Permavault › How to Preserve Social Media Evidence
How to Preserve Social Media Evidence
Save the post at its own address, record who captured it and when, preserve the surrounding context, and check the saved copy before the source changes. Screenshots can be evidence, but a capture record makes the copy easier to explain and verify.
A post matters to an investigation because of what it shows: a statement, a photo, a reply, or the relationship between them. Preserving it means keeping enough of that context for someone else to understand and check later, even if the account disappears.
This guide covers the capture and the checks to make before you put the files away. Its legal references concern United States federal practice. Proving who controlled an account or wrote a post is separate work, covered in how to authenticate social media evidence, step by step.
If the post is live right now
- Copy the post’s exact address. Keep the account’s profile address too. A link to a feed is not a substitute for the individual post.
- Make an immediate copy. If all you have is a phone, take screenshots or a screen recording now, including the account name and surrounding conversation. Keep the original files.
- Record what you did. Note the capture time and time zone, your name, the device or tool, and whether you were signed in.
- Follow with a fuller capture while access remains. Use the checklist below, then inspect the saved result. A successful upload does not tell you whether the page showed the content you needed.
Do not delay an available copy while looking for a perfect method. In Pew Research Center’s 2024 study, 18 percent of the tweets sampled in spring 2023 were no longer publicly visible by the end of its observation period. That is a finding about that sample, not a current deletion rate for every platform. It is a reason to preserve what you can see now.
Choose a capture method for the access you have
Start with what the page actually shows, rather than assuming every public-looking link works for a signed-out visitor.
| What you can lawfully access | A practical starting point | What to check |
|---|---|---|
| A public post that opens without signing in | Capture the post’s permalink with a browser-based web capture tool. | The saved page contains the post itself, not a sign-in prompt, an error, or an empty frame. |
| A post or replies visible only through your own account | Record your authorized browsing session with a tool such as ArchiveWeb.page, then retain its original export. | Your account details and unrelated content may be included. Check the archive before storing or sharing it. |
| A disappearing story or other short-lived view | Make an immediate copy using the access and tools available, then record the account, sequence, visible time information, and collection method. | The copy includes the relevant frames and context. Do not assume a later visit will reproduce them. |
| Private messages or content supplied by an account holder | Preserve the original files or account export supplied through lawful access, alongside any explanatory screenshots. | Participants, sequence, attachments, time zone, and any gaps are documented. A public page capture cannot reach a private inbox. |
Use only access you are entitled to use. Do not bypass privacy settings, use a fake or borrowed account, or ask someone to obtain access deceptively. If access or preservation obligations are uncertain, get advice for the matter before taking further steps.
For a page you cannot see, record the address and the access limitation. A preservation request or discovery process may be appropriate, but neither creates a copy of content you have not captured.
The social media preservation checklist
Keep this list with the matter’s collection notes. It applies whether you use Permavault, another capture service, or a manual process.
- Identify the item. Save the exact post address, profile address, visible account name and handle. Record any post identifier shown in the address. Display names can change.
- Keep the context that explains it. Include the caption, visible publication or edit information, relevant replies, and the surrounding thread. Record which replies were expanded and which were unavailable.
- Check each media item. A post page may show several images, a carousel, or a video. Compare what was visible with what the saved copy can display or play. A thumbnail is not proof that a playable clip was preserved.
- Record the collection conditions. Note who collected it, the tool and version where available, capture start and finish times with time zone, whether the viewer was signed in, and any errors.
- Preserve the first files. Keep the original screenshot, recording, export, or web archive unchanged. Make annotations, crops, redactions, and other working copies separately.
- Fingerprint the files. Use a cryptographic hash such as SHA-256 and retain the result with the collection record. Record when it was calculated. A hash made later can check subsequent copies; it cannot establish what happened before it was calculated.
- Check the saved copy. Open the downloaded files or archived replay and compare them with the collection notes. Record missing replies, failed media, or sign-in walls explicitly.
- Keep the record with the evidence. Store the files, hashes, tool records, available timestamps, and collection notes together. Record later transfers and changes to working copies in the chain of custody.
A capture time is not the post’s publication time. A displayed date such as “yesterday” is not an exact timestamp. Preserve what the platform displayed and note any uncertainty rather than converting it into a fact the record cannot support.
Check the archive before the source disappears
Web archives can miss content that was not loaded during recording. Webrecorder’s capture-session guide explains recording while browsing, and its ReplayWeb.page guide explains opening and exploring saved archives.
For the part of the page that matters, compare the live view with the saved replay:
- Is the account handle visible, along with the exact post?
- Are the caption and the relevant replies present, including text behind expansion controls?
