5 Things You Should Know About Social Media

white paper bytes 0 Comments
Apr 02

While the digital age has led to many technological advances and simplified even the most complex tasks, there is a flip side to that coin.  The information universe is now bordering on the infinite.  For the fact-finder, it is a daunting task to identify evidence.  It used to be a simple paper trail to follow.  It then morphed into searching desktop workstations, then laptops, then iPhones and tablets.  Now it is all of the above--plus a cloud-full of social media and storage sites.  The cloud has cracked open a new generation of hotspots to store sensitive data.

What kind of information can be drawn from social media websites?
Social media sites differ with regard to the information that is being shared on the site. Sites such as Facebook and Instagram are primarily used to post photographs, messages, or to hold online conversations.  On the other hand, an employee or competitor is more likely to share confidential or company information using an online storage site such as DropBox or GoogleDrive, which are frequently used by employees to temporarily store documents for use at home.  Further, networking sites like LinkedIn can be used to communicate with prospective employers.

Is it discoverable?
You bet.  The Federal Rules of Civil Procedure clearly include cloud-based websites when defining "electronically stored information" (ESI).  ESI includes "all current and future electronic storage mediums."

What is the first step when evidence is needed from the cloud?
Preserve.  Prolific social media users will typically post several times a day, thus altering information already on the website.  Cloud-based media sites retain discarded data for very short periods of time, if at all.  Add in the fact that users have access away from the office, and you have a strong possibility that the evidence will disappear quickly. Consequently, the request for preservation needs to be quick and expansive.  It is far easier to filter out information than try to piece it together.  If access is delayed or denied, send a formal request for preservation that encompasses both the user and the website host.

What is needed to preserve?
Because social media is continually changing, the need to react comprehensively is vital. As a result, the preservation needs to be complete and defensible.  The website collection needs to include all original source files including images, video, linked files and any other data referenced or linked to the page.  Anything short of a complete image may open the door to the indefensibility of the evidence.  Further, make sure to check each platform's terms of service to determine if any agreement will be breached by the proposed collection.

How is evidence collected and preserved?
Every cloud platform is different and custom-built for its intended use.  As a result, the collection for each site needs its own method that is forensically sound and defensible.  Knowledge of how the sites are structured is imperative.  Not every collection method is acceptable or appropriate for every site.  There are a number of tools and methods available to collect relevant data in any given situation- identifying an experienced expert who can bring the right solution to the table is your best answer.