1. A method comprising: receiving a request to present a previously captured object to a user, wherein the captured object was intercepted by a capture system configured to intercept packets from data streams, reconstruct the data streams, and store network transmitted objects from the data streams according to a capture rule that defines which objects are to be captured by the capture system; accessing a tag associated with the requested object, the tag containing metadata related to the object, the metadata including an object signature; verifying that the object has not been altered since capture using the object signature in the tag associated with the object, wherein the tag is verified using a hash, which is decrypted with a public key of the capture system; and presenting the object if the object and the tag are verified, and wherein the capture rule is part of a default rule set for the capture system configured to monitor network traffic and capture the object, and wherein the capture system is configured to store a document captured by the capture system according to the capture rule, which identifies a particular internet protocol (IP) address from which the document was sent, and wherein if the object is not verified, then an alert is generated to indicate that the object being presented to the user has been compromised.