How to Prove an Online Post Existed, and When You Can’t

Proving that a post existed is almost always a question of what was captured before it changed. After deletion, the options are archives, the platform’s own records and other people’s screenshots: none of them was made for the purpose, each has its own gatekeeper, and most need legal process. The reliable answer is unglamorous: capture it as soon as it matters, in a form the other side can check.

People usually come to this question after the fact: a post has been deleted, a page has been edited, an account has gone private, and someone needs to show what it said. It is worth being plain about what is still possible at that point, because the answer shapes what to do next time.

If it has already been deleted

Once content has changed or been deleted, nobody can go back and witness what it was. What remains are second-hand records, each with its own limits:

• Your own screenshots, or someone else’s. Easy to challenge: a screenshot shows what a screen displayed, and can be fabricated in under a minute. What a screenshot does and does not prove.
• Public web archives, such as the Wayback Machine. Useful when they happen to have a copy, but coverage is patchy, and a missing snapshot proves nothing. An archive’s copy is trust in the archive, not something the other side can independently check.
• The platform’s own records. Often the strongest source, and independent of both parties, but slow, frequently offshore, subject to retention limits, and for most parties available only through legal process such as a preservation request or a court order.
• The account holder’s own data, if they cooperate, or the devices of people who received it, through forensic examination.

None of these is useless, and a combination can be persuasive. Each has its own gatekeeper and its own limits, and each can be contested.

If it is still there

If the post or page is still online, capture it now, before anything else. The question is how, because the method decides what the capture will be able to prove later:

• A screenshot shows the screen, not the post.
• A web archive or HAR file records what the collecting software wrote down.
• A network capture with the session keys proves, for a full handshake, that the genuine site signed it, but the collecting machine could have produced the content itself.
• A capture witnessed by a relay the collector does not control can show what arrived from the platform’s side of the network, and, for connections that begin with a full handshake, that it came from the platform’s certificate holder, in a form the other side can check with the validator.

The full comparison is in Screenshot, HAR, WARC or PCAP: what does each actually prove?

Existed, and existed when

“The post existed” and “the post existed on a particular date” are different claims. A witnessed capture shows that the platform served the content to the capture. To show when, the capture also needs a trusted timestamp from an independent authority, which establishes that it was sealed no later than a certified time. That is an upper bound only: the capture was made at or before that time. It is not a precise moment, and a lower bound needs separate evidence.

Why capture has to come first

Nobody knows which post will matter until the dispute arrives, and by then it has often changed or gone. Of posts made on X (then Twitter) in spring 2023, 18 per cent were no longer publicly visible by mid-June 2023, often because the account had been deleted, suspended or made private; and around 38 per cent of web pages that existed in 2013 were no longer accessible by late 2023 (Pew Research Center, 2024).

That is the practical lesson: the evidence has to be captured when it is seen, not when it is needed. Independent proof of what was served is something you arrange in advance; afterwards, you depend on records other people kept. Shorenet is built for the first of those: social media evidence the other side can check, which also covers how to preserve a post before it is deleted.