Social media evidence in UK courts: How to preserve a post before it is gone.
Yes, social media posts can be evidence, and they are used regularly in the courts of England and Wales, which is what this page is about. The hard part is not getting them admitted. It is being able to show, later, that what you produced is what the platform actually published, after the post itself has been edited or deleted. That work has to happen before you lose it.
Published , last reviewed
Exhibit 02 · sealed
Social media post
@account.example
Thanks for all the messages. Back online next week.
- Captured 9 September 2026, 20:14 UTC
- SHA-256
46cccd2f…3721a0be - Timestamped by DigiCert (RFC 3161)
- Witnessed by the Shorenet relay
Verified · independently witnessed
Can social media posts be used as evidence?
In principle yes. A post, a profile, a comment or a message is ordinary documentary evidence, and it turns up across the range of work: contract and debt claims, defamation, insurance and counter-fraud, employment disputes, family proceedings, harassment and fraud investigations.
Being admissible is the start of the argument rather than the end of it. Whether the court receives the material and what weight it carries are different questions, and the second is for the court to decide on the whole of the evidence.
It is also not entirely in the parties’ hands. CPR 32.1 lets a civil court control the evidence by directing “the issues on which it requires evidence”, “the nature of the evidence which it requires to decide those issues” and “the way in which the evidence is to be placed before the court”, and provides that it “may use its power under this rule to exclude evidence that would otherwise be admissible”. The family court has the same power in FPR 22.1.
This page covers civil and family proceedings in England and Wales. Criminal proceedings have their own procedure rules, and Scotland and Northern Ireland have their own rules of evidence; neither is covered here. It is general information and not legal advice. Every legal point links to the rule it rests on.
How do you preserve a post before it is deleted?
Immediately, and with a record of how you did it. Most of this has nothing to do with any product:
- Capture now. Deletion and editing are the normal case. Nothing can witness a page after it has changed, so every other step depends on this one.
- Capture the context, not the fragment. The post, the account page, the thread above and below, the URL as text rather than as pixels, and the visible timestamps. A quoted sentence with no surrounding thread invites the taken-out-of-context argument, and that argument is usually available.
- Keep the original untouched. Do not crop, annotate, resize, convert or re-save it. Work on copies. Annotating the original is one of the most common ways a sound capture becomes arguable.
- Write a contemporaneous note. Who captured it, when, from what device and browser, whether logged in and as whom, and the steps taken in order. Written at the time, not reconstructed months later.
- Record the hash of each original file, and be clear what that establishes: the file is unchanged since the hash was taken, not that it shows what the platform served.
- Consider asking the platform, and do not rely on it. Platform records can carry attribution a capture cannot, but they generally need legal process and time, and the post may be gone first.
Step by step, with the procedural detail: how to preserve social media evidence before it is deleted. If it has already gone: what you can still do, and when you can’t.
What do courts look at?
Three things get contested far more often than admissibility, and they are worth preparing for separately.
Authorship
Who actually posted it. A capture can show what the platform published and which account it attributed the post to. It does not show who was holding the phone, and no capture can. Attribution to a person is a separate evidential job.
Context
What surrounded it. A single screenshot of one message in a long thread is the easiest thing in this field to attack, often fairly. Capture the thread, the profile and the replies, not the line you want to rely on.
Completeness
Whether anything is missing. This cuts against everyone, us included: a capture shows what was captured, and no technology proves that nothing was left out. Say what you captured and how, rather than implying it is the whole story.
The route by which these get tested is the notice to prove. In most civil claims and in family proceedings, authenticity of a disclosed document is admitted by default: CPR 32.19 deems a party “to admit the authenticity of a document disclosed to him under Part 31 ... unless he serves notice that he wishes the document to be proved at trial”, and FPR 22.16 does the same in family proceedings. So unless the other side serves a notice to prove in time, the authenticity of a disclosed post or screenshot is treated as admitted; if they do serve one, you have to be able to prove it, and the material for that has to be gathered when the content is captured.
Two limits worth knowing. The civil rule bites only on documents disclosed under Part 31, and it does not apply to claims on the small claims track: CPR 27.2(1) disapplies Part 31 and Part 32 other than rule 32.1 for small claims.
Messages versus public posts
They behave differently as evidence, and conflating them causes trouble.
