Metadata is Key to Getting the “Whole Truth” from Social Media

“Do you swear to tell the truth, the whole truth, and nothing but the truth?”

How many times have you heard that? Probably too many to remember. More importantly, probably too many for you to even really think about it anymore. Too frequently, it seems, we tend to forget about that middle part – telling the “whole truth.”

With physical evidence, usually what you see is what you get. Sure, you might want to know more about the evidence itself, but you can’t put a photograph on the stand and cross examine it. On the other hand, with a witness, no matter how much they testify, you just know there’s more. Even if the witness doesn’t realize it, they know more than they’re telling you.

In general, the concept of the “whole truth” is an elusive one. For social media evidence, the context of how, when, and where a person posted to their account may be more important than the contents of the post. Without that information, we’ll never be sure that we know the whole truth.

Fortunately, there is actually a place we can look – the metadata. Just how much information is contained in social media metadata? You’d be amazed…… because it’s just about everything.

More than Meets the Eye

The sleek look of most social media posts are, like your car, a fancy cover for a lot of complex machinery. Just for an idea, check out the picture below, a “map” of a Tweet (somewhat outdated, as it was published in 2010):

That’s the metadata from one Tweet. As you can see, it contains information on who posted the Tweet (by user ID), when the Tweet was posted, and what it contained. Moreover, you can see exact geographical coordinates of where the user was if geotagging was enabled (and potentially still see generally where the user was even if geotagging wasn’t enabled):

In addition to the information about the Tweet itself, did you happen to notice this section:

That’s a full set of data on the user who posted the Tweet, including user ID and screen name, the date the account was created, the user’s location, and information about geotagging and privacy features set up on the account. That information is sent out with every tweet!

Even More Metadata Today

Since 2010, additional metadata has been added to a Tweet. For example, the metadata on a Tweet sent today would also include whether it was a retweet, a direct message, a reply message, and a complete list of all hashtags the Tweet included. The metadata will also include information about the application used to send the post (“web” or “iPhone”).

Another critical piece of information contained in the metadata is information on any edits or updates to a post. Facebook’s metadata will tell you both when a post was created and when it was revised/updated.

One huge piece of metadata that shouldn’t be overlooked is the information on any images and photos associated with the post or the social media account. The metadata of the post will not contain information on that image, so you’ll need to obtain the metadata of the related URL. Don’t overlook this step, particularly when information about the picture used in a particular post is critical!

More than Just Laying a Foundation

My previous discussions on the usefulness of metadata focused mostly on how useful it can be in authenticating social media evidence. However, as you can see, social media posts can potentially serve as evidence of a lot more than just the information contained in a post!

Using the metadata obtained from a person’s Twitter feed might give you an idea of where they were during times relevant to your case. Knowing the date that Facebook posts were edited will let you know if the user modified a bunch of posts shortly after they received discovery requests. Metadata from a photo on a social media account can help you find out the identity of other people who have information about the events in the photo.

In the end…

Social media evidence contains a wealth of information beyond the text contained in a post. The metadata that is generated for a single social media item provides not only the necessary information to demonstrate authenticity, but potentially important evidence in and of itself.

The tools for obtaining this metadata are not cheap, or necessarily easy to operate. But I’ll save that for another post!