Why social media matters in litigation
Most adults in the United States use social media, and many post every day. Photos, videos, check-ins, comments, and status updates are often created in the moment, before anyone is thinking about a lawsuit or a prosecution. That makes them some of the most candid evidence in a case, and some of the most persuasive in front of a judge or jury.
Social media evidence shows up in nearly every kind of matter:
- Personal injury and insurance: activity, travel, and physical exertion that support or contradict claimed injuries and damages
- Employment and business disputes: statements, disclosures, and conduct relevant to claims and defenses
- Criminal matters: threats, admissions, affiliations, identity, and alibi, for the prosecution or the defense
- Witness and party credibility: public statements that are consistent, or inconsistent, with sworn testimony
It is also volatile. Posts are deleted or edited, accounts are renamed, made private, or deactivated, and Stories disappear on their own. Content that isn't captured promptly may not be available later.
The value of forensic documentation
A screenshot shows what something looked like. It doesn't show where it came from, when it was captured, or that it hasn't been altered, and opposing counsel knows it. Screenshots are easy to challenge and, increasingly, easy to fake.
A forensically documented capture answers those questions up front:
- Source: the full URL, the account's persistent identifier, and the page as displayed
- Time: the date and time of capture, recorded in a consistent time zone
- Integrity: hash values for captured pages and media files, so any later change can be detected
- Native media: images and video saved as files at the best available quality, not just pictures of a screen
- Method: a written record of the tools and process used, so the capture can be explained and repeated
- Chain of custody: documented handling from capture through production and trial
That documentation is what supports authentication under Federal Rule of Evidence 901 and certification under Rule 902(14), and their state equivalents, and it lets a witness explain exactly how the evidence was collected.
Public content only. Our open-source work is limited to publicly accessible content. We don't send friend or follow requests or otherwise attempt to access private accounts. Private content is a matter for discovery, consent, or legal process, and we can analyze those returns when they're produced.
Recovery and preservation
- Public posts, comments, and replies
- Photos and videos in native format
- Profile details and changes over time
- Check-ins, tagged locations, and geotags
- Shares, reposts, and re-uploaded copies
- Account identifiers that survive name changes
- Public connections, followers, and tags
- Archived and cached copies of removed content
We also trace how content moves: identifying duplicates, derivatives, and re-shared copies circulating across accounts and devices, and working back toward the earliest available version.
Analysis
Capturing a post is only the first step. The questions that matter in court are who created it, when, where, and whether it is what it appears to be.
- Attribution: is there a reliable basis to connect an account, or a specific post, to a particular person?
- Timing: when was the content actually created, as opposed to posted, shared, or edited?
- Location: what do check-ins, geotags, and the visible content of images and video show about where they were taken?
- Authenticity: is the image or video an original, a re-encoded copy, or an altered file? More on video and image evidence
- Corroboration: does the content line up with phone records, device extractions, and location data? More on timeline reconstruction
Presentation
Evidence a jury can't follow doesn't help anyone. We prepare clear, court-ready exhibits: documented captures, side-by-side comparisons, and timelines that place posts alongside other evidence. Our reports explain the capture method and findings in plain language, and we can testify to how the evidence was collected and what it shows.
Background in this work
As a task force detective, Andrew McDermott used social media warrants and returns alongside call detail records and device extractions to identify co-conspirators and build violent crime and gang cases. He has collected and preserved images and video from social media accounts and platform legal returns with hash verification and documented chain of custody, and he is a certified instructor in digital data exploitation, including social media evidence, for the Maryland Police and Correctional Training Commission.