Social media evidence tools for investigators: OSINT vs forensic capture

Private investigators, HR and workplace investigators, insurance and fraud teams, and police all collect social media, but for different end uses. A finding that goes into a client report faces a lower bar than a post that will be tendered in court. The tool should match where the evidence is going.

Three kinds of tool

• OSINT capture tools record your research as you go. They are built around the investigation: logging, case notes, link analysis and reports.
• Forensic capture tools preserve specific posts, pages or accounts with hashes, timestamps and metadata, so the material can be shown to be unchanged.
• Device forensics suites examine phones, computers and cloud accounts that have been seized or handed over, under the right legal authority.

Tools by category

OSINT tools: strong for research, so check the evidence trail

Hunchly is designed around the research session. It runs in the background, records the URL, timestamps and hashes of every page you visit, and helps you assemble client- and court-ready reports. That is valuable when you do not yet know what will matter. Its weakness for social media is video: Bellingcat's toolkit notes that it saves video as screenshots rather than video files.

Forensic OSINT covers similar ground with digitally signed PDF captures, comment expansion and video downloads with a signed continuity report. Paliscope Build and Maltego Evidence are aimed at agencies: Paliscope runs on premises, including on air-gapped networks, and Maltego Evidence collects posts in bulk from eight networks and keeps the data on your own system.

Forensic capture: when the content itself is the evidence

When a specific account is central, such as a claimant posting about activities they say they cannot do, or an employee posting about a colleague, preservation matters more than research. Social Media Evidence is built for that on TikTok and Instagram: add a public account by username and it archives every post, Story and comment, hashes each file with SHA-256, records UTC server timestamps and transcribes every video with Whisper. Forensic AI Search then answers questions across transcripts, captions and comments, citing the posts. It does not cover other networks yet and cannot archive private accounts.

For Facebook, X, LinkedIn and websites, Page Vault and WebPreserver are the broader options. Both record SHA-256 hashes; Page Vault adds a staffed collection service and WebPreserver adds digital signatures and live stream recording.

Law enforcement

Police work splits into public content, data held by platforms, and data on devices. Public posts can be captured with any of the tools above. Private messages, deleted content and account records generally need legal process to the platform. In England and Wales, the Crown Prosecution Service's guidance on communications offences says that when a matter is reported, police should make a data retention request to the platform so evidence is secured.

Speed matters for public posts too. A capture made the day a post appears, with a hash and a timestamp, shows what was public at that time, even if the account is later deleted or made private.

Seized phones and computers are a different job. Magnet Axiom recovers, analyzes and reports on data from mobile, computer, cloud and vehicle sources. Cellebrite's Physical Analyzer ingests UFED extractions and cloud warrant returns and produces court-ready reports, with chain of custody handled in Cellebrite Guardian. Neither is the quickest way to save a public TikTok before it is deleted.

HR and workplace investigators

Workplace complaints often involve posts by or about employees. Capture only public content or content the complainant can lawfully share, record how and when you captured it, and keep originals separate from the investigation report. Privacy and employment law vary by country and state, so check with counsel before collecting from an employee's personal accounts. For an organization's own accounts, a compliance archive such as Smarsh may already hold the records.

Insurance and fraud investigations

Claims investigators often need a timeline rather than a single post: what a claimant posted before and after an incident, and how often. Capturing the whole public account at once gives that timeline and avoids the charge that posts were cherry-picked. Transcripts help when the relevant detail is spoken in a video rather than written in a caption. Capture again later if the account keeps posting, and keep each capture's date clear.

Questions to ask any vendor

1. Does it save video as a video file, or as screenshots?
2. Which hash algorithm does it use, and is the hash recorded at the moment of capture?
3. Where do timestamps come from: your computer's clock or the vendor's servers?
4. Does it capture comments and nested replies?
5. Do I need to log in to a social media account to collect, and whose account?
6. What export or report do I get, and can a court or client open it without the software?
7. Can it run on our own servers if policy requires it?

Five habits that make captures hold up

1. Capture the profile as well as the post, so the account can be identified later.
2. Prefer tools that record a hash and a timestamp they did not get from you.
3. Never edit the original; annotate copies.
4. Keep a short log: who captured what, when, and with which tool.
5. Separate what the content shows from who posted it. A capture shows what was on the page; tying an account to a person needs other evidence.

Further reading: Social Media Evidence on OSINT vs forensic social media tools.

Questions and answers

More guides

1. Page Vault alternatives for capturing social media evidence
2. TikTok evidence capture tools: how to save TikTok videos for court
3. Instagram evidence capture tools: posts, Reels and Stories
4. Social media evidence tools for family lawyers and self-represented parents
5. How much does social media evidence capture cost?