One of the difficulties of mining social media sites for clues to the existence of relevant electronic evidence in an investigation is the ability of the target to simply delete whatever they don’t want you to see. A quick-thinking subject can make valuable social media evidence relevant to a case disappear with the click of a mouse. Or can they?
Duplication of Communication
Luckily for investigators and lawyers it’s not always as easy as that, says attorney Benjamin Wright, who is an expert in e-discovery as well as an author and instructor at SANS Institute. Without some indication that a user's social media profiles contain matter that is relevant to a case, the courts are unlikely to order users to hand over their information. So the ability to mine social media sites for clues to the existence of evidence is important.
As a user of social media, Wright points to the tendency of users like himself to cross-post their updates to other sites, creating copy after copy of the tweet, update or status. “They replicate one another. If I were to tweet and then try to go and delete my [tweet], I know for a fact that there are many other copies of my tweet all over the place. They can end up on my friends’ cell phones, on computer, iPads…stuff can be all over the place and be very hard to fully delete,” he says.
Deletion Draws Attention
Sometimes a deletion itself can influence an investigation, bringing even more attention to whatever was deleted. These actions may be punished severely by the courts, says Wright.
Take, for example, a recent wrongful death case in Virginia. Isaiah Lester was suing Allied Concrete for the alleged wrongful death of his wife, Jessica, who died when an Allied Concrete truck rolled onto her car. Lester’s lawyer, Matthew Murray, instructed his client to “clean up” his Facebook and MySpace profiles. Lester deleted 16 photos from his Facebook profile, showing him in situations that undermined the image Murray was trying to project for the courts. These included photos of Lester partying, holding a beer and wearing a t-shirt that read “I [heart] hot moms”.
