Page 1
SOCIALMEDIAEVIDENCE · A GUIDE FOR UK LAWYERS Preserving Social Media Evidence Before It Changes Posts, Profiles, Stories and Deletions: Capturing a Medium Built to Move COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM DELETED-CONTENT INVESTIGATION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: evidence with a half-life 03 The capture ladder: methods ranked by evidential weight 04 Platform self-download archives: the account-holder route 05 The public-view route: capturing what the world could see 06 Platforms, process and what providers hold 07 Authentication: proving the post was real 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: TREATEVERYRELEVANTPOSTASSCHEDULEDFORDELETION, ANDCAPTUREATTHEHIGHESTEVIDENTIALRUNGAVAILABLETODAY
§ 02 · FIRST PRINCIPLES The problem in plain English: evidence with a half-life
§ 03 · THELADDER The capture ladder: methods ranked by evidential weight RUNG METHOD · WEIGHT · WHEN 4 · Provider records Platform-held data under legal process: account records, IP and access logs, and content 3 · Self-download archive The account's own structured export: posts, messages, media, metadata, account history: 2 · Forensic capture Documented acquisition of the live view: full pages, URLs, timestamps, request context, 1 · Screenshot A picture of a screen: no metadata, no pedigree, fabrication-trivial: better than nothing at the
Page 2
§ 04 · THEACCOUNT - HOLDERROUTE Platform self-download archives: the account-holder route
§ 05 · THE PUBLIC - VIEWROUTE The public-view route: capturing what the world could see
§ 06 · THE PROVIDER S Platforms, process and what providers hold
§ 07 · ISITREAL? Authentication: proving the post was real
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE PLATFORM D OWN LOAD (LEGAL LIVE SELF- PROVIDER VIEW ARCHIVE PROCESS) POSTER'S COUNTERPARTS / DELETED / DEVICES ECHOES RECOVERABLE (FFS)
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THESTORYTHATEXPIREDINTOACOURSEOFCONDUCT EXAMPLE2 · THEEDITTHATTHEPAIROFCAPTURESPROVED EXAMPLE3 · THEACCOUNTDELETIONTHATUNMADEITSELF
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · SOCIALMEDIALIMBFORTHEPRESER VAT I ON LETTER
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The social media checklist Red flags When to involve a digital forensic expert 35. Through e-discovery.uk, captured social content is processed into review beside the estate's other
§ 13 · COMMON QUESTIONS Frequently asked questions Are screenshots of posts admissible? A post has already been deleted. What are the realistic routes? Can we make an opponent hand over their private account content? How do we deal with an anonymous account attacking our client? Our client wants to "clean up" their own profile before proceedings. Advice? Do expiring formats (stories, view-once) beat preservation?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Preserving Social Media Evidence, Computer Forensics Lab, https://e-discovery.uk/library/preserving-social-media-evidence/pdf.