Social Media Evidence Capture and Preservation With OSINT
Social media evidence capture is the step most cases get wrong: a cropped phone screenshot of a post that is deleted the next day. We preserve the post, the page around it, the media in original quality and the record of how it was collected, so the item can still be shown, checked and relied on months later.
- Posts, stories, live video, comments
- SHA-256 hashes and capture metadata
- Web archive files, not just screenshots
- Same-day preservation possible
Social media evidence capture preserves public posts, profiles, comments, stories and videos with the URL, platform IDs, a UTC timestamp, the capture tool, the analyst and a SHA-256 hash of every file. OSINT-S adds web archive files and original media alongside screenshots, keeps a chain-of-custody log, and works only from public content or material the client lawfully holds.
What to Capture, by Type of Content
Each kind of content disappears in its own way and needs its own capture method. Stories and live streams need the fastest action.
| Content | What we capture | Watch out for |
|---|---|---|
| Posts and threads | The post, the full thread above and below it, the post URL and ID, the author's account ID | Edits, and context lost when only one reply is kept |
| Stories and ephemeral posts | Screen recording plus the media file where it can be obtained, with the time it was seen | Expiry within hours; capture before you report the account |
| Live streams | Recording of the stream and chat, then the replay if one is published | Replays are often trimmed or never posted |
| Videos and images | Original files at the highest available quality, plus the page they sit on | Platforms compress and strip metadata; a re-encoded copy is weaker evidence |
| Comments and reactions | The comment list as displayed, expanded, with commenter account IDs | Comments load lazily and are hidden by ranking |
| Profiles | Bio, links, follower counts, profile photo, account ID and former usernames where the platform shows them | Handles change; the numeric ID usually does not |
| Private messages | Only those the client received or sent, taken from their device or the platform's own data export, with consent | We never access anyone else's private messages |
The OSINT Capture Record: Hashes and Metadata
Every item comes with a record of what it is, where it came from, when and how it was collected, and a hash that shows it has not changed.
For each captured item we log: the source URL and platform IDs; the capture time in UTC; the tool and version used; the analyst; the files produced (screenshot, page source, media, archive file); and the SHA-256 hash of each file, calculated at collection. Web pages are saved as WARC files, the web archive format standardized as ISO 28500, which stores the content together with the information exchanged when it was retrieved (ISO 28500:2017).
Browsing-based collection uses tools that hash and log pages automatically, such as Hunchly; the record and the method are what you rely on.
Screenshots vs Forensic OSINT Capture
A screenshot shows what someone says they saw. A forensic capture shows what was there, where and when, and lets anyone check it.
| Method | Strength | Weakness |
|---|---|---|
| Phone screenshot | Fast; anyone can do it | No URL, no ID, easy to crop or fake, no proof of time |
| Full-page capture with log | Shows the whole page with URL and time | Still an image; dynamic content can be missed |
| WARC web archive | Replayable, stores retrieval data, hashable | Some platform pages replay poorly; needs a second format alongside |
| Original media download | Best quality for later verification | Must be tied back to the page it came from |
| Public web archive copy | Independent third-party record | Not every platform can be archived; not suitable for sensitive matters |
We combine at least two methods for every item that matters.
Why Capture Now: Platforms, Courts and the Berkeley Protocol
In civil cases you usually cannot count on getting content from the platform later, so preserving public content yourself matters, and it must be done in a way a court can test.
US law sets out the situations in which a provider may disclose the contents of communications, and a civil subpoena from a private party is not among them (18 U.S.C. 2702(b)). Once a post is deleted, the platform may hold the only copy.
When a capture is used in US federal court, Rule 902(14) of the Federal Rules of Evidence allows data copied from an electronic device, storage medium or file and "authenticated by a process of digital identification" to be self-authenticating with a qualified person's certification (FRE 902). Hash values are the usual process. How this plays out in litigation is covered on our OSINT for law firms page. For international and human rights work, the Berkeley Protocol on Digital Open Source Investigations sets the standard for collection and preservation that we follow.
How an OSINT Evidence Capture Engagement Runs
Triage the urgent items, agree the list, capture, check integrity, then hand over an indexed bundle.
