Social Media Investigations for Professionals: The Complete Guide

Somewhere in most case files there is a printout of a post the subject wishes they had not written. It got there because somebody sat down and read — not databases, not records requests, just the subject's own public words, found before they thought to delete them. Skip the courthouse romance: a working investigator's average Tuesday involves more scrolling than shoe leather.

That part of the job has quietly become enormous. A subject with ten active years online has left more written material in public than most people produce in a lifetime of letters — and it is candid material, written for an audience of friends, not for you. This guide covers how professionals read it: the manual workflow and what it costs, what automated reading adds and where it stops, how to keep what you found before it disappears, and the legal lines that separate due diligence from trouble.

Why the public feed belongs in the file

People perform for interviews and dress up for depositions. Their public feed is where the performance slips. A subject's posts show how they talk about money, exes, employers, ethnic groups and grudges when they believe the room is friendly — and they show it with timestamps.

For due-diligence work, that candour is the whole point. A prospective business partner's pitch deck says one thing; three years of their public replies say another. For domestic and dating cases, the feed often holds the pattern a client only suspected. Fraud work leans on it too — people reported losing more than $800 million to romance scams in 2024 (U.S. Federal Trade Commission), and the clients who walk in after one usually bring little more than a name and a feed to start from.

None of this replaces the rest of the craft. It sits beside it: the written record a subject built about themselves, in public, over years — available to anyone patient enough to read it properly.

The manual read, and what it costs

The honest description of a manual social media review: open the profile, start scrolling, keep scrolling. Screenshot what matters, note the date, note the URL, try to remember what you saw four hundred posts ago that suddenly connects. Repeat on the next platform. An active subject can hold five accounts and post across a decade — a serious pass over that is billable hours by the fistful, and most of them are spent reading posts about lunch.

Manual reading has real virtues. You catch tone, in-jokes, the slow drift in how a subject writes about a person over months. No tool reads context the way you do. The failure mode is not quality; it is coverage and fatigue. Attention flags after an hour, and the post that mattered has a way of sitting one scroll past the point where you stopped.

What an automated read adds

An automated scan does the reading a person cannot sustain: the full public history, every platform, in one pass. Here is what comes back, and how working professionals use each piece.

The flags, with receipts. The scan surfaces the most concerning public posts — extremist content, hate speech, harassment, conspiracy material — and every flag shows the original post, quoted word for word, dated, and linked. Nothing arrives as a bare score you would have to defend later. You read the post itself and decide whether it belongs in the file. That matters professionally: a claim you cannot trace to its source is a claim you cannot use.

The shape of the account. A report also maps what the subject posts about — the topics and the people they keep returning to, and the sentiment they express toward each. Ten thousand posts reduce to a readable picture: who occupies the subject's attention, what they love, what they circle back to angry. For a due-diligence read on a prospective partner or a collaborator, that map is often more useful than any single flag.

Search across everything. Every case has its own vocabulary — a name, a company, a street, a grievance. A keyword search across the subject's whole public history, all platforms at once, answers the question a client actually asked: has this person ever posted about that? Doing the same by hand means re-scrolling five accounts and hoping.

Questions, within limits. An AI assistant will answer questions about the collected material — useful for orienting in a large report. It works inside ethical safeguards, and it will decline what it should decline; treat it as a colleague who has read everything once, not as an oracle.

Keep the frame straight: the scan is a first pass, not a finding. It reads faster than you; it does not judge better than you. Sarcasm and reclaimed language can trip an automated flag — which is exactly why every flag carries the original post for a human to read. The tool compresses the haystack. The needle-work stays yours.

Keeping what you found

Public posts are evidence with a shelf life. Subjects clean up. Accounts go private mid-case, posts vanish the week a dispute turns formal, and the screenshot nobody took is the one that gets asked about. Any professional workflow needs to treat preservation as part of the reading, not an afterthought.

Working by hand, that means capturing as you go: the post, the date, the URL, kept in order. A scan helps here in a specific way — it saves a copy of what it reads as it reads it, including photos and video, so the material it flagged is preserved from the moment of the scan even if the post is deleted afterward. For pre-litigation work, that timing difference is the difference between having the post and having a story about the post.

A caution alongside: preserved material is not the same thing as admissible evidence, and no consumer tool substitutes for formal forensic collection where a matter demands it. Know your jurisdiction's standards, and when a case is headed somewhere serious, involve the people who do certified capture. The scan's copies are working material — a reliable record of what was public and when.

The logged-out ceiling

Every honest description of this work includes the ceiling: it reads what a logged-out visitor can see, and nothing else. No logging in, no fake profiles, no borrowed accounts, no private groups. That is both an ethical line and a technical one — and it means a locked or gated profile yields little or nothing, full stop.

Platforms have been lowering that ceiling for years. Some now show logged-out visitors almost nothing even for accounts whose owners consider themselves public. When that happens, a scan comes back thin, and the right response is to read the thinness correctly rather than fight it. A subject who is invisible to the logged-out web is telling you something about how they manage their exposure — record it in the file as a finding, because it is one. What no one should do is respond with workarounds; the professional who logs into a pretext account to read a locked profile has traded a case advantage for a liability.

The flip side: this work only tells you something when the subject actually posts. An active account gives a real read. A dormant one gives you silence, and silence is not a red flag.

The lines that do not move

Professionals live on the right side of lines, so here they are, plainly.

Public means public. Everything above concerns content a subject placed where anyone can read it. Private messages, closed groups and locked accounts are out of scope for this kind of review, whatever a case seems to justify.

This is not a consumer report. A scan of public posts is not an FCRA consumer report and not a regulated background check, and it must not be used as a factor — in whole or in part — in any employment, tenancy or credit decision. If a client is screening a hire or a tenant, that job belongs to a licensed, FCRA-compliant provider with the disclosures and consent the law requires. Investigators know better than most how expensive it is when a client blurs that line; part of the professional's value is keeping them on the right side of it.

Adults only, and no minors' accounts — ever. Subjects are adults, 18 and over.

Your rules still apply. Licensing, privacy law, and evidence standards vary by jurisdiction and case type, and nothing in a tool changes what your rules permit. The scan reads public posts; what you may do with them where you practice is yours to know.

Findings are for judgement, not publication. A flagged post is a reason to look closer, never a license to accuse. The file is where findings go; your client's counsel decides what happens next.

A working checklist

1. Start from what the client gave you: full name, any known handles, and the platforms the subject actually uses.
2. Find the subject's public profiles on X, TikTok, Instagram, Facebook and LinkedIn, and confirm each one is really theirs before you read a word.
3. Skim the recent public posts yourself first, to get the register of the account and how the subject talks.
4. Run an automated read of the full public history, then go through every flag with the original post open.
5. Search the history for the case's own words: names, places, grievances, nicknames the client mentioned.
6. Save what matters as you find it, and note the date and URL of every post you rely on.
7. Corroborate anything decisive from a second source, and let your judgement, not a flag, close the question.

The order matters less than the habit: read first with your own eyes, automate the coverage, verify anything you would be uncomfortable defending. A €15 scan earns its place as step four — the wide pass that makes sure the post that matters is not sitting one scroll past where a tired reader stopped.