Getting Evidence from Social Media Platforms: Records, Preservation and Legal Process
How investigators obtain account evidence from Meta, X, Google, WhatsApp, Telegram and TikTok: subscriber data versus content, preservation versus production, law-enforcement portals versus MLAT, encryption limits, and authenticating records for court.
This guide offers general professional guidance for police officers, cybercrime investigators and analysts on obtaining account evidence from major social media and messaging platforms. It is not legal advice. Powers, thresholds and platform policies differ by country and change over time, so officers should act only under proper legal authority, verify the current rules in their own jurisdiction, and take advice from prosecutors or a central authority before relying on any step below.
- Three broad data categories exist: basic subscriber information, transactional or non-content logs (including IP and login records), and stored content. Each attracts a different legal threshold.
- A preservation request freezes existing records so they are not deleted; a production request compels the platform to hand them over. They are separate steps.
- Most large platforms run a law-enforcement request portal for preservation, records and emergency requests, but content for foreign investigators usually still needs MLAT or an equivalent treaty channel.
- End-to-end encrypted services (WhatsApp, Signal) cannot produce message content because the provider never holds the keys; only metadata and account records are available.
- A bare screenshot is weak evidence. A certified return of records with metadata from the platform is far stronger and far harder to challenge in court.
What account evidence actually exists
Before drafting any request, decide which category of data you need, because the legal threshold follows the category, not the platform. Across Meta (Facebook and Instagram), X, Google and YouTube, TikTok, and messaging services, the records broadly fall into three groups.
- Basic subscriber information. The identity and registration data tied to an account: name supplied, email, phone number, account creation date, and the IP address used at sign-up. This is the lightest category and is often the most useful starting point for attribution.
- Transactional or non-content records. Logs about activity rather than the activity's content: login IP addresses and timestamps, connection records, device identifiers, and message headers or routing metadata. These are central to placing a person behind an account at a moment in time.
- Stored content. The substance of communications and posts: private messages and direct messages, photos, videos, drafts and stored files. This is the most protected category and almost always requires the highest legal threshold.
Do not assume a platform holds everything indefinitely. Retention periods vary by provider and by data type, and some logs are kept only briefly. This is precisely why preservation matters and why it should be the first action, not the last.
Preservation versus production: two distinct steps
The single most common and most costly mistake is to treat one request as both. They do different jobs.
- A preservation request asks the platform to take a snapshot of the records that exist for a named account today and hold them, so they are not overwritten or deleted while you obtain legal process. It does not disclose anything to you. In the United States the statutory basis is 18 U.S.C. 2703(f), under which a provider must preserve records on request for 90 days, extendable by a further 90 days on renewal. Many platforms apply a similar preservation window pending formal legal process.
- A production request is the legal instrument that actually compels the platform to hand the data over: a subpoena, a court order, a search warrant, a production order, or a treaty request, depending on the data category and country.
Legal thresholds: the US SCA framework and India's BNSS
In the United States the Stored Communications Act, 18 U.S.C. 2701 to 2712, sets a tiered structure that most global platforms map their disclosure policies onto, because so many are US-based. The thresholds rise with the sensitivity of the data: a subpoena reaches basic subscriber information; a court order under 18 U.S.C. 2703(d), which needs specific and articulable facts showing relevance to a criminal investigation, reaches transactional and non-content records; and a search warrant on probable cause is required for the content of communications held for 180 days or less. This is the core reason content is hard to get.
In India, the parallel domestic production power sits in Section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023, which lets a court or an officer in charge of a police station issue a summons or written order, in physical or electronic form, requiring production of documents, electronic records and other things, including data held by intermediaries. Section 94 is the workhorse for compelling Indian-held records, and it operates alongside the Information Technology Act framework for intermediary cooperation. Officers should pair it with the platform's own law-enforcement channel rather than relying on either alone.
In the European Union, cross-border production within the bloc runs through instruments such as the European Investigation Order and the e-Evidence framework, and any disclosure must satisfy GDPR law-enforcement processing rules. The principle is the same everywhere: content sits at the top of the ladder.
| Request type | What it yields | Typical legal threshold |
|---|---|---|
| Preservation request | Nothing is disclosed; existing records are frozen pending process | Letter or portal request (US 18 U.S.C. 2703(f)); no court order needed to preserve |
| Basic subscriber information | Registration identity, email, phone, sign-up IP, account dates | Subpoena (US); production order or police request, e.g. BNSS Section 94 (India) |
| Transactional / non-content records | Login IPs and timestamps, connection logs, device and metadata | 2703(d) court order in the US (specific and articulable facts); production order elsewhere |
| Stored content | Messages, DMs, photos, videos, stored files | Search warrant on probable cause (US); MLAT or treaty channel for foreign investigators |
| Emergency disclosure | Limited data needed to prevent imminent harm | Voluntary good-faith disclosure; no prior court order, but fully documented |
Platform portals, emergency disclosure and MLAT for content
Every major platform now runs a dedicated law-enforcement request system rather than accepting requests by email. Meta operates its Law Enforcement Online Request System, reviewed by a dedicated response team; Google runs a Law Enforcement Request System; X, TikTok and others maintain equivalent portals; and each publishes law-enforcement guidelines describing accepted process and the registration steps for an official email domain. Use the official portal: it authenticates you, routes the request correctly, and produces a cleaner record for court.
