A client called us recently and asked about information on social media that involved disparaging remarks against the client and others. The client stated that “He posted it on social media and I took a screenshot.” That’s great instinct, and a good starting point for us, but unfortunately, it’s usually not enough.

A screenshot shows an image. It does not prove who posted it, when it was posted, whether it was altered, or that the account belongs to the person you say it does. Opposing counsel knows this, and a judge may too.

Why screenshots fail

• No authentication. Someone has to establish that the post is what you claim it is. A cropped image with no URL, no date, and no account details gives them very little to work with.
• Missing context. Comments, reactions, tagged users, location data, and the posting timestamp often matter more than the post itself.
• Easy to challenge. Screenshots are simple to edit, and everyone knows it.
• Posts disappear. Once the subject realizes they’ve been noticed, content gets deleted, edited, or locked down. You usually get one chance at this.

What a defensible capture looks like

1. Capture the full page, including the URL and a visible date and time. Not just the text that helps your case.
2. Document the profile. Username, profile URL, user ID if available, profile photo, “About” section, and friends or followers where public. This ties the content to a real person.
3. Record the navigation. A screen recording that shows you going from the profile to the post, with the URL bar visible, is far stronger than a single image.
4. Use forensic capture tools when the stakes are high. Purpose-built software records the page, metadata, and a hash value, which helps show the file hasn’t changed since capture. (Page Vault, Hunchly, and X1Social Discovery are just a few capture tools that can assist in preservation.)
5. Have the right person capture it. A neutral investigator who can testify to the process is better than the client or a party to the case. Two people are better still, one capturing and one witnessing.
6. Keep a log. Who captured it, when, on what device, with what tool, and where the files are stored. Social media data must be treated like any other evidence.
7. Preserve the original files, not just copies. Store them in a controlled location and work from duplicates. (For example, an encrypted drive in a locked safe, or a secured server with access logs and a backup kept elsewhere.)

Where investigators get into trouble

Public content is fair game; however, private content is another matter. Sending a fake friend request, using a false identity to gain access, or logging into someone’s account crosses legal and ethical lines, and it can taint the evidence and expose the attorney and the investigator. If it isn’t public, ask counsel how to proceed, and consider a preservation letter or discovery request instead.

Key Takeaway

Social media can make or break a case, but only if it can be used. Capture it early, completely, and capture it in a way you’d be comfortable explaining on the witness stand.

If you have a case where online content matters, call us before the post disappears.

A presto!