Page 1

SOCIALMEDIAEVIDENCE · A GUIDE FOR UK LAWYERS Preserving Social Media Evidence Before It Changes Posts, Profiles, Stories and Deletions: Capturing a Medium Built to Move COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM DELETED-CONTENT INVESTIGATION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: evidence with a half-life 03 The capture ladder: methods ranked by evidential weight 04 Platform self-download archives: the account-holder route 05 The public-view route: capturing what the world could see 06 Platforms, process and what providers hold 07 Authentication: proving the post was real 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: TREATEVERYRELEVANTPOSTASSCHEDULEDFORDELETION, ANDCAPTUREATTHEHIGHESTEVIDENTIALRUNGAVAILABLETODAY

§ 02 · FIRST PRINCIPLES The problem in plain English: evidence with a half-life

§ 03 · THELADDER The capture ladder: methods ranked by evidential weight RUNG METHOD · WEIGHT · WHEN 4 · Provider records Platform-held data under legal process: account records, IP and access logs, and content 3 · Self-download archive The account's own structured export: posts, messages, media, metadata, account history: 2 · Forensic capture Documented acquisition of the live view: full pages, URLs, timestamps, request context, 1 · Screenshot A picture of a screen: no metadata, no pedigree, fabrication-trivial: better than nothing at the