Skip to content
HomeResourcesSocial Media Evidence: Preserve It Before It Disappears
Social & Online Evidence

Social Media Evidence: Preserve It Before It Disappears

Practical steps for preserving posts, profiles and messages with enough context to remain useful later.

6 min readPractical forensic guidanceUpdated September 2026
Social Media Evidence: Preserve It Before It Disappears
Evidence firstPreserve the source. Understand the context.

Social-media content can be edited, deleted, restricted or removed by the platform. Preservation should capture not only what was posted but also the account, date, surrounding context and location of the material.

Capture context, not just content

A screenshot of one sentence may be ambiguous. Where possible, preserve the profile name, username, URL, timestamp, surrounding posts or replies and enough of the interface to show where the material came from.

Keep the original URL

Record direct links to posts, profiles, images or videos. URLs can help identify the source even if the content later changes or disappears.

Preserve media separately

Images and videos may contain useful metadata or visual details that are lost in a compressed screenshot. Where lawful and available, preserve the original downloadable media as well as the page context.

Do not create unnecessary interaction

Following, messaging, liking or commenting can alert the account holder and alter what you see. Passive preservation is often preferable where safety and legal authority permit.

Evidence to preserve
  • Full-page or contextual screenshots
  • Profile names and usernames
  • Direct post and profile URLs
  • Dates and times
  • Original images or video where available
  • Related messages or notifications
Avoid if possible
  • Cropping away usernames or timestamps
  • Editing screenshots for presentation before preserving the original
  • Relying solely on a copied block of text
  • Engaging with the account simply to generate more evidence
A useful rule: preserve before you clean up, export before logs expire, and document any action that changes the source.