Social Media and Digital Platform Forensic Examination

Social media content can be edited or deleted within minutes. A screenshot taken after the content is gone may carry little evidential value.

Content therefore needs to be captured with a verifiable method that shows when and from which address it was recorded.

• Time-stamped forensic capture of accessible content
• Assessment of account activity and session records
• Review of posts, comments and messages
• Analysis of images and videos with their metadata
• Investigation of access traces in account takeover cases
• Fake account and impersonation investigations
• Technical consulting on formal data requests to platforms
• Structured reporting of findings

We limit the work to accounts the client is legally authorised to access and to public content. Public content is recorded using forensic capture methods; where the account holder authorises it, account data is exported with the platform's own tools and examined.

1. Intake and custody: we confirm the requester's legal authority, sign a non-disclosure agreement and receive the material with a signed evidence handover record. The chain of custody is documented from this point on.
2. Capture and verification: content is captured together with its URL, date and time and a page record, and the hash values of the captured files are recorded.
3. Analysis: account activity, session records and content metadata are examined and combined into a timeline.
4. Reporting and return: findings are reported together with the scope and limitations of the work. The material is returned against a signed record and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment. Where content is at risk of removal, capture is prioritised.

Organisations and individuals dealing with defamatory content, fake accounts, account takeovers or commercial disputes.