- A public post is published to the world. It can be captured by anybody who can see it, including you, without anyone’s cooperation. The contested questions are usually authorship and context.
- A private message normally exists only on the devices at each end, and on whatever the service holds. There is usually no public version to capture and no neutral copy to compare against, so the dispute tends to turn on the devices and on the account of how a copy was made. Keep the device if you can: once it is lost, wiped or replaced, a screenshot of a thread rests on the word of whoever made it.
- A logged-in view sits between the two. You can capture what you are entitled to see, and whether you are entitled to see it is your decision, not ours.
For messaging specifically: WhatsApp messages as evidence. For family proceedings: social media evidence in the family court.
A screenshot alone does not show what the platform served
A screenshot shows only what a screen displayed. It can be fabricated in moments, edited in the browser before it is taken, or dismissed as AI simply because it could have been. Once the post is deleted, there is nothing left to check it against.
Hashing and timestamping a screenshot helps less than people expect: it shows the file has not changed since, and says nothing about where the content came from.
Screenshots as evidence: what they prove, and what they don’t. Or see why unchanged is not the same as accurate.
Platform notes
Shorenet records the traffic your own browser receives. That means it works on what you open in a capture browser, and not on native mobile apps. Where a platform is mostly used through its phone app, the web version is what can be captured. The authoritative, current position is in the FAQ.
- Facebook, Instagram, X, TikTok, LinkedIn and YouTube. Captured as traffic from the website in a capture browser, and rebuilt readably: posts, profiles, comments, stories and listings, including content you are logged in to.
- Instagram and Telegram additionally produce structured records today: accounts, posts and messages and how they connect, each linked back to the sealed evidence.
- Telegram. Supported today on the web, including its second layer of encryption inside the web connection.
- WhatsApp. In development, and not supported today. Services that add their own encryption layer inside the web connection need a dedicated module each, and WhatsApp’s is not finished. Background: WhatsApp messages as evidence.
- Video. Can be rebuilt from YouTube captures, clearly labelled as a reconstruction and never presented as more complete than it is.
Shorenet creates no accounts, does no automated browsing and never resells data. Your investigator browses; Shorenet records what their own browser receives, and witnesses it.
What a Shorenet capture gives you instead
What the platform sent
The encrypted traffic itself, witnessed in transit by our relay, which is independent of whoever captured it and cannot read the content. Where a connection begins with a full handshake, the platform’s own signature ties it to the platform; resumed connections are reported separately, never rounded up.
Sealed, so any change shows
The capture is sealed with post-quantum and classical signatures. Any later change breaks them, including one made by the investigator.
Checkable by the other side
Built so their expert can verify the capture themselves, with no Shorenet server, account or cooperation, and open the traffic in tools they already trust. The validator that makes that possible is not published yet: Shorenet is pre-deployment, and what exists today is a demonstration of the decryption step rather than the validator.
What it does not do
- It does not prove a post is true or genuine. It proves what the platform sent, which is often what matters: that something was published.
- It does not detect deepfakes or synthetic media, and we do not claim to.
- It does not identify who ran an account. It proves what the platform showed the account as publishing.
- It cannot capture a post that is already gone. Nobody can witness a page after it has changed, so capture as soon as it is reported. What you can still do if it has gone.
- It makes no completeness claim per post. A capture shows what was captured.
- We operate the relay. It is independent of whoever captured the evidence, not of us, and we set out exactly what that means.
- Admissibility and weight remain for the court. Nothing here changes what a court may decide to receive.
Who uses social media evidence
Insurance and counter-fraud
Claimant posts and ghost-broker adverts.
Read more →Litigation and eDiscovery
Defamatory posts, family and employment disputes.
Read more →Law enforcement
Harassment, image-based abuse, fraud.
Read more →HR and workplace
Online conduct and leaks.
Read more →Regulators
Finfluencers and misleading adverts.
Read more →Journalism and OSINT
Posts that document wrongdoing.
Read more →Facebook, Instagram, X, TikTok, LinkedIn, YouTube, Telegram, WhatsApp and other names used on this page are trademarks of their respective owners. Shorenet is not affiliated with, endorsed by or sponsored by any of them.
Capture it while it’s still there.
We’re opening a small evaluation programme before general release. If your team relies on evidence of what was online, talk to us.