Indirect Collection
Definition
Deriving evidence from interconnected accounts (mutual friends, tagged content, common groups) rather than the target's own profile. Powerful when the target's account is private or deleted.
- Field
- Social media evidence collection
- Source
- Interconnected accounts: mutual friends, tags, shared groups
- Advantage
- Works when target account is private or deleted
Common questions
Why is indirect collection especially valuable once a suspect deletes or locks their profile?+
Content the suspect posted or was tagged in often persists on friends' public accounts or in shared group archives even after their own profile disappears, so investigators can reconstruct activity through those surrounding accounts.
What limits the reliability of evidence gathered through indirect collection?+
Tags, comments, and mentions from a third party's account require independent authentication tying them back to the actual target, since another user's post about or featuring someone is not the same evidentiary weight as content from the target's own account.
Related terms
- API-Based Collection
- Acquisition via the platform's official API: X v2 API, Meta Graph API, LinkedIn API. Requires a developer account, often paid tiers, and...
- Direct Collection (With Login)
- Acquisition using the subject's account credentials or a session cookie lifted from a seized device. Requires legal authorisation under BNSS Section 91...
- Direct Collection (Without Login)
- Acquisition of a target's public profile content using no credentials. The page is served to anyone. Limited to whatever the privacy settings...
- Hunchly
- Browser-based case-management tool for OSINT. Captures every page visited as a hashed snapshot, builds the case dossier and produces a court-ready report....
- OSINT
- Open-Source Intelligence. Investigation using publicly available sources: social media, satellite imagery, news archives, public databases. In deepfake casework, OSINT corroborates or contradicts...