Social Media Forensics & Online Evidence
A Practical Guide for Defense Attorneys and Investigators
Social media and online evidence can help establish identity, relationships, communications, location, activity, knowledge, intent, credibility, or the timing of events. It can also show that an account, post, message, or file was misunderstood or attributed to the wrong person.
This guide provides a practical framework for identifying, preserving, obtaining, and evaluating online evidence for defense attorneys and investigators, including those with little or no technical experience.
Online evidence can change or disappear quickly. Begin preservation as soon as a potentially relevant account, post, message, page, video, or provider record is identified.
Key point: An account name, profile, device, or Internet Protocol address may connect activity to an account or connection without proving who personally performed it. Evaluate source, access, authorship, and context separately.