Platform Logs, Exports & Digital Evidence in Harassment and Account Compromise Matters
A practical guide to what major platforms retain, how to request it, and why how you collect it matters as much as what you collect.
When someone comes to me after a harassment campaign, a compromised account, or a stalking situation involving social media, the first thing they almost always say is: "I have screenshots." And my first question is always the same: "Of what, and how did you collect them?"
Screenshots are a starting point - not evidence. At least not on their own.
This guide is for victims, their attorneys, and HR professionals who need to understand what major platforms actually retain, what you can realistically obtain, and how the collection process determines whether any of it survives a legal challenge. If you need hands-on support, see Digital Investigations.
Why Platform Data Matters More Than Screenshots
Screenshots are trivially easy to fabricate. Anyone with browser developer tools and thirty seconds can alter displayed content and photograph it. Courts know this.
What courts - and investigators - need is data that carries its own authentication: timestamps corroborated by platform records, metadata embedded at the moment of capture, and a documented chain of custody proving the evidence hasn't been touched since collection.
Platform-native data solves all three problems simultaneously. When Meta produces records in response to a legal request, those records are authenticated by the platform itself. When a forensic tool captures a webpage in WARC format, it preserves the underlying HTML, metadata, and structure - not just a pixel image. When a digital forensics professional documents their collection process, they create a chain of custody that withstands cross-examination - and can translate it into plain-language technical summaries for legal and non-technical audiences.
The gap between "I have screenshots" and "I have preserved, authenticated digital evidence" is exactly where cases are won and lost.
What Platforms Actually Keep
Understanding what's collectable starts with understanding what exists. Here's a practical breakdown of the major platforms and what they retain.
Meta (Facebook & Instagram)
Meta retains a significant volume of account data even after users delete content. This includes basic subscriber information (name, email, phone, registration IP), login/logout IP logs, message metadata, and - depending on the settings at the time - message content.
As of late 2023, Meta rolled out default end-to-end encryption for Messenger. That shift has meaningful implications: encrypted content on Meta's servers may not be producible even with valid legal process, because Meta may not hold the decryption keys. Instagram direct messages and Facebook content that wasn't end-to-end encrypted at the time of the incident may still be recoverable.
Meta's law enforcement guidelines state they will preserve account records for 90 days pending receipt of formal legal process. This preservation window is critical - it doesn't last forever, and it doesn't start until someone requests it.
Practical implication: If you're involved in a harassment or account compromise matter involving Meta platforms, the clock is running. Preservation requests need to happen quickly, before the user deletes the account or the data ages out of retention.
Apple (iCloud)
Apple's posture on law enforcement requests is frequently mischaracterized in both directions - they're neither a black box nor an open door.
Apple can produce iCloud account data, device registration records, iMessage metadata, FaceTime logs, connection logs, and customer service records in response to valid legal process. What they generally cannot produce is the content of end-to-end encrypted iMessages - not because they won't, but because they don't hold the keys.
Apple's October 2025 legal process guidelines specify that preservation requests must come from an official government or law enforcement email address to lawenforcement@apple.com. Non-law enforcement parties - including civil litigants - must personally serve legal process at Apple's headquarters or through their registered agent. This matters: civil matters involving iCloud data face a higher procedural bar than criminal matters.
One important nuance: iCloud backups are a different story. If a user has iCloud backup enabled, the backup may contain iMessage content that isn't otherwise producible - because the encryption key for those messages can be stored in the backup itself. A forensic professional who understands this distinction can help determine whether the backup pathway is viable.
Google (Gmail, Drive, Voice, Android)
Google maintains a broad data footprint across its services. Through Google Takeout, users can export their own data - and in civil matters, directing a subject to produce their own Google data through discovery is often the most efficient path.
For law enforcement requests, Google preserves account information in response to 18 U.S.C. § 2703(f) requests. Google's transparency reporting shows they review every request, frequently push back on overbroad demands, and apply a tiered standard: basic subscriber information is producible via subpoena, non-content account data via court order, and content via search warrant.
From a civil investigation standpoint, Google data is particularly valuable in account compromise cases - login history, IP addresses, associated devices, and account recovery activity can paint a clear picture of unauthorized access.
Snapchat
Snapchat's ephemeral design is its defining characteristic and its most significant evidentiary challenge. The platform is designed to delete content: Snaps delete after viewing, Stories delete after 24 hours, and by default, chat messages are cleared after the conversation ends.
That said, "deleted" on Snapchat doesn't mean "gone." Snap retains some categories of data even after content expires from user view - account information, Snap metadata (who sent what, when, to whom), and content saved to Memories persists until a user actively deletes it.
The SCA (Stored Communications Act) governs what Snap can produce. Like other major platforms, they require specific legal process - subpoenas, court orders, or search warrants - and law enforcement must go through Snap's Law Enforcement Service Site (LESS) portal. Civil litigants face the same SCA barrier here as elsewhere: platforms typically won't produce message content in civil matters without a court order.
The key practical point: in harassment matters involving Snapchat, metadata is often more obtainable than content, and that metadata - combined with device forensics and other corroborating evidence - can still build a compelling picture.
X (formerly Twitter)
X retains IP addresses, device information, login history, direct message metadata, and account activity logs. Content retention varies depending on whether the user deleted it and when.
X accepts legal process through their transparency and trust portal. Like other platforms, they apply a tiered standard tied to legal process type. Preservation requests can lock down account data while formal process is prepared.
Worth noting: X's cooperation rates with legal requests have fluctuated under current ownership, and their transparency reporting on government and civil requests has become less consistent than it was previously. For civil matters specifically, X's historical reluctance to comply with civil subpoenas for message content is well-documented.
