Social media evidence is content and activity records from platforms — posts, messages, reactions, and the account metadata behind them. Screenshots are the usual method of capture and the usual reason it fails: a screenshot carries no metadata, no provenance, and nothing distinguishing it from a fabrication.
The screenshot problem
A screenshot of a post is an image of a screen. It proves that something appeared on a display, and nothing about who published it, when, from what account, or whether the page was edited in a browser's developer tools thirty seconds beforehand.
Courts have grown noticeably less tolerant of screenshots offered without more, and the reason is not pedantry — fabricating a convincing one requires no technical skill at all. Authentication under Rule 901 requires evidence sufficient to support a finding that the item is what it is claimed to be, and an image with no provenance does not supply it.
Better capture, in order
- The platform's own data export. Most major platforms let an account holder download their data, including posts, messages and account activity with timestamps. Where the account is your client's, this is the cleanest route.
- Forensic web capture tools that record the page, the underlying HTML, HTTP headers, the capture time, and a hash value of the output. This is the standard answer for public content on someone else's account.
- Device extraction. Content in the app on a phone, obtained by mobile extraction, including material the platform interface no longer displays.
- Subpoena to the platform, which is slow and — under the Stored Communications Act — sharply limited as to content in civil cases.
That last constraint surprises litigators regularly: a civil subpoena to a provider generally cannot compel the contents of communications, so the practical routes run through the account holder rather than the platform.
Authenticating an account, not just a post
The contested question is usually attribution: whether this defendant wrote it. Useful evidence includes account registration details, the device and IP records tied to activity, distinctive content only that person would know, corroborating messages from other participants, and admissions.
A post from an account bearing someone's name is not evidence that they wrote it, and account compromise is a genuine and frequently raised defence. Building attribution from more than the account name is what makes the evidence hold.
Preservation is urgent for a different reason
Unlike a hard drive, social media content can be deleted by its author at any moment from anywhere, and disappearing-message features remove it on a timer without anyone acting. There is no equivalent of seizing the device to stop it.
A preservation letter to the account holder and to the platform is worth sending immediately, and capture should not wait for it to be answered. Where content is already gone, ephemeral messaging covers what may still be recoverable — often more than parties assume, because deletion in an app is not deletion in its local database.
Proportionality applies
Requests for a party's entire social media history are routinely narrowed. Courts have been consistent that a claim does not open a person's whole online life to inspection, and requests tied to specific issues, date ranges and topics are the ones that survive.
From our work
Dealing with social media evidence in a live matter?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.