Social media evidence preservation is the process of capturing, authenticating, and archiving platform content in a form that survives deletion, platform moderation, and legal challenge. The key identifiers are timestamped platform metadata, content hashes, and URL-stable capture records. Content deleted after capture but before publication is not lost to the investigation if provenance is properly documented from the moment of retrieval.
The method applies when capturing posts or pages before anticipated deletion, preserving user-generated conflict documentation for potential judicial use, archiving statements by public figures before retraction, building a timestamped record of coordinated inauthentic behaviour, documenting evidence of platform-removed content, or securing material from accounts that may be banned under evolving platform policies. Platform moderation can remove content within minutes of a report being filed. Each piece of content, individually, is ephemeral. The provenance chain, documented from the moment of retrieval, is not.
SOC-002 sets out the methodology for capturing, authenticating, and archiving social media evidence to evidentiary standard.
Eight workflow steps, six tooling sources, six false-positive checks, six chain-of-custody requirements.
|
01
Required Tools
Six platforms covering Hunchly, Wayback Machine, Mnemonic Archives, SMAT, and InVID WeVerify.
|
02
OPSEC
Immediate capture, no primary account, SHA-256 on capture, dual-location storage, and UTC timestamp conversion.
|
|
03
Workflow
Eight steps from content identification through capture, hashing, stable archival, and custody record finalisation.
|
04
False Positives
Reposted historical content, satirical accounts, scraping artefacts, dynamic page previews, and timezone errors.
|
|
05
Chain of Custody
Original URL, post ID, UTC timestamp, SHA-256 per file, Wayback archive URL, and tool version logging.
|
06
Key Queries
Seven operator references across Wayback Machine, yt-dlp, InVID, SMAT, ExifTool, Hunchly, and CrowdTangle.
|
Download the card.
A PDF version of SOC-002 is available below for Signal subscribers.
The rest of this card is for Signal subscribers.
What remains: the step sequence, the tool list, the false-positive checks and the chain-of-custody note. Signal is €90 a year, or €9 a month. Students, €49 a year.
Join SignalSignal includes:
- Full OSINT Reference Card library, 21 domains
- Methods, every tradecraft tutorial in full
- AI in OSINT, every prompt and field report
- Shadow Analysis, every forensic dossier
- OSINT Hub community access