MODLAN · ADVANCED SOCIAL MEDIA INVESTIGATIONS
Turn public digital signals into defensible investigative intelligence.
MODLAN combines lawful public-source research with evidence-grade acquisition, graded attribution, chronology and relationship analysis, media-integrity escalation, custody, and examiner support—so the social-media investigation can survive scrutiny long after the browser tab is gone.
PUBLIC-SOURCE ONLYNo private-profile access or pretextingHASH AT ACQUISITIONCollection and individual-artifact integrityGRADED ATTRIBUTIONIndicia + falsifiers, never a hidden binaryEXAMINER-BACKEDA human prepared to explain the work
SYNTHETIC CONCEPT VISUALSOCIAL EVIDENCE INTELLIGENCENo claimant, carrier or production data shown
VISUAL INTELLIGENCE MODES
One investigation. Multiple ways to see the evidence.
These MODLAN-generated concept views are synthetic. They illustrate different investigative perspectives without displaying claimant, carrier or production information.
SOCIAL EVIDENCE VISUAL SYSTEM
See the investigation as a connected intelligence problem.
These illustrations are synthetic MODLAN concept art. They do not depict real claimants, clients, source records, or production data.
SOURCE UNIVERSE
Hundreds of potential public-source surfaces. One matter-specific plan.
There is no defensible industry-wide “average number of searches.” MODLAN therefore does not promise a fixed number per matter. The source universe can span hundreds of potential search surfaces, while the actual collection is rightsized to the authorized investigative question, jurisdiction and facts.
Public profiles, posts, comments, public groups, public channels and community discussion surfaces.
Professional profiles, employer pages, job boards, public resumes, biographies and career-history signals.
Public reviews, ratings, complaints, testimonials, forums and reputation surfaces tied to people, businesses or events.
Public marketplace listings, seller pages, storefronts, product activity and other openly available commercial signals.
News, press releases, blogs, websites, cached pages, web archives and indexed public documents.
Corporate sites, public registrations, professional directories, association pages and organization-linked records.
Public event pages, venue information, geospatial context, public location references and time-linked activity.
Public images, video, audio, documents and metadata routed for preservation or provenance review when material.
Breadth is not a substitute for relevance. A source is searched because it can answer the matter question—not because a marketing counter needs to increase.
MODLAN-DEVELOPED EDGE AGENTS
Automation expands reach. Investigator judgment controls the finding.
MODLAN combines commercial and open-source investigative capabilities with internally developed edge agents. Public materials describe what those agents help accomplish—not protected orchestration, correlation logic, thresholds, scoring or unpublished implementation.
DISCOVERNORMALIZEROUTEPRESERVEREVIEW
Discovery orchestration
MODLAN-developed edge agents can coordinate repeatable public-source discovery tasks, normalize task context and route responsive artifacts for investigator review.
Entity pivoting
Public identifiers can be used as controlled pivots across approved source families while preserving the distinction between a lead and an attributed finding.
Collection handoff
Responsive public content can be routed into documented capture, hashing, preservation and custody workflows instead of remaining an ephemeral browser result.
Timeline assembly
Signals can be organized around event date, publication date, resurfacing and acquisition date so chronology remains visible to the reviewer.
Relationship context
Public associations can be organized as reviewable investigative context without converting proximity or association into culpability.
Human adjudication
Automation assists collection and organization. A qualified investigator remains responsible for relevance, attribution, limitations and reporting.
WHY MODLAN BUILT THIS DIFFERENTLY
Discovery is only the opening move.
Finding a public post is useful. An insurance investigation needs more: source context, time context, attribution, preservation, integrity, limitations, custody, and a reviewer who can explain what the evidence does—and does not—establish.
DISCOVERCAPTUREAUTHENTICATEATTRIBUTECONTEXTUALIZEPRESERVETESTIFY
THE EVIDENTIARY PROBLEM
What looks simple in a browser becomes difficult under challenge.
MODLAN separates discovery, capture, attribution, context, and evidentiary integrity so a useful lead does not silently become an unsupported conclusion.
A screenshot is not an acquisition
Most social media evidence arrives as an image pasted into a report, with no hash, no URL chain, no capture record and no one willing to authenticate it. It is useful for triage and fragile under challenge. The gap only appears once the file is contested, which is exactly when it matters.