Portals handle preservation, basic subscriber and transactional records well when you serve valid process. The hard limit is content for foreign investigators. Because the SCA has long been read to bar US providers from disclosing the content of communications directly to foreign governments, non-US officers generally cannot obtain content through a portal alone. The route is a Mutual Legal Assistance Treaty request through your central authority to the US Department of Justice, which then seeks a US warrant. This is slow, frequently many months, so start it early. Where a bilateral executive agreement under the US CLOUD Act exists, qualifying countries may obtain some data more directly, but most investigators should plan around MLAT for content.
The end-to-end encryption limit
On end-to-end encrypted services, the provider does not hold the decryption keys, so it cannot produce the content of messages or calls no matter what legal process you serve. WhatsApp and Signal fall here. A warrant or production order for message content on these services will return no readable content, because none exists in the provider's possession.
What may still be available is everything around the content: account and subscriber information, when the app was used and for how long, device and connection metadata, and on some services a forward-looking record of which accounts a target communicates with. Telegram is a mixed case: ordinary cloud chats are not end-to-end encrypted by default and only its opt-in secret chats are, and the company has disclosed limited data such as IP addresses and phone numbers under valid legal orders in serious cases. The practical lesson is to redirect effort: pursue metadata, device-level evidence from a lawfully seized handset, and the accounts of other participants, rather than expecting the provider to break encryption it cannot break.
The request workflow
- Identify the account precisely. Capture the exact profile URL, numeric user ID or handle, and the platform, so the provider can locate the right account. Handles can be changed; stable internal IDs cannot.
- Preserve immediately. Send a preservation request through the platform's portal for the named account before anything else, and diarise the renewal date so the hold does not lapse.
- Decide the data category. Map your need to subscriber, transactional or content data, because that determines the instrument you must obtain.
- Obtain the correct legal process. Secure the matching domestic instrument (subpoena, court order, warrant, or a BNSS Section 94 order in India), or begin an MLAT request where content held abroad is involved.
- Serve through the official channel. Submit via the platform's law-enforcement portal from a verified official email domain, citing the legal basis and the specific records sought, with a clear date range.
- Validate the return of records. On receipt, check the certificate or business-records declaration, confirm the data covers your request, and store the original files unaltered with their hash values.
Authenticating social media evidence for court
How evidence is collected decides whether it survives challenge. A screenshot of a profile or chat is the weakest form: it is trivial to fabricate or edit, it carries no metadata, and defence counsel will attack both authorship and integrity. Treat screenshots as an investigative lead and an early preservation step, not as the proof itself.
The strong form is the platform's own return of records, delivered in response to legal process and accompanied by a certificate or affidavit of authenticity (a business-records declaration in many systems). It carries the metadata that ties activity to an account and a time, and it comes from the custodian of the data rather than from a party to the case. Strengthen the chain further with the associated IP and login logs, contemporaneous notes of every step, and forensic preservation of any device lawfully in your possession, hashing files on acquisition and documenting the chain of custody. Where you must capture a public page before process completes, use a tool that records the URL, the capture timestamp and a hash, rather than a phone photograph.
Frequently asked questions
Can I get the content of someone's private messages with a subscriber-information request? No. Subscriber information is the lightest category and never includes message content. Content sits at the top of the legal ladder and, in the US framework, needs a search warrant on probable cause; for foreign investigators that typically means an MLAT request.
Why does my warrant for WhatsApp content come back empty? Because the service is end-to-end encrypted and the provider does not hold the keys. There is no readable message content in its possession to disclose. Pursue metadata, the devices of participants, and other accounts instead.
Do I really need to preserve if I am already getting a court order? Yes. The order takes time, and records can be deleted or age out of retention before it is served. Preservation freezes what exists now so the production step has something to return.
Is a notarised screenshot good enough for court? It is far weaker than a certified return of records from the platform. A screenshot proves little about authorship or integrity. Wherever possible obtain the records directly from the platform with an authenticity certificate, and keep the screenshot only as a lead and preservation marker.
This guide is part of our Guides for Investigators & Police reference series, covering Foundations, Mobile, Web & Social, Crypto, Cloud and AI.