Our simple thoughts on Best Practices for social Media Preservations.

1.Stay out of the process, remove yourself or your staff from the preservation.  You may do the leg work and find the profile, or posting of interest, but once found, step back and have it done in a way that is self-authenticating, or removes yourself or staff from being a witness.

Federal Rules of evidence 902.

  • (13) Certified Records Generated by an Electronic Process or System. A record generated by an electronic process or system that produces an accurate result, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12). The proponent must also meet the notice requirements of Rule 902(11).
  • (14) Certified Data Copied from an Electronic Device, Storage Medium, or File. Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12). The proponent also must meet the notice requirements of Rule 902(11).

2. Do it quick.  Things can be deleted at a key stroke?  Have you issued a preservation request after a preservation has been completed?

3.  Do it right.  The preservation should contain the WYS ( what you see) evidence but also Meta Data from the social media platform, like url, date times events etc.  A good forensic software that conforms to the Federal Rules evidence will do that.  Screen shots will not.  That being said even a screen shot obtained prior to  a full preservation has importance so do not just exclude it. attach it with the preservation report.  It should be complete, get the specific post, but also expand for a 6 month range or year, or the entire thing.  Look at the whole picture ( whole account) then focus in on the precise event you want to address.

 

Things to consider…

Some social media platforms have consumer access to “download my data” in place.  A court order or an agreement could give you a report generated by the owner of the account, or ask for the credentials and provide those to us to utilize the forensics software to access the data and eliminate any potential errors or emission of the self downloaded data.

As of recent we have not heard of Facebook providing content of ny kind from a civil subpoena.  Unless it was garnered by a search warrant issues  through a police investigation.  There is still some data NOT available for consumer download that is provided to law enforcement as part of that criminal investigation and warrant.

 

(None of our opinions are legal advice)