The surge in cybercrime activities utilizing web servers for illegal purposes, such as distributing hoaxes, hosting illegal online gambling, and spreading malware, highlights the urgent need for a standardized digital forensic framework. Current methods, like simple IP blocking, fail to ensure the integrity and admissibility of digital evidence. This research proposes a seizure and acquisition framework designed to handle web servers both Virtual Private Server (VPS) and cloud-based, focusing on live acquisition to preserve volatile data and ensure minimal service disruption. The framework addresses key challenges by emphasizing legal authorization, server type identification, appropriate forensic tool selection, evidence integrity validation through hashing, meticulous Chain of Custody documentation, and secure storage of acquired data. The framework’s effectiveness was tested through simulations of seizing an VPS server used for spreading hoaxes and remote acquisition of a cloud server engaged in illegal activities. Results confirmed the framework’s ability to maintain evidence integrity and legal compliance, although limitations remain in multi-tenant cloud environments and the automation of Chain of Custody documentation. Validation by Subject Matter Experts (SME) shows that the framework is robust but requires further optimization for cloud-native contexts. This study represents a significant step toward standardizing procedures for web server seizures, ensuring that digital evidence remains valid, intact, and legally admissible in court.