Social media evidence tends to arrive in a solicitor's inbox as a folder of screenshots. That is a starting point, not an exhibit. The originating platform usually retains a great deal more than a user sees, and the user's own device usually holds cached copies that can be recovered even after the account is deleted.
Where the evidence actually lives
- On the account itself, retrievable by data subject access request or platform disclosure.
- In device caches, where posts and messages remain long after they were deleted online.
- In backup archives, both device and cloud.
- In the URLs and identifiers embedded in screenshots, which can be checked against the live account.
Common issues
Fabricated screenshots are common, especially in harassment and family cases. So are edited profile names designed to imply the wrong account. A proper examination checks identifiers, timestamps and account ownership, not just the visible text.
Practical steps for legal teams
Preserve the device early. Ask the client to stop using the account. Consider a data subject access request in parallel with the extraction; the two sources cross check each other and expose fabrications quickly.