Question 1

Are screenshots of posts admissible?

Accepted Answer

Admissible, yes: weighty, no: a screenshot is a document, but its fabrication-triviality means challenges succeed against it alone where they would fail against a documented capture corroborated by an archive or device artefacts. The practice rule: accept screenshots as leads, upgrade the same week, and never rest a pleaded quotation on rung 1 where rungs 2-3 were available: tribunals increasingly ask why they were not taken.

Question 2

A post has already been deleted. What are the realistic routes?

Accepted Answer

In practical order: the poster's devices (creation media, app caches, drafts: Example 1's rescue); any self- d own load archive generated before deletion, or ordered now if deleted content persists in the account's export; the echo layer (reposts, quote-posts, web archives, search caches); counterpart captures and recipients; and provider windows via preservation request and process, moving fast because they close. Plus the deletion itself: dated against notice, it may be worth more than the post.

Question 3

Can we make an opponent hand over their private account content?

Accepted Answer

Where relevant and proportionate, yes: private posts and messages are documents within their control: the self- d own load order is the clean mechanism (complete, structured, platform-generated), with specific disclosure of identified threads the narrower alternative. Privacy objections are weighed, not dispositive: UK GDPR and proportionality shape scope and handling (redaction, confidential it y clubs), not existence of the obligation.

Question 4

How do we deal with an anonymous account attacking our client?

Accepted Answer

Sequence per §6: capture everything now (rung 2, scheduled recaptures); provider preservation request immediately; then the disclosure route against the platform for account and access data (the Norwich Pharmacal line), with service and jurisdiction navigated for non-UK entities; and in parallel, the contextual investigation: who knew what the account knew, posting-time patterns, linguistic and device overlaps: which has unmasked accounts that IP logs alone could not. Expectations honest: determined anonymity some time s holds; the capture record ensures the content is usable against whoever is eventually fixed with it.

Question 5

Our client wants to "clean up" their own profile before proceedings. Advice?

Accepted Answer

In terms: once litigation is contemplated, deleting or editing relevant content is spoliation with a timestamp: the other side captures too, and Examples 2-3 show how loudly changes date themselves. The lawful path: freeze the accounts, archive them, and address bad content by evidence and submission: context, apology where wise, honest explanation: rather than deletion that converts an embarrassing post into a conduct finding. This advice, given in writing at matter-open, has saved more positions than any capture tool.

Question 6

Do expiring formats (stories, view-once) beat preservation?

Accepted Answer

They compress it: the display window binds the public-view capture, so the race is real (same-day, some time s same-hour): but the format's promise is thinner than it looks: creation media persists poster-side, archives log the posting, viewers capture, and platforms hold short windows: Example 1's fourteen videos. The advice pairing: race the window when warned in time; when not, work the creation side and the viewers: expiry defeats the casual observer, not the map. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

Preserving Social Media Evidence