Objectives
- Capture and hash material before examining it
- Write an evidence log that survives challenge
Lesson
Material disappears exactly when it becomes important, and sometimes because it became important. A post gets deleted, an account gets locked, a page gets quietly edited. Everything downstream of collection depends on a copy existing, so preservation comes before reading closely, before analysis, and certainly before contacting anybody.
Capture two ways: an independent web archive and a local copy. One archive service is a single point of failure, and services change their retention policies without asking you.
Then hash each file with a modern digest such as SHA-256 and record the value. A hash is a fixed fingerprint; recomputing it later and getting the same number is what lets you say the file is unaltered.
MD5 will not do this job anymore. Full practical collisions were published in 2004, a forged certificate followed, and by the end of 2008 it was formally described as unsuitable for further use.
The evidence log records, for every item: the source location, the capture time with its time zone, the tool used, who captured it, the hash, and where the copy lives. Contemporaneously. A log reconstructed from memory next month is a recollection, not a record.
Finally, collect the minimum the question requires. Data minimization is a stated professional standard, not politeness. Material about uninvolved people is a liability you chose to create, and you will be asked why you have it.