What we examine
- Platform records produced in response to subpoenas, warrants or account-holder requests
- Screenshots and exports compared against native records and device data
- Login, IP address and device information tied to account activity
- Direct messages, deleted content and edit histories, where recoverable
- Preservation steps taken, or missed, before content changed or disappeared
Questions we help answer
- Can this screenshot or post be authenticated, and what records would confirm it?
- What links, or fails to link, a person to this account and this activity?
- Is the platform's production complete, and what else should be requested?
- Could the content have been altered, impersonated or posted by someone else?
How it fits your case
We advise on what to request and preserve, analyze platform productions alongside device evidence, and explain attribution findings and their limits in writing and in testimony.