Untangling the Web: What Public Online Content Can (and Can’t) Show

---

In a perfect world, every digital forensic investigation would include the device with its passcode and a neatly labeled evidence bag.  In the real world, evidence might not be available in a timely manner, sometimes only partial records are received, and it is common for clients to ask, “can you just find out what they were up to?”  These are scenarios where investigators can turn to open-source information.

When a device is unavailable and carrier records are unhelpful, the digital forensic analysts at DJS Associates, Inc. review publicly available materials and records (content), typically to achieve one of three objectives:

1. Identify & Preserve Evidence: Social media posts, profiles, comments, tagged photos, or anything made available to the public, online.  Relevant data should be preserved in a way that demonstrates what it is, where it was found, and when it was discovered.
   • Case Example: Plaintiff claims they can barely walk after an injury.  Investigation discovered a photo of Plaintiff wearing high heels at a night club, which their sister had posted and tagged them in on Instagram.
2. Corroborate or Refute Claims: Public content can challenge or support statements like, “I wasn’t there,” “I don’t know that person,” or “that account isn’t mine.”  There is rarely one perfect screenshot but rather patterns and corroboration across multiple sources to establish a clear picture of the facts.
   • Case Example: Defendant claims they were home alone on the night of an incident, yet their Instagram Story contained a photo of a meal, showing that they were at a restaurant.  Venmo transaction history revealed a friend had paid Defendant that evening, commenting on the transaction with a “drink emoji.”  That friend was then brought in as a new witness.
3. Build a Timeline, with Limitations: Public content can provide timestamps, context, and associations, but it also has pitfalls: reposts, edited captions, time zone differences, platform data storage and “memory” features, and content that looks current when it really is not.  It is important to clearly state what the data can support, and what it cannot.

Practice Areas This Strategy Could be Helpful

• Personal Injury & Premises Liability
  • Activity level, travel, events, and public posts that may contradict claimed limitations.
• Medical Malpractice
  • Public updates, photos, and statements that help establish a timeline of symptoms, recovery, and claimed restrictions.
• Workers’ Compensation
  • Public content that may corroborate or refute work restrictions, side work, travel, or physical activity claims.
• Insurance Fraud / SIU Support
  • Public posts, marketplace listings, and other online signals that support or challenge loss narratives.
• Wrongful Death & Serious Injury Litigation
  • Relationship mapping and timeline building from public statements, tagged photos, and event posts.
• Commercial Litigation & Employment Matters
  • Public announcements, business affiliations, role changes, and posts relevant to damages, mitigation, or credibility.
• Family Law
  • Public posts and timelines that may bear on conduct, travel, and representations.

Publicly available information is not a replacement for device-level analysis, but it can be a powerful supplement when devices are unavailable, or records are incomplete. When handled carefully, public source content can help preserve relevant evidence, corroborate or refute critical claims, and develop timelines. It is important that the investigator documents what was found, where it was found, when it was observed, and what the information can (and cannot) support to ensure the final conclusions remain accurate and defensible in verifiable content.