Finding it and preserving it are two different disciplines
Research locates content. Forensic acquisition preserves it in a form that can be verified later. Work that treats these as one step tends to do the first well and the second not at all, and the handoff between them is where defensibility usually breaks.
Attribution is where claim decisions fail
The hard question is rarely whether a post exists. It is whether the account belongs to the subject, when the content was actually created, and whether a photograph of an activity establishes capability on a particular date. A finding that skips those questions will not survive the first cross-examination.
How it was collected determines whether you can use it
Collection method decides legal exposure, and exposure transfers to the party relying on the work. We disclose our method so that decision is yours to evaluate rather than ours to withhold.
ADVANCED INVESTIGATIVE INTELLIGENCE
More than a profile search.
MODLAN develops a public-source intelligence record around identity, chronology, relationships, activity, media, corroboration, and evidence integrity—then carries material findings into preservation and review.
Identity + attribution
Resolve public accounts with graded confidence, stated indicia, alternative-subject testing, and explicit falsifiers rather than a binary match.
Chronology + context
Separate event date, content-creation date, publication date, resurfacing or reposting, and acquisition date so old content is not treated as current activity.
Relationship intelligence
Map publicly observable people, organizations, vehicles, locations, events, and recurring associations into reviewable matter context without treating association as culpability.
Activity + capability
Describe the activity actually visible and distinguish it from unsupported conclusions about duration, unrestricted function, symptoms, causation, or claim validity.
Media + provenance
Escalate material images, video, audio, documents, or other artifacts into MODLAN provenance and media-integrity workflows when authenticity or manipulation becomes relevant.
Preservation + volatility
Prioritize dynamic or deletion-prone content, preserve source context, repeat acquisition when justified, and retain deltas between captures as evidence.
Cross-source corroboration
Test a working theory against independently sourced public or matter-authorized records instead of using one source to validate itself.
Negative + exculpatory findings
Document searches that produced no responsive material and report claim-supporting findings with the same rigor as findings that may contradict an allegation.
INTERACTIVE METHODOLOGY MAP
Explore a synthetic evidence-intelligence graph.
The map illustrates how subject, account, relationship, event and artifact context can be examined without representing any node as a conclusion by itself.
LIVE METHODOLOGY VIEWSOCIAL EVIDENCE INTELLIGENCE
THE QUESTIONS THAT MATTER
Research should resolve uncertainty—not manufacture certainty.
Each engagement is scoped around matter-specific investigative questions. Findings are separated from inference, and unanswered questions remain unanswered.
- 01
Does the public-source footprint materially clarify identity, chronology, relationships, location, or activity?
- 02
Can a material account be attributed with enough support to justify investigative use—and what facts would weaken that attribution?
- 03
Is apparently current content actually contemporaneous, or is it older material resurfacing later?
- 04
Does the content show an observable activity, or is someone inferring a capability the evidence does not establish?
- 05
Is a material image, video, audio clip, or document authentic enough to rely upon without additional provenance or manipulation review?
- 06
Which findings should inform field surveillance, interview planning, subrogation development, litigation strategy, or further evidence preservation?
THE EVIDENTIARY CHAIN
Five stages. One custody record. A witness at the end.
Most social media work performs the first stage and stops. Select a stage to see what it produces and where it stops.
STAGE 01 · DISCOVER
Find what is publicly there — and record what is not.
Research across publicly accessible sources, performed without logging in to any account. The search itself is documented: sources examined, terms used, date and time, and the examiner who ran it. A negative result is a documented result, because a search that found nothing is itself a finding a file may need.
- Documented search record
- Source inventory
- Examiner attribution
- Documented negative findings
DATE + CONTEXT INTELLIGENCE
A post date is not necessarily an event date.
MODLAN separates the chronology surrounding digital content so an old photograph, repost, resurfaced memory, or later capture is not silently treated as contemporaneous evidence.
When did the depicted activity actually occur?
The evidentiary question begins with the real-world event, not with when a platform later displayed it.
ACQUISITION STANDARD
SWGDE 21-F-001-1.1 — Best Practices for Acquiring Online Content
NIST OSAC Registry. Our acquisition SOP implements this published online-content acquisition standard. We describe the method and evidence controls accurately; we do not describe MODLAN as SWGDE-certified, OSAC-certified, or NIST-certified.