- TriageYou send the links. Anything likely to vanish soon, such as stories, live replays and accounts under report, is captured first, often the same business day.
- Agree the scopeWe list accounts, posts and date ranges with you or counsel, so collection is proportionate and nothing important is missed.
- CaptureEach item is collected with at least two methods, hashed and logged at the moment of collection.
- Verify integrityA second analyst recalculates hashes, checks that every item in the log has its files, and records any gaps.
- Index and hand overYou receive an indexed bundle with the log, files, hashes and a methods note an analyst can stand behind in a statement.
- Recapture if neededFor ongoing matters, accounts are recaptured on an agreed schedule so changes and deletions are documented.
Timelines, Deliverables and Limits
Urgent items can often be preserved within a business day; a full capture of several accounts takes from 10 business days.
Small urgent captures can often be done within a business day of agreeing scope; collections across several accounts and platforms take from 10 business days, and large or recurring captures up to about a month. Urgent delivery adds 50%. The quote is fixed after written scoping, a senior analyst reviews the bundle before release, and the fee goes down if we miss the agreed date.
We capture only what is public, or what you lawfully hold and give us. We do not use fake profiles to see locked accounts or closed groups, and we do not collect more personal data than the matter needs. Captures often feed an online harassment investigation or anonymous account attribution, and media that needs its place and date checked goes to image and video verification. For other OSINT services for disputes and investigations, see the full list.
Send the Links Before They Disappear
Email the URLs, what they show and whether anything is about to be deleted or reported. We start with the most fragile items and send a fixed quote for the rest.
Social Media Evidence Capture FAQ
Our opponent in a contract dispute keeps deleting Instagram stories that mention our deal — can social media evidence capture preserve them before they expire, and how quickly can you start?
Yes, if they are public or visible to an account you lawfully use. Stories expire within a day, so we treat them as urgent: screen recording, the media file where it can be obtained, the account ID and a timestamp, all hashed and logged. Capture of fragile items can often start within a business day of agreeing scope, and we can recapture the account on a schedule while the dispute runs.
I already took screenshots on my phone of harassing posts that have since been deleted — are they useless now, or can you still help make them usable as evidence?
They are not useless. Keep the originals on your phone, do not edit them and note when you took them. We can record their file details and hashes, look for surviving copies in public archives, search engine caches or reposts by others, and link them to the account's current profile. They will be weaker than a forensic capture, but often still useful.
Our litigation team wants to rely on a defendant's public Facebook posts in federal court — what do you provide so we can authenticate them under Rule 902(14)?
For each post we provide the captured files, SHA-256 hashes calculated at collection, the URL and platform IDs, the UTC capture time, the tool used and the analyst, in a chain-of-custody log. Rule 902(14) allows hash-authenticated copies to be self-authenticating with a qualified person's certification. Whether the court accepts it, and how counsel uses it, remains for counsel and the court.
Can you capture posts from a private Facebook group that a former employee runs if one of our current staff is already a member of the group?
Possibly, but carefully. If an employee is a genuine member and chooses to share what they see, that material may be usable, and we can document it from their own account with their consent. We will not ask anyone to join under a false pretext, and counsel should advise on privacy, employment law and any group rules before you rely on it.
We're a small business and only need about twenty posts preserved for a defamation claim — is a professional evidence capture worth it compared with doing it ourselves?
If the claim may go to court, usually yes. Twenty posts is a small, quick job, and a documented capture is much harder for the other side to challenge than screenshots. If you want to start yourself today, save full pages with the URL and date visible and do not crop. We can then capture them properly and hash your own copies too.
Sources and Notes
- ISO 28500:2017 Information and documentation, WARC file format
- 18 U.S.C. § 2702: Voluntary disclosure of customer communications or records (Cornell LII)
- Federal Rules of Evidence, Rule 902 (Cornell LII)
- OHCHR and UC Berkeley: Berkeley Protocol on Digital Open Source Investigations
Sources checked 10 October 2026. Figures about third-party firms and tools are as published by them or by the cited source on that date.