Social Media Forensics
Law & Forensics collects, preserves, analyzes, and reviews social media evidence across platforms including Facebook, Twitter, LinkedIn, and Instagram, using forensically sound methods that protect integrity, chain of custody, and admissibility in court.
Social Media Forensics capabilities
Social Media Data Collection and Preservation
We collect and preserve data from social media platforms using a strict, forensically sound process that maintains integrity and chain of custody. Each engagement begins with a customized collection plan tailored to the data type, platform, and risks involved, ensuring the resulting evidence is admissible in court.
Social Media Data Analysis and Review
Our experts analyze and review social media data across platforms using advanced data analytics tools to search, filter, and examine large data volumes. We identify relevant information and present it clearly while preserving integrity and admissibility.
Multi-Platform Coverage
We work across major social media platforms, including Facebook, Twitter, LinkedIn, and Instagram, adapting our tools and techniques to the specific platform and data at issue.
Chain of Custody and Admissibility
Throughout collection, preservation, analysis, and review, we maintain documented chain of custody and follow defensible methods designed to withstand scrutiny and support admissibility in litigation and investigations.
Clear, Concise Reporting
We deliver regular updates and clear, concise reporting throughout the engagement, presenting relevant findings in a form that lets clients focus on the critical issues in the matter.
Social Media Forensics — matters we are engaged for
A screenshot is offered as evidence
An image of a post carries no provenance, no metadata and no way to exclude fabrication. Rule 901 asks for evidence sufficient to support a finding that the item is what it is claimed to be, and a screenshot on its own does not supply it.
The account holder deletes after the hold attaches
Deletion on a platform is rarely instantaneous or complete. Platform download archives, cached copies and the recipients' side of an exchange frequently preserve what the account no longer shows.
Authorship is disputed
The content is not in question; who posted it is. Device association, session records, and the pattern of activity around the post are what tie an account to a person, and none of them come from the post itself.
Requests are drafted too broadly to survive
Courts have repeatedly narrowed social media requests that sweep in everything rather than tying the material sought to the injury actually alleged. Scoping the request to what the platform can produce, and to what the case is about, is what makes it enforceable.
Social Media Forensics — frequently asked questions
Which social media platforms do you support?
We collect, preserve, analyze, and review data across major platforms including Facebook, Twitter, LinkedIn, and Instagram, and adapt our methods to the platform and data type at issue.
How do you ensure social media evidence is admissible in court?
We follow a strict, forensically sound process that maintains data integrity and chain of custody from collection through review, using specialized tools and techniques designed to support admissibility.
Can you handle large volumes of social media data?
Yes. Our experts use advanced data analytics tools to search, filter, and analyze large data volumes, identifying relevant information while preserving its integrity and admissibility.
How does a social media forensics engagement begin?
We start by understanding your needs, including the data to be collected or analyzed, the platforms involved, and the associated risks, then develop a customized plan that addresses your concerns and goals.
Social Media Forensics — questions, terms and comparisons
Terms defined
Digital Forensics experts who testify to this work
Full expert panel →
J-Michael Roberts
Senior Director
Digital Forensics · Incident Response · Malware Reverse Engineering
Daniel B. Garrie
Founder
Digital Forensics · Expert Witness Testimony · Incident Response
Roland Cloutier
Expert Consultant
Incident Response · Expert Witness Testimony
Our experts serve as court-appointed special masters, forensic neutrals, and arbitrators — 40 appointments are listed by matter and citation.
Social Media Forensics case results
Electric Utility / Power Generation
Forensic Attribution Halts a Departing Engineer's Theft of Grid Design Data at an Electric Utility
Logistics & Freight
Insider Theft of Proprietary Routing and Pricing Models Traced and Proven at a National Logistics Carrier
Public Research University
Forensic Attribution of Faculty Research-IP Theft at a Public Research University