Platform-supported interfaces
Where one lawfully exists, it returns records and metadata that are not visible on a rendered page.
Documented browser-based acquisition
Performed from a sanitized, documented environment with the configuration recorded.
Screen capture
Used to supplement an acquisition, never as the acquisition. URL, date and time are visible in frame.
- Full untruncated URL chain, including protocol, domain, subdomains and path
- Capture date and time with local time zone and UTC offset
- Access address, browser and user-agent string
- Examiner identity, tool and tool version, capture host configuration
- Domain registration detail and archival history where applicable
- Extended image-format metadata, preserved rather than stripped
- Hash computed at acquisition over the whole collection and each individual file
- Native form, format and language preserved — no reformatting, no translation in the evidence layer
- Packaged into a forensically sound archive recording examiner, acquisition time and description
- Contemporaneous examiner notes and a custody log recording every transfer
- Write-once storage with access logging
INVESTIGATIVE DOCTRINE
Six distinctions protect the integrity of the file.
These are not slogans. They are review boundaries intended to keep a public-source finding from becoming more certain than the evidence supports.
AUTHENTICATION FRAMEWORK
Integrity and authorship remain separate questions.
Capture documentation is prepared to support authentication of the acquisition process under Federal Rule of Evidence 901(b)(9) and, where applicable, certification procedures under Rule 902(13).
Hash-verification documentation is prepared to support certification of a copied digital record under Rule 902(14), where applicable.
Those procedures concern the capture process and copy integrity; they do not establish authorship, relevance, hearsay status, or admissibility, and applicable notice and case-specific requirements remain separate.
- Investigative report with findings stated separately from analysis
- Capture certificate executed by the examiner who performed the acquisition
- Hash verification record for the collection and each individual file
- Native-format evidence package with live links disabled
- Capture video with timed stills for dynamic content
ATTRIBUTION DISCIPLINE
Finding the account is not proving the account.
Identity is evaluated from multiple non-biometric indicia and reported with uncertainty intact. The same analysis records what could disprove the working attribution.
Account-control indicia
Publicly observable self-identification, account history, stable handles, and other non-biometric signals tied to account control.
CONFIRMEDPROBABLEPOSSIBLEUNRESOLVED
The final grade depends on the matter-specific record. This visual describes the methodology; it is not an automated identity score.ATTRIBUTION CONFIDENCE
We grade the identification. We do not hide uncertainty.
Each attribution states the supporting indicia and what would falsify it. Misattribution is treated as a material investigative risk.
Account control is established by direct, documented indicia.
Self-identifying content corroborated against independently sourced records, or an admission.Multiple independent indicia align and no contrary indicator is present.
Handle consistency, associated named parties, and posting-pattern alignment across sources.Indicia are consistent but thin, or a plausible alternative subject exists.
Common name, limited self-identifying content, or a single corroborating signal.The account cannot be attributed on available public information.
Reported as unresolved. We do not close the gap with inference.A photograph of an activity is not proof of unrestricted function on a given date. Reports distinguish original-post date from capture date, identify reposted or resurfaced material where apparent, and separate observed activity from inferred capability.
RELATIONSHIP + EVIDENCE CONTEXT
The finding becomes useful when it connects to the matter.
Public-source intelligence can develop relationships, objects, chronology, and evidentiary leads. MODLAN keeps source attribution and confidence attached as that context moves into the broader investigation.
Subject
The person or entity whose lawful public-source footprint is being evaluated.
Illustrative synthetic topology. No real claimant, account, carrier, or matter data is shown.INSURANCE + LITIGATION APPLICATIONS
Built for the next investigative decision.
The work product is designed to inform proportionate follow-up—not to replace adjuster, SIU, counsel, or expert judgment.
SIU referral development
Develop public-source identity, chronology, relationship, and activity context before deciding what additional investigation is proportionate and useful.
Surveillance planning
Use lawful public information to refine timing, locations, vehicles, routines, public events, or other planning context without representing the intelligence as proof of future activity.
Workers’ compensation
Evaluate public activity with date-and-context rigor while preserving the distinction between an observed act and functional capability.
Liability + injury
Develop chronology, witnesses, relationships, public statements, media, and event context that may support or challenge specific factual assertions.
