346-200-6097
When the Claim and the Timeline Don't Match
A plaintiff claims a debilitating back injury, files suit, and six weeks later posts a video from a friend's wedding, dancing without a limp. Defense counsel and adjusters see this pattern constantly, and it's usually more complicated than "there's a video, let's use it."
A screenshot of a social media post is not evidence on its own. It's a lead. Opposing counsel routinely moves to exclude screenshots as edited, mistimed, or taken out of context, and a judge will often agree if there's nothing behind the image but a phone camera and a printout. Social media forensics is the process that turns a suspicious post into something that survives a motion to exclude and holds up in front of a jury.
Why a Screenshot Doesn't Cut It
Under the Federal Rules of Evidence, digital evidence has to be authenticated before it's admitted, meaning someone has to establish it is what it's claimed to be (FRE 901). A screenshot, by itself, only shows what rendered on a screen at one moment. It doesn't show:
- The original posting timestamp in the platform's own records, as opposed to whatever timestamp a screen displays
- Whether the post was edited after it went up (most platforms log edit history internally even when it's not visible to the public)
- The account's activity pattern before and after, which matters for showing the post wasn't a one-off
- Geolocation or device metadata embedded in the original photo or video file
Courts have increasingly accepted certified electronic records under FRE 902(13) and 902(14), which allow self-authenticating digital evidence when it comes with a certification from a qualified person describing the system or process that produced it. That's the standard a forensic collection is built to meet. A phone screenshot isn't.
How a Forensic Social Media Collection Actually Works
- Digital footprint mapping. Before collecting anything, the examiner identifies every account tied to the plaintiff, including maiden names, nicknames, business accounts, and accounts where the plaintiff is tagged by friends or family rather than posting directly. A lot of useful evidence lives in other people's accounts.
- Preservation urgency assessment. Counsel and the examiner evaluate how likely the plaintiff is to lock down, delete, or make an account private once litigation heats up, and prioritize collection accordingly.
- Forensic capture, not screenshotting. Purpose-built collection tools capture the full underlying page source (the HTML/DOM), not just what's visually rendered, along with platform metadata such as post IDs, timestamps in UTC before conversion to local time, and any available edit history.
- Metadata extraction. For photos and video specifically, embedded EXIF or file metadata (camera or device model, GPS coordinates if the platform hasn't stripped them, original capture timestamp) gets pulled and preserved separately from the compressed version the platform displays.
- Hash verification. Every captured file is run through a cryptographic hash function (typically SHA-256) at the moment of collection. That hash value becomes a fingerprint. If the file is ever altered afterward, even by one pixel, the hash changes, which is how the examiner proves in court that what's being shown at trial is exactly what was collected.
- Chain of custody documentation. Who collected the evidence, when, using what tool and method, and where it has been stored since, all gets logged. This is what lets the examiner testify to the collection process if it's challenged.
- Cross-referencing against the claim. The examiner lines up post dates, activity levels, and location data against the plaintiff's own testimony, medical records, and claimed limitations, looking for inconsistencies worth flagging for counsel.
- Expert report and deposition prep. Findings go into a report written for a legal audience, and the examiner prepares to testify to methodology if opposing counsel challenges authenticity or the collection process itself.
A Real Limitation Worth Knowing: The Stored Communications Act
Defense counsel sometimes assume they can subpoena Facebook or Instagram directly for a plaintiff's private content. Generally, they can't. The Stored Communications Act restricts platforms from disclosing the content of private communications and non-public posts directly to civil litigants, even under subpoena, absent the account holder's consent or a narrow exception. In practice, this means the more reliable path is often collecting what's publicly visible or accessible through a properly scoped discovery request compelling the plaintiff to produce or authorize access to their own account data, not a subpoena to the platform itself. A forensic examiner can advise counsel on which path applies to a given account's privacy settings.
Posts Disappear Faster Than Litigation Moves
Plaintiffs and their counsel often lock down social accounts once litigation starts. If defense counsel wait for written discovery to request account information, the useful posts may already be gone, and platforms typically don't retain deleted content indefinitely for later production. Early forensic preservation, ideally as soon as a claim looks disputed, protects that evidence before an account goes private or a post gets removed.
Beyond the Obvious Post
The most valuable evidence isn't always the one dramatic photo. Fitness app activity synced to a public profile, photos where the plaintiff is tagged by someone else's account, location check-ins, and even content that's been deleted but was cached, indexed, or reshared elsewhere can build a fuller picture of what a plaintiff was actually capable of during the claimed injury period.
What to Build Into Discovery and Deposition
A few specific asks tend to pay off in these cases:
- Request the plaintiff's full list of social media accounts and handles in written discovery, including any accounts under a maiden name, nickname, or business name, not just the obvious profile.
- Ask, at deposition, whether the plaintiff has deleted, deactivated, or changed the privacy settings on any account since the incident, and when specifically.
- Send a preservation letter to plaintiff's counsel early, putting them on notice that social media activity is potentially relevant and must be preserved. This also sets up a stronger spoliation argument later if accounts get scrubbed anyway.
- Ask the plaintiff directly, on the record, to identify every device and account used to access social media during the claimed injury period. That answer opens the door to requesting device-level forensic collection if the activity looks inconsistent with the claim.
Mistakes That Undercut This Evidence
- Relying on a paralegal's screenshot instead of a forensic capture. It might be enough to open settlement talks, but it usually won't survive a motion in limine.
- Waiting until the eve of trial. By then, plaintiff's counsel has likely already advised the client to lock down accounts, and the window for meaningful collection has closed.
- Treating one post as the whole case. A single photo is easy for plaintiff's counsel to explain away as "a good day." A documented pattern across weeks or months is much harder to dismiss.
- Failing to connect the evidence back to the specific claimed limitation. A post showing the plaintiff walking doesn't carry much weight unless it's tied directly to a claim that they can't walk without assistance.
About Black Dog Forensics
Black Dog Forensics provides digital forensic and expert witness services nationwide, including social media and cloud account preservation, metadata analysis, and forensic collection built to withstand scrutiny in civil litigation. The firm works with insurance defense counsel and corporate litigation teams building or challenging digital evidence in personal injury and liability cases.
Call to Action: Have a claim where the plaintiff's own online activity might not match the story? Work with our team.
