Digital forensic analysis of social media content

Nowadays, content published on social media is increasingly used as evidence to prove or challenge facts in legal proceedings. Posts, profiles, comments, photographs, videos and other interactions may have evidential relevance, making it necessary to assess their origin, authenticity and integrity, as well as the context in which they were published, particularly when the associated account or profile, the publication date or the possibility that the content has been manipulated is disputed.

A screenshot or printout may be useful for showing the visible content of a social media platform at a particular point in time, but it does not necessarily preserve all the elements required to verify its origin and reliability. Posts may be modified or deleted and screenshots may be altered. They may also omit relevant information such as the web address, post identifier, associated account, date and time, comments, replies or other elements linked to the publication. Therefore, when these aspects are disputed, it may be necessary, whenever possible, to examine and preserve the available digital evidence together with the elements associated with the publication.

What do we analyse in a forensic examination of social media content?

• Preservation and chain of custody: documented collection and preservation of posts, profiles, comments and other relevant content, recording their source and the actions carried out during the examination.
• Origin, authenticity and integrity of the content: analysis of the available evidence to assess whether the examined content corresponds to the indicated publication and associated account or profile, as well as to identify possible signs of manipulation.
• Screenshot analysis: examination of the screenshots provided and, whenever possible, comparison with the publication, the associated account or profile and the other available evidence, in order to assess their correspondence, consistency and possible signs of manipulation.
• Identification of profiles and publications: examination of usernames, identifiers, web addresses, visible profile information and other available elements in order to distinguish the account and content under examination.
• Date and timeline analysis: assessment of the dates and times associated with posts, comments, replies and screenshots, as well as their chronological sequence and consistency with the remaining evidence.
• Comments, replies and interactions: examination of the context in which a publication appears, including comments, mentions, replies, reactions and other interactions that may be relevant to correctly understanding the content under analysis.
• Associated multimedia content: examination of photographs, videos and audio files linked to publications, assessing the available files, their characteristics, their relationship with the published content and any possible signs of manipulation.
• Information provided by platforms and other sources: analysis of records, reports, data exports or other documentation obtained from the social media platform or other sources, when available, and comparison with the remaining evidence in the case.
• Counter-expert analysis of social media content: review of publications, screenshots and expert reports submitted by another party in order to assess the preservation of the evidence, the methodology applied and whether the conclusions are supported by the data examined.