Subrogation
Identify public relationships, entities, products, vehicles, locations, or events that may support responsible-party and recovery development.
Litigation support
Preserve volatile material, document acquisition, support attribution analysis, and maintain an examiner who can explain the work when challenged.
THE EVIDENCE DOSSIER
Every material finding carries its own record.
The deliverable is structured so another investigator, carrier reviewer, counsel, or examiner can understand what was searched, what was captured, what changed, what was inferred, and what remains unproven.
Discovery record
Sources examined, search date and time, examiner, scope, responsive findings, and documented negative findings.
Acquisition record
Source path, acquisition environment, method, timestamps, native or documented capture, and supporting examiner notes.
Integrity record
Cryptographic digests for the collection and individual artifacts with later verification events recorded separately.
Attribution analysis
Confidence grade, supporting indicia, alternative-subject considerations, and specific facts that could weaken the attribution.
Context analysis
Event date, creation/publication timing, repost or resurfacing indicators, activity-versus-capability limits, and material chronology.
Custody record
Transfer, storage, access, derivative creation, and release events for preserved evidence.
Authentication support
Capture-process and copy-integrity documentation prepared for matter-specific authentication and certification procedures where applicable.
Examiner support
A qualified human available to explain discovery, acquisition, integrity controls, attribution reasoning, limitations, and the contents of the investigative record.
BUYER PATHWAYS
One evidentiary method. Different operating questions.
The canonical service stays in one place. Buyer pathways frame the same capability around the work SIU, counsel, workers’ compensation, and subrogation teams actually need.
SIUReferral intelligence
Develop lawful public-source context, preserve material findings, document negative findings, and route defensible evidence into the SIU file.
Explore pathway →COUNSELChallenge-ready acquisitionPreserve public digital material with method, integrity, attribution analysis, custody, and an examiner available to explain the work.
Explore pathway →WORKERS’ COMPActivity in contextEvaluate publicly observed activity without converting one photograph or post into an unsupported conclusion about unrestricted capability.
Explore pathway →SUBROGATIONRelationship + event developmentDevelop public-source relationships, chronology, entities, and digital artifacts that may support recovery-oriented investigation.
Explore pathway →SOCIAL EVIDENCE INTELLIGENCE
Go deeper than the service page.
Original public-safe resources explain the evidentiary questions behind advanced social media investigations without exposing protected CST implementation or confidential operating details.
PROTECTED EVIDENCE INTELLIGENCE
Market the result. Protect the invention.
Findings terminate in an evidence-authentication layer that is the subject of a pending patent application. Public materials describe what that layer produces and the boundaries it operates within. Method, logic and implementation are not published.
WHAT YOU RECEIVE
A record built to be examined.
The investigation is delivered as an evidentiary record rather than a collection of browser screenshots. Each material finding remains connected to its source, acquisition context, integrity record, attribution analysis, limitations, and custody history.
- Investigative report with findings stated separately from analysis
- Capture certificate executed by the examiner who performed the acquisition
- Hash verification record for the collection and each individual file
- Native-format evidence package with live links disabled
- Capture video with timed stills for dynamic content
- Documented search record, including sources examined and negative findings
- Graded attribution with supporting indicia and stated falsifiers
- Custody log recording every transfer
- Technical appendix describing method, configuration and validation
- Examiner availability for declaration, deposition and testimony
MODLAN STANDARDS
How we work
These apply to every engagement, in every jurisdiction.
- Recorded consent, everywhereWe obtain recorded consent from every party to every recorded statement, in every jurisdiction, regardless of which state rule applies.
- Lawful vantageObservation is conducted from publicly accessible vantage points. We do not enter private property, observe into areas where privacy is reasonably expected, or place concealed or unattended recording devices.
- No pretextInvestigators identify themselves where identification is appropriate. We do not use fictitious identities, misrepresent our purpose, or obtain information under false pretences.
- Documented permissible useInformation from restricted sources is accessed only for the permitted purpose of the matter it was obtained for, and that purpose is documented for every search.
- Represented partiesWhere a party is represented, we proceed only on documented instruction from counsel.
- Aerial for property, not peopleAerial documentation is used for property, scene, and loss documentation. We do not use aircraft to observe individuals.
- Public sources, unauthenticatedDigital collection is performed from publicly accessible sources without logging in to any account.
