Permavault › How to Preserve Social Media Evidence
How to Preserve Social Media Evidence
Capture the post at its permalink using a neutral automated system that records the URL, the time, and its own process, and fingerprints the result with cryptographic hashes at capture. A phone screenshot is a lead, not evidence.
Social media evidence has a short shelf life. According to Pew Research Center’s 2024 study of online content, 18 percent of tweets become invisible within three months of posting: 1 percent within an hour, 10 percent within a week. Half of all eventually removed tweets are gone within six days.
If a post matters to your case or investigation, the window to preserve it is measured in days, sometimes hours. And how you preserve it matters as much as when, because courts have been excluding casual screenshots of social media for over a decade.
The two ways social media evidence dies
It disappears. The account owner deletes the post, edits it, or takes the account private. The platform removes it for a policy violation. The account gets suspended. Once litigation is foreseeable, deletion by a party can be spoliation, and courts do punish it. In Lester v. Allied Concrete Co., a plaintiff deleted Facebook photos after a discovery request; the result was roughly $722,000 in sanctions and a five-year license suspension for the attorney who directed it. But sanctions against the other side do not give you the evidence back. A preserved copy does.
It gets excluded. In United States v. Vayner, 769 F.3d 125 (2d Cir. 2014), the government offered a printout of a social media profile page bearing the defendant’s name and photo. The Second Circuit held it inadmissible: the mere existence of a profile with someone’s name on it does not establish that they created it or authored its contents. In Moroccanoil v. Marc Anthony Cosmetics, 57 F. Supp. 3d 1203 (C.D. Cal. 2014), Facebook screenshots failed without circumstantial evidence supporting their authenticity. The pattern is consistent: a bare image of a post, captured by an interested party with no record of when or how, invites the objection.
Those two failure modes need different answers, and it is worth being precise about which one a good capture solves. Preserving the post properly defeats the first completely and the second not at all: a perfect capture of an impersonated account is a perfect capture of a fake. What a rigorous capture buys you is that the argument happens on authorship, where your investigation can win it, rather than on authenticity, where a weak capture loses before anyone reaches the merits.
Why phone screenshots are the weakest form of preservation
A screenshot of an Instagram story or an X post is easy to make and easy to fake, and everyone in the courtroom knows both things. It shows no URL. It carries no reliable timestamp beyond what is drawn in the pixels. It cannot show the post in context, the account it came from, or whether the content was altered before or after capture. And the person who took it is usually the client or the lawyer, which puts an interested party inside the chain of custody.
Screenshots are fine as leads and working notes. As the preserved evidence itself, they should be the last resort. Our guide to what opposing counsel looks for in screenshot metadata covers what an examiner does with one when it is challenged.
If the post is live right now
Preservation quality matters, but a rough copy of a live post beats a perfect method applied to a deleted one. In order:
- Copy the permalink. Every post you care about, into a list, before anything else. A URL you no longer have is a post you can no longer capture.
- Make an immediate capture with the best tool you have to hand, even if that is a screenshot.
- Then preserve properly, with the workflow below, while the content is still up.
- Send the preservation demand if a party controls the account, and do it early. It does not preserve anything by itself, but it starts the spoliation clock.
What good social media preservation looks like
The requirements mirror web evidence generally, and we cover the legal framework in detail in our guide to authenticating website screenshots under FRE 902. For social media specifically:
1. Capture the post at its URL, not from your feed. Most posts on X, Instagram, Facebook, and TikTok have a permalink. Capture that page, so the record shows the content tied to the account and platform context.
2. Record who, when, and how automatically. The capture should carry its own metadata: exact URL, date and time, and the process used. This is what the excluded captures in Moroccanoil lacked, and what no printout offered in Vayner could supply.
3. Fingerprint the capture immediately. A cryptographic hash computed at capture time can support a Rule 902(14) certification and is the cleanest answer to “how do we know this was not edited?” We explain the mechanics in FRE 902(13) vs 902(14).
4. Use a neutral, automated system. A capture performed by an automated service, rather than by you or your client, keeps interested parties out of the chain of custody and gives opposing counsel less to work with.
5. Store it somewhere that outlives the case. Custody disputes and IP matters run for years. The capture needs to survive laptop failures, vendor shutdowns, and subscription lapses for as long as the matter might.
6. Move fast, then preserve properly. If the content is up now and might not be tonight, make an immediate capture with the best tool available, then follow with a proper preservation workflow. A rough copy now beats a perfect copy of a deleted post.
Platform by platform
The principles are the same everywhere, but each platform loses content in its own way, and the practical capture problems differ. Instagram stories expire on a 24 hour timer. X lost the third-party archives that used to watch it. TikTok is built around content that is not meant to persist. The cluster below covers each in turn.
For what happens when the source is a web page rather than a post, see web archiving for evidence, which also covers why the Wayback Machine is not a substitute for a capture you control.
A note on private accounts and DMs
Everything above concerns publicly visible content. Private messages and friends-only posts raise separate issues: they generally must come through discovery, a preservation letter, or the account holder, and platforms respond to lawful process on their own timelines. What you can do immediately is send a preservation demand early and capture whatever is lawfully visible to you before it changes.
Preserving social media with Permavault
Permavault captures a social media post the way an evidence workflow needs it captured. Paste the post’s URL and a neutral automated system preserves the full page as it rendered, fingerprints every file with cryptographic hashes at capture, and stores the result on a permanent decentralized network of roughly 300 independent nodes, funded by a long-term storage endowment. The capture is designed to remain retrievable and verifiable for the life of your matter and long after, independent of any vendor. Including us.
Each capture is $4.99, with an optional Certificate of Authenticity from $9. The Legal tier adds a qualified electronic timestamp from Disig a.s., an EU-listed qualified trust service provider, applied to the signed capture manifest, plus an independent Bitcoin-anchored timestamp and a declaration template designed to support authentication under FRE 902(13) and 902(14). Under eIDAS Article 41, a qualified electronic timestamp carries a presumption of the accuracy of its date and time in EU courts.
The post you can see today is evidence. The post that was deleted last night is an argument. Capture while it is still the former.
This article is general information, not legal advice for any specific matter. Preservation obligations and admissibility depend on the facts, the jurisdiction, and the judge.