│   ├── info-huisregels.html / .headers.txt
│   ├── app-announcement.html / .headers.txt
│   └── info-faq.html / .headers.txt
├── rendered-dom/             ← DOM after JS hydration (Chrome)
│   ├── home.html
│   ├── programma-artiesten.html
│   ├── info-huisregels.html
│   ├── app-announcement.html
│   └── info-faq.html
├── screenshots/              ← full-page + viewport PNGs (1440-wide desktop)
│   ├── 01_home_ttfestival.nl_*            04_app-announcement_*
│   ├── 02_programma-artiesten_*           05_info-faq_*
│   └── 03_info-huisregels_*
├── meta/                     ← the sitemaps + the verifiable coverage proof
│   ├── sitemap_index.xml + 6 sub-sitemaps
│   ├── sitemap-urls.txt      ← the 174 page URLs (seed list for the mirror)
│   └── coverage-report.txt   ← 174/174 coverage audit + the 8 recovered pages
├── logs/
│   ├── capture-start.txt
│   └── tool-versions.txt
└── mirror/  → MOVED to private repo GraafG/tt-festival-app-evidence
               (full wget --mirror clone of all 174 pages + assets, ~1.16 GB;
                wget-command.txt + wget-mirror.log live there too. Integrity of
                every mirrored file is recorded above in mirror-manifest.sha256.)

Verify integrity

sha256sum -c SHA256SUMS.txt          # this public folder, run inside it

Get-Content SHA256SUMS.txt | ForEach-Object { $h,$p = $_ -split '  ',2
  if ((Get-FileHash -Algorithm SHA256 -LiteralPath $p).Hash.ToLower() -ne $h) { "MISMATCH: $p" } }

To verify the full mirror, clone the private companion repo and run sha256sum -c SHA256SUMS.txt inside its ttfestival.nl_2026-06-26_234242/ folder; that list is byte-identical to this folder’s mirror-manifest.sha256.

Reproduce

Visual: open any PNG in screenshots/.
Exact bytes: files in raw/ are the verbatim server responses (the programma headers show the live 301 → /artiesten/ redirect).
Rendered state: files in rendered-dom/ are the DOM after JavaScript ran.
Whole site: clone GraafG/tt-festival-app-evidence and open ttfestival.nl_2026-06-26_234242/mirror/ttfestival.nl/index.html.
Re-mirror: the exact wget command is in the private repo’s ttfestival.nl_2026-06-26_234242/wget-command.txt; it is seeded from meta/sitemap-urls.txt (preserved here).

These captures mirror public pages for fixed-point, reproducible reference. URLs are preserved unmodified.