The post that decides your case is sitting on an account the other side controls. Deleting it takes four seconds and notifies nobody. Most investigators find that post, screenshot it, drop the image into a report, and move on.
The report holds up right until someone contests it. Then the question stops being what the post said and becomes how you know it said that.
The material you need is under the other side’s control
Public records sit still. A Florida corporate filing from 2019 will be there in 2029, in the same form, on a server nobody in your matter administers. Online material behaves differently. A LinkedIn position, an X post, a company blog entry, a Google review, a Facebook comment: each of those lives on an account, and the account holder has an edit button and a delete button.
So the clock on that material is not the statute of limitations. It is the moment your subject learns someone is looking.
Most matters generate that moment early. A demand letter goes out. A former employee hears from a colleague that HR pulled a file. A vendor gets a call asking about an invoice. Nobody has to be sophisticated to react. They only have to be nervous, and a nervous person tidies up a profile. Even a subject who goes quiet usually cleans the front door first.
Deletion is not the only way material disappears
Removal is the obvious failure. It is also the least common one.
Accounts flip from public to private, and the post still exists while your access does not. A LinkedIn headline gets rewritten with no public version history. An X handle changes, every permalink you saved returns a 404, and the post itself stays live under a new URL. Instagram stories expire in 24 hours by design. A Slack workspace on a paid plan can be configured to delete messages older than 90 days, and that deletion is a scheduled job, not a decision anyone makes about your case.
Then there is ordinary decay. Link rot destroys material nobody intended to destroy. A company rebuilds its site, drops the old blog, and four years of public statements by an executive vanish because a CMS migration did not preserve URLs. That gap is why adverse media screening so often returns a thin file on a subject who has been talking in public for a decade.
None of that requires bad faith. All of it costs you the same exhibit.
A screenshot proves you saw something, not that it existed
A screenshot is not evidence. It is a picture of a claim, and the claim is yours.
An image file records pixels. It does not record the URL those pixels came from, the server that answered the request, the time of the request, or whether the browser was showing a live page or a locally edited copy of one. Anyone with fifteen minutes and a browser’s developer tools can produce a convincing screenshot of a post that never existed. Opposing counsel knows that. They do not have to prove your exhibit is fabricated. They have to make the judge uncertain, and uncertainty is cheap to manufacture when the exhibit is a JPEG.
A capture that survives a challenge records more than the picture:
- The full URL, query string included, not a cropped address bar
- The page source as delivered, not as rendered
- The HTTP status code and response headers
- A cryptographic hash of the capture, computed at capture time
- A timestamp from a clock you do not administer
- The name of the operator and the method used
Tools do this without much ceremony. Hunchly runs in the background of a browsing session and hashes every page you touch, at roughly $130 a year. WebPreserver targets social platforms specifically. At a command line, wget --warc-file writes a WARC archive, the same container format the Internet Archive uses, and sha256sum on that file gives you a fingerprint you can swear to under oath. The expensive part was never the software.
The timestamp has to come from a clock you do not control
Careful captures fall apart right here. The investigator hashes the file, logs the URL, writes a clean method note, and stamps the whole thing with the time on the workstation. That workstation belongs to the investigator. The investigator works for one side.
Two fixes, both cheap. Submit the hash to an RFC 3161 timestamp authority, which returns a signed token binding your hash to a time you did not set; FreeTSA does it at no cost. Or push the URL through the Internet Archive’s Save Page Now, which creates an independent snapshot dated on infrastructure neither party runs. Treat the archive snapshot as corroboration rather than the exhibit itself, which is a different job and usually the more useful one.
Capture before you send the preservation letter
Counsel sends litigation holds because the rules require it. The letter is also notice, and notice is exactly what triggers the cleanup you were worried about.
Sequence solves that. Capture the public-facing material first, completely, using the method above. Then send the letter. The order costs nothing and changes what you hold if the material later disappears: an artifact and a documented before-state, instead of an argument about what used to be there. It is the same timing logic that makes asset tracing work better before the lawsuit than after the judgment.
Waiting and relying on spoliation as the remedy is the alternative, and it is a bad bet. Federal Rule of Civil Procedure 37(e), as amended in December 2015, gives a court remedies for lost electronically stored information only where the information should have been preserved in anticipation of litigation, reasonable steps were not taken to preserve it, and it cannot be restored or replaced from another source. The severe sanctions, an adverse-inference instruction or dismissal, require a finding that the party acted with intent to deprive the other side of the information. Proving someone’s state of mind is slower and harder than running a capture, and you only get to attempt it after the exhibit is already gone.
When the material is already gone, work backward
Sometimes you inherit the problem. The post was up in March, the engagement started in July, and nobody captured anything.
Start with the Internet Archive, then archive.today, which crawls on user request and often holds pages the Wayback Machine missed. Do not reach for Google’s cache: Google retired cached links in September 2024 and closed a path investigators had used for two decades. What remains is the copy someone else made. Deleted posts survive in replies that quote them, in screenshots posted by people arguing with the author, in Reddit and news aggregator threads, in newsletter archives that mailed the text before it came down.
Those secondhand copies are weaker, and they are worth having anyway. A quoted reply from a third party with its own timestamp is a corroborating record, and a corroborating record is the thing that makes a subject stop arguing that the post never existed.
Not every post deserves this treatment
Capturing everything at forensic grade turns a two-day assignment into a two-week one. The test is exposure. If the material could end up as an exhibit, in a deposition, or in a report a regulator reads, capture it properly. If it is background that shapes your understanding and will never be quoted, a screenshot in a working file is fine.
The mistake is deciding that later. By the time a piece of background turns out to matter, the account is private and the post is gone. When you are unsure, capture properly, because the marginal cost is about ninety seconds and the cost of guessing wrong is the exhibit itself. The same discipline applies to how you write it up, which is why the report gets written for the deposition rather than for the client.
Run this test on a file you already closed
Pull a matter where an online post made it into the report. Find the person who captured it and ask three questions. What was the full URL, including everything after the question mark? What was the hash of the capture file, and when was it computed? What clock produced the timestamp in the exhibit?
Three answers, and your process holds. One answer, and you have exhibits that stand exactly as long as nobody pushes on them. The difference shows up on the day it costs you.
Farsight Intelligence does corporate intelligence and investigative work for attorneys, executives, and compliance officers who need to know what is actually there before they decide. If you are working a matter where the record lives online and the other side owns the account, the work starts before the letter goes out. Reach me at [email protected], book time at meet.brettfl.com, or start at brettfl.com.
Capture before you ask.