Evidence

Before the post disappears: how lawyers and investigators preserve social media evidence

Courts want to know that a post is what you say it is. Hash values, server timestamps and full-account captures are how legal teams show it.

Filed
Area
Evidence
By
The editors

Posts get deleted, accounts go private and stories expire, often right after a dispute starts. Social Media Evidence is a forensic capture platform that preserves any public TikTok, Instagram or X account, transcribes every video and lets legal teams search the archive, with a SHA-256 hash and a server timestamp recorded for every file.

Engraving of a smartphone in a sealed evidence bag beside a clock and a strip of code
Illustration: Court & Screen

For lawyers, investigators and people preparing their own cases, the hard part is rarely finding the post. It is proving later that what they kept is exactly what was online, and when.

Proving a post is what you say it is

In US federal courts, Rule 901 of the Federal Rules of Evidence requires the party offering an item to produce evidence sufficient to support a finding that the item is what they claim it is. Rule 902(14) allows data copied from an electronic device, storage medium or file to be authenticated by a process of digital identification, such as a hash value, backed by a certification from a qualified person.

Australian law takes a related approach. Under section 146 of the Evidence Act 1995 (Cth), where a document or thing is produced by a process or device that ordinarily produces a particular outcome when properly used, a court can presume it did so on the occasion in question, unless there is evidence sufficient to raise doubt.

The Sedona Conference Primer on Social Media walks through how social media content is preserved, collected and authenticated in litigation, and stresses capturing metadata along with the visible content. A hash value is a short fingerprint calculated from a file: change a single pixel or character and the hash changes, so matching hashes show a file has not been altered since it was recorded.

Screenshots and captures

A screenshot shows what was on one screen at one moment. On its own it says little about where the content came from, which account posted it, whether it was edited, or what comments and replies sat around it. That is why litigators increasingly prefer a capture: a copy of the content collected directly from the source, with the URL, the account, the time of collection and a hash recorded at the same moment.

A capture can be checked. If the other side disputes a video, the hash recorded at collection can be recalculated from the file produced in court, and the two should match. The server time shows when the content was collected, and the surrounding posts and comments show the context a single image leaves out.

What a forensic capture records

Social Media Evidence is built around that kind of record. According to the company, each capture includes:

  • Whole accounts, not single screens: posts, reels, stories, replies, reposts and quote posts from public TikTok, Instagram and X accounts, with page screenshots of the profile and posts.
  • Integrity data: a SHA-256 hash on every file and a capture time recorded by the company's servers in UTC, rather than typed in by a user.
  • Transcripts and comments: every video is auto-transcribed with time codes, and comments and nested replies are captured alongside each post, with usernames.
  • Search with citations: plain-English AI search across transcripts, captions and comments, returning results that link straight to the exact post.
  • Security and export: AES-256 encryption at rest, TLS in transit, and export of the whole archive as CSV or JSON for a brief or disclosure.

Pricing starts from $19 as a one-time payment, with free sign-up and no subscription. The company says more than 19,000 posts have been archived on the platform, and it lists lawyers, law enforcement and private investigators among its users. It operates through Social Media Evidence Inc in the United States and Social Evidence Pty Ltd in Australia.

Where it gets used

The matters where social media evidence decides outcomes are the ones our republished writers keep returning to:

A practical checklist

  1. Capture early. Preserve the account as soon as a dispute looks likely, before content is deleted or made private.
  2. Capture context. Keep comments, replies and the surrounding posts, since meaning often depends on them, as Cavell Ord-Shrimpton explains in her piece on message drift.
  3. Keep the integrity record. Retain the hash values and capture times with the files.
  4. Document the process. Note who captured what, when and with which tool.
  5. Export for the brief. Produce a clean, searchable set for counsel, experts and the other side.

More on how the platform works is at socialmediaevidence.com.