Preserving Social Media Evidence

SOCIALMEDIAEVIDENCE · AGUIDEFORUKLAWYERS Preserving Social Media Evidence Before It Changes Posts, Profiles, Stories and Deletions: Capturing a Medium Built to Move COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM DELETED-CONTENT INVESTIGATION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: evidence with a half-life 03 The capture ladder: methods ranked by evidential weight 04 Platform self-download archives: the account-holder route 05 The public-view route: capturing what the world could see 06 Platforms, process and what providers hold 07 Authentication: proving the post was real 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : TREATEVERYRELEVANTPOSTASSCHEDULEDFORDELETION , ANDCAPTUREATTHEHIGHESTEVIDENTIALRUNGAVAILABLETODAY § 0 2 · FIRSTPRINCIPLES The problem in plain English: evidence with a half-life § 0 3 · THELADDER The capture ladder: methods ranked by evidential weight RUNG METHOD · WEIGHT · WHEN 4 · Provider records Platform-held data under legal process: account records, IP and access logs, and content 3 · Self-download archive The account's own structured export: posts, messages, media, metadata, account history: 2 · Forensic capture Documented acquisition of the live view: full pages, URLs, timestamps, request context, 1 · Screenshot A picture of a screen: no metadata, no pedigree, fabrication-trivial: better than nothing at the § 0 4 · THEACCOUNT - HOLDERROUTE Platform self-download archives: the account-holder route § 0 5 · THEPUBLIC - VIEWROUTE The public-view route: capturing what the world could see § 0 6 · THEPROVIDERS Platforms, process and what providers hold § 0 7 · ISITREAL ? Authentication: proving the post was real § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE PLATFORM DOWNLOAD (LEGAL LIVE SELF- PROVIDER VIEW ARCHIVE PROCESS) POSTER'S COUNTERPARTS / DELETED / DEVICES ECHOES RECOVERABLE (FFS) § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THESTORYTHATEXPIREDINTOACOURSEOFCONDUCT EXAMPLE2 · THEEDITTHATTHEPAIROFCAPTURESPROVED EXAMPLE3 · THEACCOUNTDELETIONTHATUNMADEITSELF § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · SOCIALMEDIALIMBFORTHEPRESER VAT IONLETTER § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The social media checklist Red flags When to involve a digital forensic expert 35. Through e-discovery.uk , captured social content is processed into review beside the estate's other § 1 3 · COMMONQUESTIONS Frequently asked questions Are screenshots of posts admissible? A post has already been deleted. What are the realistic routes? Can we make an opponent hand over their private account content? How do we deal with an anonymous account attacking our client? Our client wants to "clean up" their own profile before proceedings. Advice? Do expiring formats (stories, view-once) beat preservation? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY