Social media forensics is the branch of digital forensics concerned with identifying, collecting, preserving, and analyzing evidence from social networking platforms such as Facebook, Instagram, X (Twitter), Telegram, WhatsApp, Snapchat, and TikTok. As criminal activity increasingly moves online — cyberstalking, fraud, radicalization, defamation, and organized crime coordination — social media artifacts have become central to modern investigations.

Why It Matters

Social media generates vast amounts of user-generated content and metadata: posts, messages, timestamps, geolocation tags, IP login records, and connection graphs. Unlike traditional evidence, this data is often stored on third-party servers (sometimes outside national jurisdiction), is highly volatile (users can delete content instantly), and requires cooperation from platform providers for lawful acquisition.

Categories of Evidence

• Content evidence: posts, photos, videos, comments, direct messages
• Metadata evidence: timestamps, device info, EXIF data, IP addresses used at login
• Relational evidence: friend/follower lists, group memberships, interaction patterns
• Behavioral evidence: posting frequency, language patterns, location check-ins over time

An investigator must understand each platform's data retention policy, API access model, and law enforcement request process before initiating any collection.