5.1 Account Ownership Challenges
A social media post proves that a post was made from an account - not necessarily that the accused made it. Account ownership and control must be independently established.
Ownership Vulnerabilities
- Shared accounts: Multiple people may have access to one account
- Compromised credentials: Account may have been hacked
- Fake accounts: Anyone can create an account in another's name
- Session sharing: Logged-in sessions can be shared across devices
- Account recovery: Third parties may gain access through password reset
A: Yes.
Q: Did you verify that the accused created this account?
A: The account has his name and photo.
Q: Anyone can create an account with any name and any photo?
A: Yes, that is possible.
Q: Did you obtain records from Facebook/Meta confirming the account owner?
A: No.
Q: Did you verify the email or phone number registered to this account belongs to the accused?
A: We did not obtain that information.
An account with someone's name does not prove they control it. Establish who registered the account, what email/phone is linked, and whether anyone else had access.
5.2 Screenshot Limitations
Why Screenshots Are Weak Evidence
- Easy fabrication: Screenshots can be created in minutes using basic tools
- No verification: Cannot be authenticated against platform records
- Missing context: May show partial information out of context
- No metadata: Screenshots do not contain post metadata
- Ephemeral content: Original may have been deleted or modified
A: Yes.
Q: When was this screenshot taken?
A: At the time of investigation.
Q: Is the original post still available on Instagram?
A: No, it was deleted.
Q: So we have no way to verify this screenshot against the actual platform?
A: The screenshot shows what was there.
Q: Are you aware that screenshots can be fabricated using image editing software?
A: (Hesitates) Yes.
Q: Did you use any forensic tool to capture this post with metadata?
A: No, it is a regular screenshot.
Platform records obtained through legal process (MLAT, Section 91 BNSS notice) are more reliable than screenshots. If only screenshots are available, challenge their reliability heavily.
5.3 Platform Preservation
Proper evidence preservation requires obtaining platform records, not just user-facing content:
What Platform Records Reveal
- Account registration data: Email, phone, IP address at creation
- Login history: IP addresses and timestamps of access
- Post metadata: Creation time, device information, location
- Edit history: Whether content was modified
- Connection data: Who the account connected with
Challenge prosecution evidence that relies only on screenshots without platform records. Argue that without official records from the platform, the evidence lacks proper authentication.
5.4 Deletion and Modification Issues
Content Can Change
- User deletion: Posts can be deleted at any time
- Platform removal: Content may be removed for policy violations
- Editing: Many platforms allow post editing without trace
- Account deactivation: Entire accounts can disappear
If evidence was obtained after content was modified or deleted, authentication becomes nearly impossible. The prosecution must establish:
- When the original content was posted
- What it contained at the time of alleged offense
- Who had access to modify or delete it
- How the preserved version relates to the original
"Social media evidence is uniquely ephemeral. Content that existed yesterday may not exist today, and what exists today may not be what existed yesterday." Digital Evidence Handbook
Key Takeaways
- Account ownership must be independently proved - a name on an account is not enough
- Screenshots are weak evidence - easily fabricated, no metadata, no verification
- Platform records are more reliable than user-captured evidence
- Deletion and modification mean content may not reflect original state
- Always demand authentication through official platform records