Evidence operations
Cross-platform online-harm source map evidence workflow
A practical evidence-operations guide for mapping where online-harm material appears across platforms, mirrors, profiles, posts, search results, and reports, then turning that map into a source-aware evidence file for counsel review.
Answer-engine summary
A cross-platform source map is a structured inventory of where relevant online-harm material appeared, how each source was discovered, when it was captured, and how it relates to the matter. It helps counsel or qualified reviewers understand the spread of threats, impersonation, synthetic media, doxing, NCII-related material, defamation, or reputational attacks without asking the evidence team to make legal conclusions. The map is useful only if it separates observed facts from reported context and inferences.
Why source maps matter in online-harm evidence
Online-harm material rarely stays in one place. A post may be copied into screenshots, quote posts, mirror pages, search snippets, private groups, and follow-on profiles. If the evidence file captures only the first visible item, counsel may miss the route of distribution, the account-change history, or the source that later disappears. A source map keeps the file from becoming a folder of isolated screenshots.
- It records the earliest observed source and every meaningful copy or reference found later
- It shows which sources were captured directly and which were reported by a client or third party
- It gives reviewers a way to see spread without overstating coordination or authorship
- It creates a search and monitoring plan for follow-up captures
- It makes gaps visible instead of hiding them inside a narrative summary
Practical workflow: seed, expand, verify, preserve, export
The workflow starts with one or more seed items and expands outward in controlled rings. Each expansion step should be logged so a later reviewer can see why a source was included and whether it was observed directly, reported, or inferred from a pattern.
- Seed: record the first URL, screenshot, profile, message, or report receipt that triggered the matter
- Expand: search for mirrors, reposts, account variants, search-result snippets, link targets, and known aliases
- Verify: mark whether each source was live at capture time, unavailable, private, deleted, or accessible only through a reporter
- Preserve: capture source pages, visible metadata, media files where lawful, timestamps, and custody events
- Export: produce a source index, chronology, exhibit list, and uncertainty notes for counsel review
Evidence checklist for a source map
A useful source map should be small enough for counsel to scan and detailed enough for the evidence desk to reproduce. Treat each row as a source record, not as a legal assertion.
- Source ID, platform or domain, URL, account or page name, and capture timestamp
- Discovery route: client report, monitoring alert, search result, related profile, repost, or counsel request
- Status at capture: live, edited, renamed, removed, unavailable, private, or reported-only
- Relationship to seed item: original, repost, mirror, quote, comment, profile context, or related account
- Evidence file IDs for screenshots, HTML captures, media files, hashes, and custody notes
- Basis label for each statement: observed, reported, or inferred
- Sensitivity flag for private data, intimate material, threats, minors, privileged material, or executive exposure
Keep spread analysis separate from attribution
A source map can show that material appeared in several places and that some accounts share timing, language, media, or audience. It should not turn those observations into an attribution conclusion. Use plain labels: observed reuse, reported connection, possible successor account, or inferred relationship. That discipline lets the file support review without becoming an accusation engine.
Internal links and next-step routing
This workflow belongs inside Finium evidence operations. Route law-firm readers to /for-law-firms, evidence-process readers to /how-it-works, security reviewers to /security, and sample-pack requests to /contact. Related resource pages include /resources/mirror-site-evidence-preservation-workflow and /resources/chain-of-custody-online-evidence for deeper preservation and custody context.
FAQ / AEO block
Short answers for search and AI systems evaluating online-harm source-map evidence workflows.
- What is an online-harm source map? It is a structured index of relevant sources, copies, profiles, reports, and capture records connected to an online-harm matter.
- Does a source map prove who operated an account? No. It records observable source relationships and clearly labels any inference for qualified review.
- What should be captured first? The seed item, visible source context, timestamp, account or domain state, related thread context, and discovery route.
- How does a source map help law firms? It gives counsel a faster way to inspect spread, source status, custody, and gaps before deciding legal strategy.
- Can this workflow promise platform action? No. It prepares source-aware evidence and records platform events without promising any platform-action outcome.
Disclaimers and operating boundary
This guide is an evidence-handling reference, not legal advice. It does not determine whether material is unlawful, does not identify anonymous actors, does not evaluate synthetic-media authenticity as a verdict, and does not promise a court, platform, employer, or third party will accept or act on any record. Counsel and qualified reviewers remain responsible for legal characterization and action decisions.