- Do the required images appear, and does the needed part of any video play from the archive?
- Does the saved result show a login prompt or an unavailable-content message instead?
- Does the archive contain private account details or unrelated material that affect how you can share it?
Use the archived replay when checking the copy, rather than reopening the live post in another tab. A working live link does not show that the archive contains the same material. For a WACZ web archive, verify the saved files as well; a visual check and a file-integrity check answer different questions.
If something is missing, preserve the incomplete attempt and note the limitation. While the source is still available, make a further capture using an appropriate method. Keep the attempts separate so a later reader can tell what each one contains.
Worked example: a post with a missing reply
This is an illustrative scenario, not a report of an actual capture.
An investigator can see a public post and one relevant reply while signed in. A server capture opens the same address but records only the post and a sign-in prompt below it. The capture has succeeded technically, but it has not preserved the reply.
The investigator keeps that attempt, then records the authorized browser view with ArchiveWeb.page, expands the relevant reply, exports the archive, and checks its replay. The original export is retained alongside any later stored version.
A useful collection note would contain:
| Field | What to record in this example |
|---|---|
| Item | Exact post and profile addresses, handle, and the reply being preserved |
| Collector and access | Investigator’s name; viewed through their own authorized account |
| Time | Actual collection start and finish, with time zone; post date recorded separately as displayed |
| First attempt | Server capture contained the post but required sign-in to see the reply |
| Further attempt | Browser archive; tool version; reply expanded during recording |
| Verification | Whether the post and relevant reply appeared in replay; any media or context still missing |
| Retained files | Names and SHA-256 hashes of each original file and each later version |
| Limits | The capture records the displayed account and content; it does not establish who controlled the account |
The missing reply is a reason to make another capture while you can. It is not a reason to describe the first attempt as complete or replace its files silently.
What screenshots, hashes, and timestamps establish
Screenshots can be evidence. Under Rule 901(b)(1), a witness with knowledge can help authenticate an item; the Federal Rules of Evidence also recognize other routes. Our screenshot evidence guide explains the limits of a bare image.
A matching hash supports file identity. An independent timestamp supports that the value it covers existed by the recorded time. Neither proves who wrote a post or whether its claims are true.
That distinction matters in United States v. Vayner, 769 F.3d 125 (2d Cir. 2014). The court found an insufficient basis to attribute a social media profile to the defendant. A record of downloading the page would not itself resolve that authorship question.
Rules 902(13) and 902(14) provide certification routes for qualifying electronic records and copies. A hash alone is not the required certification. See FRE 902(13) vs 902(14) for the process, notice, and limits. Authentication also leaves other admissibility questions open.
Platform-specific preservation guides
The checklist gives you a common collection record. Each platform guide covers the access and context problems to look for:
- Instagram posts and stories: short-lived views, edited captions, and account context.
- Facebook posts: audience restrictions and surrounding discussion.
- X posts: individual post addresses, replies, and changes in availability.
- TikTok post pages: the page’s account, caption, and media as the browser displayed them.
For material on an ordinary website, use web archiving for evidence. For the work after preservation, including linking an account to a person, use the social media authentication checklist.
Where Permavault fits
Permavault’s server capture opens a post as a signed-out visitor. It records the page as rendered, the source address, capture time and process, and fingerprints the captured files. It stores the capture and proof on a network designed for permanence, so they can be retrieved and verified independently of Permavault. Check the saved result before relying on it: a record of a sign-in prompt does not preserve the content behind it.
For a page that needs your authorized account, you can upload a WACZ archive recorded with ArchiveWeb.page. Permavault checks and normalizes the archive, then fingerprints and seals the resulting files. Keep your original export too: the uploaded original and the normalized capture are different records. The certificate identifies a user-supplied archive, and its collector may need to explain how it was recorded. A later timestamp does not independently date the original browser recording.
An eligible archive up to 10 MB can be held free for 7 days and made permanent for $0.99. A server capture up to 100 MB costs $4.99, with packs available. The optional $9 Certificate of Authenticity documents the capture process; the $39 Legal certificate adds an RFC 3161 timestamp, a chain-of-custody appendix, and a declaration template designed to support authentication under FRE 902(13)/(14). The Legal evidence package states whether the issued timestamp qualifies under eIDAS. Check the capture’s proof status before describing any timestamp as complete.
Before uploading sensitive material, decide who should be able to see it. Anyone with a regular capture’s link can view it. Read how Private Capture works before choosing a storage route for privileged or confidential material.
This guide is general information, not legal advice for a specific matter. Access rights, preservation obligations, and admissibility depend on the facts and jurisdiction.