Social Media Forensics: A Primer
A brief overview of the technical, legal, and practical issues in a social media investigation.
The data is available, but collecting this vast array of information in a way that is thorough, economical, and admissible as evidence is a technical challenge that usually requires a forensic examiner with specialized tools. Social media is a dynamic data source and is being continuously modified by the user, other users, and the company itself (e.g. Facebook or Twitter), along with the automated algorithms that govern these sites.
Specialized hardware, software, and knowledge is required, so most collection or preservation efforts will require a digital forensics expert. In addition to the data that is visible directly on the site, an expert can often collect other data, such as private posts and metadata, that may not be accessible through the normal user interface.
After capturing the data, a social media forensics expert can also make the data more useful to an attorney or investigator, enabling comprehensive keyword searches and allowing for review of the data in a format that emulates the original post.