The SCA Problem in Civil Cases
This is where a lot of non-lawyers (and some lawyers) get surprised.
The Stored Communications Act (18 U.S.C. §§ 2701-2712) creates a significant barrier to obtaining platform data in civil litigation. The SCA generally prohibits platforms from voluntarily disclosing the contents of stored communications to private parties - even with a civil subpoena.
Courts have been inconsistent on this, and the law is genuinely unsettled in places. The general rule of thumb:
- Criminal matters: Law enforcement can compel production through the tiered process (subpoena → court order → search warrant)
- Civil matters: Civil subpoenas often won't compel content production; court orders are typically required for content, and some courts have held that civil litigants can't use federal court orders to compel production under the SCA at all
This doesn't mean civil litigants are without options. It means the strategy has to account for the SCA from the outset:
- Directing parties to produce their own data through discovery
- Seeking court orders rather than simple subpoenas
- Building the evidentiary case from the user's end (their devices, their exports, their cloud backups) rather than relying entirely on platform production
- Working with a digital forensics professional who understands where the SCA applies and where it doesn't
If you want more context on how I structure investigations and reporting, see Process & Methodology and Ethics & Confidentiality.
What "Chain of Custody" Actually Means for Digital Evidence
Chain of custody is documentation proving that evidence is what you claim it is and hasn't been altered since collection. For digital evidence, this means:
Who collected it, on what device, using what process. If you take a screenshot on your iPhone and text it to your attorney, that chain is already broken - the file has been transmitted, potentially compressed, and the metadata modified.
How it was stored. A screenshot saved to iCloud and later downloaded is a copy of a copy, and every transfer introduces questions.
Whether it's been modified. Even resizing an image or changing a filename can affect metadata in ways that invite challenge.
Hash verification. Professional forensic collection tools generate cryptographic hash values (typically MD5 and SHA-256) for collected evidence at the moment of capture. These hashes can be re-verified at any point to prove the file hasn't changed. Courts increasingly expect this for digital evidence admitted under FRE 902(13) and (14).
The practical takeaway: the moment you know something is likely to become a legal matter, stop improvising. Screenshots are fine as contemporaneous notes. They are not a substitute for proper forensic collection, and courts - and opposing experts - know how to attack them.
What You Should Do Right Now (Before Engaging an Attorney or Investigator)
If you're documenting a harassment situation or account compromise and haven't yet engaged professional help, here's what to do and what not to do.
Do:
- Capture screenshots immediately, with timestamps visible. Something is better than nothing for establishing a contemporaneous record, even if you'll need better evidence later.
- Document the context: what platform, what account, when you first observed the content, what device you used to view it.
- Enable any available platform export functions for your own accounts (Google Takeout, Facebook's "Download Your Information," Apple iCloud export) and do it promptly.
- Preserve your own devices - don't factory reset, don't "clean up" your messages, don't delete anything.
- Note any account recovery or login notification emails you received and don't delete them.
Don't:
- Screenshot and then delete the source. Courts and investigators need to be able to trace evidence back to the original platform record.
- Send screenshots through messaging apps before you've documented them properly. Every transmission modifies metadata.
- Wait. Platform retention windows are finite. Accounts get deleted. Evidence disappears.
- Confront the harasser through the same channels where evidence exists. This can complicate later collection and create spoliation risk.
When to Bring in a Digital Forensics Professional
Not every situation requires a forensic investigator from the outset. But certain circumstances make professional involvement early on critical, not optional:
- The matter is likely to result in litigation (civil or criminal)
- The harassing party has already deleted content or accounts
- You suspect account compromise and need to establish unauthorized access
- You need platform records that require formal legal process
- The opposing party is sophisticated enough to challenge evidence collection
- HR, legal counsel, or law enforcement is already involved
A forensic investigator brings technical collection tools that produce court-ready output, knowledge of platform-specific data structures and retention, experience working within the SCA framework, and the ability to provide expert testimony if the case goes to hearing.
If you're trying to determine whether your matter needs this level of support, start with Digital Investigations and the FAQs.
The cost of bringing in a professional early is almost always lower than the cost of trying to salvage an improperly collected evidence set later - or losing a case because key evidence was rendered inadmissible.
A Note on What Investigators Like Me Can (and Can't) Do
I want to be direct about this, because I see it misrepresented elsewhere.
A private forensic investigator - operating outside of law enforcement - cannot compel platform production. I can't send a "preservation request" to Meta on your behalf and have them hold your harasser's account data. That process requires law enforcement credentials or court-issued legal process.
What I can do is help you build the evidentiary foundation on your end: forensically collecting data from your devices, your accounts, your cloud exports; documenting a clear chain of custody; producing reports that authenticate the evidence under applicable federal rules; and working alongside your attorney to support the legal process strategy that gets you platform data when it's warranted.
The combination of proper user-side forensic collection and a solid legal process strategy - with an attorney who understands ESI and digital evidence - is how these cases get built.
Summary
Platform data in harassment and account compromise matters is more obtainable than most people think - and more fragile than most people handle it. The key points:
- Major platforms retain more than users realize, but that data has finite preservation windows
- The SCA creates real barriers in civil cases; strategy matters as much as the evidence itself
- Screenshots are starting points, not evidence - chain of custody and metadata authentication are what make digital evidence admissible
- Time is the most common enemy; act early, preserve immediately, and don't improvise collection
- A digital forensics professional can help you build the foundation - and work with your attorney to access platform records through proper channels
If you're dealing with a harassment situation, a suspected account compromise, or you're an attorney or HR professional trying to understand your evidentiary options, I'm available for consultations. You can contact JDI Consulting to request an initial consult.
Contact: jimi@jdiconsulting.co