MODLAN INTELLIGENCE RESOURCE · GUIDE
Chain of Custody for Social Media Evidence
A practical public-safe overview of source documentation, acquisition integrity, transfers, retention, and witness continuity for dynamic online evidence.
Online content is volatile
Posts can be edited, deleted, restricted, reshared, or resurfaced. Preservation therefore needs a documented acquisition time and may require repeat acquisition where volatility is material.
Custody begins with the examiner
The acquisition record should identify who performed the capture, when it occurred, the source path, the collection method, the resulting artifacts, and the integrity references created at acquisition.
Every transfer should remain reconstructable
A defensible custody record documents material movement, authorized access, retention, derivative creation, and controlled handoff rather than relying on an investigator's memory months later.
Preserve originals and separate analysis
Original acquired material should remain distinct from annotations, summaries, crops, extracts, or investigative analysis so later reviewers can distinguish the source artifact from the interpretation.