Fraud Forensics

Ediscovery evidence in Social Media

By JoEllen Marsh, SMI

Special to GRC & Fraud Software Journal

smiCapturing public social media evidence before it’s taken down or made private is vital if you want to use that evidence in court.

Facebook posts, photos, videos, comments on Yelp!  and just about any communication on the public Internet can and has been used to bolster plaintiff and defendant cases, to evaluate a job applicant's fitness for employment, and to investigate a cheating spouse.

Here are examples of the kinds of content our customers have asked us to preserve:

  • Photos of disability claimants scuba diving, dancing or participating in other strenuous activities
  • Tweets and wall posts written about current legal proceedings
  • Instagram photos that show a subject cheating on his or her spouse
  • Facebook comments that exemplify racist opinions
  • Facebook posts that indicate drug or alcohol abuse and reckless behavior.

Once a subject removes something from social media, there's usually nothing anyone can do to recover the post; it generally takes a court order or very cooperative opposing counsel to get the evidence at that point. If the content you want was on Facebook (which is frequently the case), you will likely have a difficult time getting Facebook to hand over the information if you're not law enforcement.

There must be a threshold showing that the requested information is reasonably calculated to lead to the discovery of admissible evidence. Otherwise, the defendant would be allowed to engaged in an evidence fishing expedition in the plaintiff's Facebook account.

Analyze Large Social Media Accounts

SMI’s Exports solution does all of that work for you - you submit a URL and SMI produces a fully searchable, hyperlinked PDF that allows you to delve deeply into a subject’s timeline and highlight everything that’s relevant.

Tip: If you know what you're looking for, tell us when you order an Export so we can highlight incriminating posts and photos.

Another use case is to run a diagnostic Export on your own client's social media. Clients don't always understand their privacy settings or realize that certain social media posts could affect their cases.

You can then better advise them on managing their public online presence and detect weaknesses in the case.

Tip: Remember to be careful when advising clients to hide posts or deactivate social media accounts - spoliation of social media evidence can result in sanctions.

Exports can give you visually appealing documents to take to court. Even if the content is not at risk of disappearing, Exports can still make it easier for you to turn a website into a document that can be printed and shared. For example, business reviews from sites like Yelp! are not generally at risk of disappearing, but they can be difficult to print. SMI's technical team will work to make Exports look as much like the original website as possible.

Monitor Ongoing Cases

Social media habits can be hard to break, and monitoring is most appropriate when subjects have a history of posting personal details to social media multiple times per week. Recently SMI found that a woman in the middle of a disability case continued to post public status updates about her health and results from her doctor’s visits.

Although most subjects eventually realize that social media can be detrimental to their cases, SMI has found that some people figure this out more quickly than others.

Exports can also be used to help print your client's content. Facebook gives you the option to download your own content, but this results in a zip file of multiple, poorly formatted html files that are not hyperlinked and are not easy to read or print. These files also do not indicate whether or not a post is private or public.

Prepare Documents for Court

Exports can also be used to show your side of the case in a positive light. One of SMI’s customers used an Export to print the Facebook timeline of a mother and athlete who had been killed by a drunk driver. The attorney later called to say he had successfully used the Export in court to prove to jurors that the woman had led a full and happy life and would be dearly missed by many of her friends and family.

Understand Your Clients

Because it’s hyperlinked, as long as you are connected to the internet you can click links in the PDF and open them in your browser. This is helpful when you're trying to continue research on the subject’s friends’ profiles, linked videos, group pages, liked businesses, etc.

Anyone who’s tried to analyze a massive Facebook account knows the monotony of endlessly scrolling and repeatedly clicking “view more comments.” Our largest Export to date was more than 2,200 pages; a paralegal or investigator trying to do it themselves would likely have spent several full days sorting through and capturing everything on that Facebook timeline.

Tip: If you are looking to subpoena private or deleted social media information, check out this Social Media Subpoena Guide.

While Exports only contain public information, relevant public posts can be used to subpoena a subject's private content. (Thompkins v. Detroit Metro Airport).

Evidence like this can make or break a case, but it is often only available for a short window of time. It’s important to order an SMI Export as early as possible, before a subject takes steps to deactivate his accounts or hides relevant posts and photos from public view. SMI recently exported a 1,200 page Facebook profile one day before all content was made private.

Monitoring is also recommended for cases in which a subject has received a court order related to social media. In one high profile case a subject was court-ordered not to delete posts from her social media accounts. Though the subject’s accounts were set to private, we were able to compare the numbers of tweets and Instagram posts from week to week to show that she had deleted content.

JoEllen Marsh is product development and operations manager for SMI. She can be reached at


Does your company have a fraud forensics solution we can feature on this page?