Social Media Evidence Collection: API, Direct, Indirect and OSINT

Build a source map before collection. A profile, conversation, attachment, notification, account export and provider log can describe different parts of the same event.

Visibility is not a complete legal access ladder. Public collection can still involve legal or ethical constraints; a friend’s access is not permission to enter every connected account.

Provider-type fields can also appear in account security pages or endpoint records. Conversely, the provider may lack readable end-to-end encrypted content. Do not promise a fixed set of eleven artefacts or passwords in every return.

Capture perishable content promptly, but do not defer provider preservation until all public work is complete. Retention differs by record and feature; visible expiry does not prove backend deletion or continued availability.

Four useful method labels are direct capture without login, authorised capture with login, API collection and indirect collection. They are planning categories, not exhaustive legal powers.

For dynamic pages, record loaded content, visible counters and any pagination or expansion performed. Save native media where available alongside context captures. A screenshot does not preserve all underlying data, while saved HTML may depend on remote resources.

Authenticated collection can trigger alerts, mark messages read, refresh sessions or alter account state. A recovered cookie is sensitive evidence, not automatic permission to impersonate the user. Plan and document remote interactions separately from device acquisition.

An export’s scope depends on the service, account, options and request date. Preserve the original archive, manifests and completion notices. Explain differences between exported timestamps and the user-facing page.

APIs expose supported objects under actual permissions and rate limits. Keep raw responses, pagination tokens where appropriate, errors and query details, while protecting credentials. “No results” can reflect access or query limits rather than absence.

Indirect collection may locate a repost, reply or tagged image. Preserve its own provenance; it does not automatically reconstruct the target’s original content or author.

No general production order overrides every platform term or authorises bypass of all technical access controls. Check the scope and applicable process instead of treating an investigative purpose as blanket authority.

Choose tools for the evidence question rather than running every reconnaissance module. Queries can expose sensitive case details to external services or actively contact target infrastructure.

SpiderFoot, Recon-ng and theHarvester can assist scoped discovery where supported. Module counts, service coverage and API access change. A tool’s inclusion in a list does not mean every agency uses it or its output is court-certified.

Validate account hits against independent attributes, historical context and source reliability. Similar names, reused photos and common infrastructure produce false matches. Separate a candidate link from a confirmed attribution.

For graphs, preserve original query results and the reason for each edge. A transform result can be stale, inferred or sourced from a third party; a visually dense graph is not stronger evidence by itself.

Keep a collection log, original outputs, hashes where applicable, analyst annotations and an evidence index. Test capture tools against the actual feature and keep failed or partial acquisitions visible in the report.

Metadata describes the acquired representation. A public derivative may differ from an original file, message attachment or export. Do not assume every upload strips all metadata or that every off-platform copy retains it.

Use a local validated parser on sensitive evidence instead of uploading it to an unrelated web viewer. ExifTool reads supported formats and can also modify tags; record read-only commands and preserve the original.

For example, exiftool -a -G1 -s -GPSLatitude -GPSLongitude -DateTimeOriginal -Make -Model file.jpg displays selected tags with group names. Assess coordinate reference, hemisphere, timestamp semantics and duplicate fields rather than relying on a formatted location alone.

Background landmarks can support geolocation when compared with independent mapping and imagery. Distinguish location depicted from where a file was uploaded or where a person was at the alleged event time.

Snap Map, fitness maps and public check-ins expose different data under current settings. An aggregate heat map does not identify an individual route automatically. Preserve the exact view and avoid inferring hidden users.

IP geolocation is generally approximate and can describe a VPN, carrier or hosting exit. A Wi-Fi database lookup can be stale or affected by moved access points. Document uncertainty and corroborate physical-location claims.

Document author fields, camera model and filenames are leads, not a “single strongest” identity proof. Consider templates, shared devices, edits and copied files before linking a human author.

Deleted or edited material may survive in earlier captures, participant devices, exports, reposts or provider records. Recovery is a possibility to investigate, not a guaranteed retention window.

An archive timestamp normally concerns the archive capture, not the original publication or event. Preserve the archive URL, collection details and relevant resources. Do not treat a replayed page as a complete historical server image.

A third-party public archiving service can disclose the URL or sensitive content. Use it only when appropriate; local preservation and restricted case storage may be preferable.

Do not rely on retired search-cache features or fixed provider recovery queues. Consult current official procedures. X’s law-enforcement guidance describes a 90-day preservation snapshot pending valid process; this does not mean every deleted post remains available for 90 days.

Notification previews are conditional on delivery, settings, OS and acquisition method. There is no universal iOS/Android 48–72-hour recovery promise. A preview may be truncated, grouped or inconsistent with the final message.

Check provider guidance and request acknowledgements promptly, including any extension requirements. A preservation request and disclosure authority are distinct, and neither guarantees a successful response.

Authentication begins with provenance: identify the source, acquisition method, access context, time, files and transformations. Preserve originals and explain how each exhibit relates to the source material.

In US proceedings, relevant authentication and evidence rules depend on the forum and record. A screenshot or hash does not independently prove who authored the content. In the UK, distinguish the applicable legal system and disclosure duties.

Use the appropriate certificate or authentication process for the forum and record. A generic analyst signature is not a worldwide substitute for source-custodian information or a prescribed form.

Earlier case law must be read within its actual statute, facts and later developments. Do not assume a historical ruling supplies identical requirements in another country or under a later evidence law.

Production, search, seizure and recording requirements are separate legal questions. Document the actual authority rather than using a generic section number as permission for every collection step.

Package an evidence index, original files/exports, collection log, checksums, source and timezone notes, tool details, transformations and limitations. Hashes support byte comparison, not source truth or account ownership.

Use the dedicated final-module lesson for BNS and BSA Electronic Evidence. Requirements vary by jurisdiction; this collection workflow does not replace the relevant legal assessment.