Capturing and Preserving Online Material

Digital content is rarely permanent. Social media posts can be deleted, webpages can be updated, usernames can change and search results can disappear.

Capturing online material preserves a record of what an investigator observed at a particular time. Preserving it means retaining that material in a way that protects its integrity, provenance and connection to the investigation.

This involves more than taking a screenshot. A screenshot may show what appeared on screen, but it may not record where the content came from, when it was accessed, whether anything was omitted or how the file was subsequently handled.

The appropriate method will depend on the purpose of the investigation. A screenshot may be sufficient to support a low-risk intelligence assessment. Material that may be used in disciplinary, regulatory, civil or criminal proceedings may require more robust collection, continuity and verification.

The objective is not to make every collection forensic-grade but to preserve enough information for another person to understand:

• What was collected
• Where it came from
• When it was collected
• Who collected it
• How it was collected
• Whether it has changed since collection
• What the capture does and does not show