Social media and open-source intelligence (OSINT) investigations are the systematic collection, authentication, and preservation of publicly available online information so that it can be relied on in a legal proceeding. The critical word is authentication. A screenshot of a Facebook post is not evidence. It is a picture of a screen, and opposing counsel will say so.

Nearly every case now has an online dimension. The difference between a case that turns on that dimension and a case that gets embarrassed by it is entirely in the method.

Why does OSINT matter more every year?

The volume of consequential activity happening in public online spaces keeps growing, and so does the volume of harm. The FBI's Internet Crime Complaint Center logged 859,532 complaints in 2024 with reported losses exceeding $16 billion, a 33 percent increase over the prior year (FBI IC3, 2025). Separately, the Federal Trade Commission reported that consumers lost more than $12.5 billion to fraud in 2024, and that people contacted through social media reported a loss 70 percent of the time, accounting for $1.9 billion in reported losses (FTC, 2025).

Those numbers describe more than fraud. They describe a population that conducts a large share of its life, its transactions, and its disputes in searchable, public, timestamped forums. For an investigator, that is a record. For a litigator, it is either an asset or a liability, depending on how it was collected.

What does an OSINT investigation actually collect?

Open-source intelligence is not limited to social platforms. In a typical civil or family-law matter, an investigator may work across:

•           Public social profiles and their public posts, comments, tagged photos, and check-ins

•           Public business filings, fictitious business names, and corporate registries

•           Property records, liens, judgments, and civil dockets

•           Professional licensing databases and disciplinary records

•           Public marketplace listings, review accounts, and crowdfunding pages

•           Archived versions of pages that have since been altered or deleted

•           Publicly posted images and their visible context, including landmarks, vehicles, and signage

What OSINT does not include, and what a licensed investigator will not do, is pretexting into private accounts, buying credentials, accessing anything password-protected without authorization, or using deception to obtain a friend request. Those methods do not merely risk suppression. They expose the client to liability and can expose the investigator to criminal charges.

Why is a screenshot not enough?

Because a screenshot has no provenance. It shows a rendering of content at an unknown time on an unknown machine by an unknown person. It can be cropped, staged, edited, or fabricated in a browser's developer tools in about fifteen seconds. Courts know this.

Defensible collection looks different. It typically includes:

1.         Capture with metadata. The full page, the URL, the collection timestamp, and, where available, the underlying source data, captured with tooling that logs the process.

2.         Hash values. A cryptographic hash taken at collection so that any later alteration of the file is detectable.

3.         Chain of custody. A written record of who collected the item, when, from where, on what system, and everywhere it has been since.

4.         A declarant. A named investigator who can testify to the method, because authentication under the rules of evidence ultimately requires a witness, not a file.

5.         Corroboration. Independent confirmation that the account belongs to the person you think it belongs to.

That last point is where most self-collected online evidence falls apart, and it is why online findings should be paired with how field surveillance is documented to survive challenge. A profile that shows a claimant water-skiing is interesting. A profile that shows a claimant water-skiing, plus documented physical surveillance of that same claimant loading a boat on the same weekend, is a case.

How do investigators avoid the attribution trap?

The single most dangerous error in online investigation is attributing an account to the wrong human being. Names repeat. Photos are stolen. Parody, impersonation, and abandoned accounts are everywhere. Acting on a misattributed profile can destroy a case, defame an innocent person, and end in a counterclaim.

Attribution is built, not assumed. Investigators triangulate across independent signals: consistent employment history, a matching relative network, corroborating property or vehicle records, timeline consistency between posts and known events, and physical verification where the stakes justify it. This is a discipline of disproving before proving, and it is where the cost of acting on an unverified assumption becomes very concrete. In our experience across three decades of investigations, the cases that go badly for a client are almost never the ones where the investigator found too little. They are the ones where someone believed something too early.

Where does OSINT change outcomes?

•           Insurance defense. Activity inconsistent with claimed impairment, established through timestamped public posts and corroborating surveillance.

•           Family law. Cohabitation indicators, undisclosed income, travel, and asset displays relevant to support and custody.

•           Employment and HR. Harassment, threats, and off-duty conduct implicating workplace policy.

•           Business disputes. Solicitation of customers by a departed employee, misuse of a brand, diverted opportunity.

•           Threat assessment. Escalating language and fixation directed at an executive or a workplace.

•           Asset and skip work. Locating a subject who has moved, changed names, or gone deliberately quiet.

Frequently asked questions

Is looking at someone's public social media legal? Viewing genuinely public content is generally lawful. What matters is method and jurisdiction. Licensed investigators do not use deception to gain access to private content, do not bypass authentication, and follow state licensing rules and platform terms. The line is access, not curiosity.

Can social media evidence actually be used in court? Yes, when it is properly authenticated. That means demonstrating the content is what it purports to be and is fairly attributable to the person alleged to have posted it. Defensible collection, hashing, chain of custody, and a testifying investigator are what get it admitted.

Why can't our staff just gather it themselves? They can gather it. The problem comes later. Internally collected screenshots frequently fail authentication, and the employee who collected them becomes a witness with no methodology to describe. Self-collection also risks spoliation, tipping off the subject, and inadvertent access violations.

What is the difference between OSINT and surveillance? OSINT is collected from publicly available sources without contacting or observing the subject in person. Surveillance is direct, lawful physical observation. They are complementary. OSINT tells you where and when to look. Surveillance proves what actually happened.

What if the subject deletes their posts? This is a strong argument for early engagement. Evidence that is captured and hashed before deletion remains usable, and archived versions of pages may still be recoverable. Once litigation is reasonably anticipated, deletion may also raise a spoliation issue for the deleting party.

How quickly can an OSINT investigation produce results? Preliminary findings are often available within days. Attribution, corroboration, and preservation take longer, and they are the part that determines whether the findings are usable. Rushing the second half is how good leads become unusable exhibits.

Talk to NBI about your case

If your matter has an online dimension and nobody has preserved it properly, the clock is working against you. National Business Investigations conducts licensed OSINT and social media investigations with defensible collection, documented chain of custody, and investigators who can testify to the method. Contact our team to discuss your case.

About the author

Michael D. Julian brings more than 30 years of experience in professional investigations and leads National Business Investigations. He served as President of the California Association of Licensed Investigators (CALI) from 2005 to 2015 and has spent his career building investigative records that hold up under scrutiny. Connect with him on LinkedIn.