Screenshots and posts are the first things most clients give to a private investigator. Social media can provide us with lots of clues, timelines and evidence, but if we gather them incorrectly we can actually make the case worse. This guide deconstructs what generally works in North Carolina, what seems to hurt, and how a licensed PI can make those random posts work as evidence.

What usually helps

• Clear attribution. Use the account handle, and profile pic and any unique identifiers – don’t just use a cropped image.
• Dates and times. Native timestamps (especially with a visible URL on it) will always beat edited screenshots.
• Location signals. Look for check-ins, geotags, recognizable landmarks or repeat patterns within close proximity of the same address.
• Consistency in cross-platform The same thing on Facebook, Instagram, TikTok, etc. increases authenticity.
• Context which is appropriate to the case.
  
  
  • Infidelity – Repetitive overnights, trips, gifts, or pictures of couples.
• • Or as a parent involvement component: “We have observed a rise in school engagement, student achievement, and parental involvement in the school and community.” “We increased student achievement (test scores) by 12% in three months.” “We lowered the absenteeism rate from 40% to 23% in three months.” “We reduced absenteeism by 20%.” “We increased parental engagement in three months by 40% and it has continued ever since.” “We increased parental engagement by 33% at school.” “We increased school attendance by 30%.
    
  • Cohabitation and alimony: Reoccurring overnight presence, shared utilities/deliveries, pets or property in both profiles and regular weekday patterns.
    
    

What often hurts your case

• Manipulated images, partial screenshots Cropping out the URL bar, time or account handle opens up questions of authenticity.
• Illegally obtained content. Sneaking into private accounts without permission, guessing passwords or using hidden cameras can make the evidence you have unusable and put you in legal trouble.
• Harassment or fake profiles. Pretending to be different people or tricking a subject into posting can have the appearance of entrapment.
• Single, unverified posts. A vague meme seldom brings anything about – patterns and confirmation do.

Screenshots vs. verified capture

Screenshots are a starting point, not the finish line For the evidence you can count on look for:

• Page definition: “Sites with page level capture, including post in its entirety, profile header, url, and native timestamp.”
• Logging or hashing the export of logs that indicate when every piece was captured and by whom.
• A chain of custody for original file retention. Keep the original files, do not just save a compressed version from the gallery in the phone.
• Readable exports for counsel, including, for example, readable PDF with visible metadata and linked source files.
  
  

Corroboration, how investigators post to proof

A PI creates a timeline, and then tests it in the real world. Typical steps include:

1. Map out dates from posts and stories, and compare to phone calls, receipts and known schedules.
2. Perform legal surveillance to confirm patterns to which the posts point – vehicles present overnight or repeated visits on weekdays, for example.
3. Capture neutral reference points–street numbers, business signs, parking rules–to anchor each observation.
4. Write a clear report that pairs the capture of social media and observations in the field by photos and time logs.
   
   

Legal and Privacy boundaries, Keep it clean

Laws are subject to change and may be case specific. General rules of thumb:

• Fair Use: One reason why this law is important is that it will help reduce the amount of censorship that is occurring. Try not to circumvent privacy settings or technical barriers.
• Don’t use a login, shared credentials or password reset tricks of someone else to enter private messages.
• Don’t go to private groups posing as something else.
• As a general rule, if you’re unsure, consider speaking with counsel before gathering sensitive information or contacting a subject. Your PI can work with your attorney to ensure that the collection is legal and admissible.

Working with your attorney

Attorneys frequently send preservation letters requesting platforms or parties in an opposition not to delete content. In certain areas, counsel might seek discovery or subpoenas of account records. Your PI’s job is to preserve what’s out there publicly, and accurately document it, and be able to provide a report that fits into your legal strategy.

Cost, timetable and expectations

• Time. Social media capture and verification can be fast if the posts are public and slower if you need a pattern over many dates.
• Scope. Expect several hours to capture and organize, as well as additional time if you need to conduct surveillance or interviews.
• Results. The best files are a mix of online captures and real world observations. Individual posts cannot often make a case.
  
  

Short case vignette

A client believed there was continued infidelity. Their screenshots included late-night selfies with location tags at the same apartment complex on weekdays. We did page level captures with visible URLs and timestamps then scheduled surveillance consistent with these nights. Over the course of three weeks we recorded the subject’s vehicle arriving on several weeknights, staying past midnight, and leaving before work. Photos had building numbers and other references for scale. The final report matched each social capture with field observations, for a consistent and credible timeline for counsel.

Client checklist

• Bring original files and links, and not just cropped screenshots.
• Don’t get in touch with the subject regarding the posts.
• Don’t attempt to get private messages or passwords.
• List dates, locations and any witnesses or receipts that tie in with the posts.
• Share the contact details of your attorney so that reporting is an extension of the legal plan.
  
  

Frequently asked questions

Can deleted posts be recovered?
Sometimes. If you or your PI have made a capture of the post before it was deleted, that capture can be used. There may be retention policies at a platform, so letters of preservation from a counsel can be helpful.

Are private group posts/DMs usable?
Only if obtained lawfully. Unauthorized access poses a risk. Consult with counsel regarding lawful modes of discovery.

What is the minimum amount of social media evidence?
Patterns are more important than one post of a viral. Multiple posts that correlate with surveillance or third party records are persuasive.

Will it be announced to the other side?
Collecting public posts will not send a notification to account holder. Legal requests through counsel may have a notification trigger depending on the platform and type of request.

Do likes or comments help?
They can display relationships, and timing but are usually supporting details. Direct posts, photos, check in’s and corroboration in the real world are more powerful.