WHAT WE DO NOT DO
- Create, use or borrow an account under any identity other than a disclosed MODLAN examiner account.
- Send a friend, follow or connection request to a subject, or message a subject.
- Join a closed or private group, or access content behind a privacy setting, block or paywall.
- Run facial recognition against social media imagery absent a documented jurisdictional authorization.
- Represent an identification as confirmed where the supporting indicia establish less.
- Obtain information under a false identity or false pretences.
- Enter private property or observe into areas where privacy is reasonably expected.
- Contact a represented party except on documented instruction from counsel.
- Guarantee that any item will be admitted by a court.
SCOPE BOUNDARY
Claims-validity and matter-specific use only.
Reports are furnished solely to support the investigation and determination of insurance claim validity, or to support counsel in a specific matter.
- Underwriting, rating, renewal, non-renewal or continued-eligibility decisions
- Employment, tenancy or credit decisions
- Pre-employment screening or producer vetting
- Any purpose that would make the report a consumer report
For claim-validity-only engagements, MODLAN structures the service on the longstanding FTC staff interpretation addressing reports furnished solely to determine the validity of insurance claims. That is not a blanket statement that the FCRA can never apply. Any different intended use requires separate review before the matter is accepted.
YOUR GUIDELINESScope, coverage, reporting format, documentation requirements, and turnaround are performed to your guidelines and the assignment instructions for each matter. Requirements differ by carrier and by jurisdiction, and we work to yours.
QUESTIONS CARRIERS AND COUNSEL ASK
The issues that decide the engagement.
Can you access private or restricted accounts?
No, and we will not accept an assignment on that basis. Collection is limited to what a logged-out, general-public viewer can see. We do not use assumed identities, send connection requests, join closed groups, or work around a privacy setting. This limit is not waivable by client instruction — an investigator who misrepresents themselves to a platform is impeachable in every later matter, and the exposure transfers to the party relying on the work.
Is the evidence admissible?
Admissibility is the court's determination, and no investigator can promise it. What we can do is acquire and document the material so that it is positioned to be authenticated: a documented method, a hash computed at acquisition, a complete capture record, and an examiner who will testify to all of it. Hearsay, relevance and other objections are separate questions that remain open regardless of how well the capture was performed.
Does the capture certificate prove who posted the content?
No. This distinction matters more than any other in the discipline. The certificate establishes that our copy is an accurate copy of what we retrieved, from the location and at the time recorded. Authorship is a separate question, addressed through a graded attribution analysis with its supporting indicia stated and its falsifiers stated. Anyone who tells you a certificate settles authorship is describing something the certificate does not do.
Why grade attribution instead of just identifying the account?
Because misattribution is the one error in this work that cannot be corrected after a claim decision. A graded finding tells the adjuster or counsel exactly how much weight the identification carries and what would undercut it. A binary identification hides that, and it fails the moment someone asks how it was reached.
How is this different from a social media report we can already buy?
Most social media research ends at a document. Ours ends at an evidentiary record: documented discovery, forensic acquisition, a capture certificate executed by the examiner who performed it, a graded attribution analysis, a custody log, and a witness available to authenticate the work under oath. The research is the beginning of the service, not the whole of it.
Do you use facial recognition to identify accounts?
Not by default, and not at all without a documented jurisdictional authorization for the specific matter. Biometric law varies substantially by state and an occupational licence is not an exemption from it. Identity is resolved from non-biometric indicia, and where facial recognition was not used, the report records that it was not used.
Can we use the report for underwriting or hiring?
No. Reports are furnished solely to support claim-validity investigation or a specific legal matter, and they must not be used for underwriting, rating, renewal, eligibility, employment, tenancy or credit decisions. That boundary is written into the engagement, because a report used for one of those purposes becomes a different kind of record with a different body of law attached to it.
What happens when a finding supports the claim rather than contradicting it?
It goes in the report, with the same rigour as any adverse finding, and the report records that it does. An investigation built to produce one kind of answer is not an investigation, and a file that only documents what hurts the claimant is a liability to the carrier that ordered it.
CONTROLLED INTAKE
Discuss the assignment without transmitting sensitive evidence.
Public consultation channels are for business-purpose intake only. Claim files, medical records, credentials, claimant-identifying data, and evidence belong in an approved secure workflow.