OSINT
Recovering Deleted and Archived Posts
Deleting something removes it from one place. It rarely removes it from all of them, and the copies that survive are usually somewhere the person cannot reach.
Work through these in order of likelihood.
Web archives
The Internet Archive’s Wayback Machine is the first stop for any page that existed for long enough to be crawled. Profile pages, business sites, staff directories, bios.
Two things people miss: you can request a capture of a page now, before it disappears, which is worth doing the moment you find something; and the archive keeps multiple dated snapshots, so you can see what changed and when.
archive.today is a separate service with a different collection. Check both — they capture different things, and archive.today captures on demand more reliably.
Search engine caches and snippets
Even where a cached copy is no longer served, the search result snippet often still shows the text of the deleted content. Search a distinctive phrase in quotes and read the snippet.
Bing and Google fall out of sync, so a page dropped from one may persist in the other for weeks.
Other people’s copies
The strongest source, and the one people forget. A post cannot be deleted from someone else’s screenshot, quote, or reply.
Search for the quoted text. Search replies to the account. Look at accounts that argue with the subject — opponents screenshot everything, and they keep it.
On Reddit, removed comments frequently survive in a reply that quoted them.
Third-party mirrors and aggregators
A great deal of social content is scraped and republished automatically by aggregator sites, news bots and monitoring services. Those copies persist long after the original is gone and rank in search.
Search a distinctive phrase without site: restrictions and see where else it
landed.
The platform’s own leftovers
Deleting a post does not always delete the media it contained. Image and video files sometimes remain accessible at their direct URL after the post referencing them is gone.
Profile photos in particular tend to persist in the platform’s image store.
Court and regulatory filings
If the content ever mattered legally, it is likely exhibited in a filing. Defamation suits, employment cases, restraining orders and regulatory complaints all attach screenshots — and court exhibits are public and permanent.
That is often the cleanest, most defensible copy you will find, because it is already authenticated.
Capture it properly or it is worthless
Finding it is half the job. A screenshot with no context proves nothing.
- Capture the full page including the visible URL and any timestamp
- Record the date and time you captured it, and in what timezone
- Save the page source as well as the image where you can
- Submit the live page to an archive so there is a third-party dated copy
- Hash the file — the EXIF viewer generates a SHA-256 for anything you drop into it
Archive it before you tell anyone you found it. The fastest way to lose evidence is to send a preservation letter to somebody who had not yet realised the post was still visible.
What this does not cover
Private accounts, direct messages, and anything behind a login you are not entitled to use. No amount of archive searching reaches those, and attempting to get at them by deception or unauthorised access is a different category of problem entirely.
Go deeper
The Social Media Investigator’s Guide
Methods for uncovering hidden or deleted posts, tracing and verifying accounts, facial recognition strategies, and investigating digital footprints and connections — with the legal and ethical lines set out. $49.99.
See the course