IT Forensics · Private Individuals

How can I have offensive or defamatory online posts preserved in a way that provides reliable evidence?

Offensive or defamatory posts may be deleted or amended at any time. For the purposes of a request for deletion, a cease-and-desist order or a criminal complaint, it is therefore essential that the post is reliably documented, including the URL, profile, time and context.

Enquire without obligation

Why this question is important for private individuals

Digital attacks on reputation, identity or privacy can spread rapidly and have significant personal and financial consequences for those affected. Objective technical documentation helps to preserve ephemeral content and to distinguish speculation from verifiable digital facts.

Technical background

A screenshot shows the content, but not the address, the profile in the background or whether the post was public. On social networks, URLs for posts, comments and profiles differ; profiles have a fixed user ID alongside the display name. Review sites sometimes only show abbreviated names.

Relevant evidence and data sources

• Full URLs for posts, comments and profiles
• User IDs or profile identifiers
• Visibility (public, group, friends), reach, interactions
• Timestamps and, where applicable, processing histories

Borders

• Only the authorities or the courts can determine the identity of the person behind a pseudonym, following a request for information.
• Posts that have already been deleted can only be recovered if copies (e.g. in archives) exist.

Possible results

• Documentation of the backup process, complete with a log, in a manner that is verifiable for legal proceedings
• Overview of all relevant posts and profiles

Why LanCologne?

In cases of digital blackmail, defamation or identity theft, there is often considerable pressure to act quickly. Content can be deleted, profiles renamed and messages withdrawn.

Here’s how we do it

• Save the browser page, including the full page, URL and system time.
• Additional safeguarding of profiles and context (previous posts).
• Log containing the hash values of the backup files.

An account is not the same as a natural person

A key forensic principle in this field is accurate attribution. Profile names, telephone numbers, IP addresses, email addresses or devices can serve as important points of reference. However, they must not be equated with a specific individual without additional reliable data.

Ephemeral online content should be preserved along with its context

If a post or profile is likely to be deleted at a later date, it is advisable to document it at an early stage. In addition to the visible content, the URL, account ID, time stamp, full context and original files – where available – are important. The process of securing this information should not delay any necessary protective or police measures in the event of an immediate threat.

Why LanCologne for digital attacks on identity and reputation?

LanCologne does not attempt to use technical evidence to identify a perpetrator as quickly as possible. We secure the available evidence, reconstruct the digital sequence of events and clearly identify which conclusions are reliable. This ensures that the report remains comprehensible to private clients whilst also being verifiable from a technical perspective by solicitors, investigating authorities, the courts or other qualified IT forensic experts.

Depending on the circumstances, various provisions of the Criminal Code may be relevant. Section 253 of the Criminal Code deals with blackmail. In the case of threats, insults or defamatory allegations, Sections 240, 241 and Sections 185 to 187 of the Criminal Code (StGB) may be relevant, subject to their respective conditions. However, the technical preservation of a post does not automatically determine which criminal offence has been committed in a particular case.

In the event of repeated digital impersonation, Section 238 of the German Criminal Code (StGB) may become relevant. Unauthorised access to data subject to special security measures may be relevant under the conditions set out in Section 202a of the German Criminal Code (StGB). Section 201a of the German Criminal Code (StGB) may be applicable to certain images or the making of such images available. In the case of manipulated digital data relevant to the evidence, Section 269 of the German Criminal Code (StGB) may need to be considered, depending on the facts of the case.

With regard to portraits, the Artistic Copyright Act contains provisions in Sections 22 and 23 governing their distribution and public display. In addition, the general right of personality, as well as civil law claims for injunctions and removal, may be relevant. Which legal basis for a claim is applicable in a specific case is a matter for legal advice.

The Protection Against Violence Act may allow for court-ordered protective measures in the event of certain forms of threats, stalking or repeated attempts to make contact. It is not for the IT forensic expert to decide whether the conditions for this have been met or which measure should be applied for.

In the case of ephemeral digital content, producing technical documentation at an early stage may be helpful for subsequent legal or regulatory proceedings. However, LanCologne does not comment on whether privately backed-up content is admissible in court in every case, nor on the evidential value the court may attribute to it.

LanCologne is limited to the technical establishment of facts. Criminal assessments, civil claims, strategies for seeking injunctions and the judicial assessment of evidence remain the preserve of solicitors, investigating authorities and the courts.

Frequently Asked Questions

Related topics

• How can I document digital threats, harassment or repeated attempts to make contact in a way that provides reliable evidence?
• How can I document fake news that purports to come from me?
• IT Forensics for Private Individuals

LanCologne – IT Forensics for Private Individuals

Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.

Get in touch now