What you post online — or have ever posted online — can shape the outcome of a criminal case more than most defendants realize. Prosecutors in the Riverside County District Attorney’s Office routinely obtain social media evidence in cases ranging from criminal threats to domestic violence to drug offenses. The phone seized at booking is forensically searched. Subpoenas go out to Meta, Google, X, Snapchat, and TikTok. Friends are interviewed. Old posts surface years later. The Law Office of Nic Cocis represents clients facing criminal charges throughout Southwest Riverside County, including Murrieta, Temecula, Menifee, Lake Elsinore, Wildomar, Winchester, Canyon Lake, and French Valley — and managing the social media dimension of a defense is part of the work in nearly every modern case at the Southwest Justice Center.
How Prosecutors Actually Get Social Media Evidence in California
Most defendants assume social media evidence comes from the prosecution scrolling through their public profile. That is one source, but it is not the most important one. There are five primary ways the Riverside County DA’s Office and law enforcement obtain social media and digital evidence:
1. Public posts. Anything visible to anyone with an internet connection is fair game. Prosecutors simply look. They screenshot. They authenticate the screenshots through subpoenaed account records at trial.
2. Subpoenas and search warrants to the platforms. Under the federal Stored Communications Act (18 U.S.C. § 2701 et seq.) and California’s Electronic Communications Privacy Act (CalECPA, codified at Penal Code § 1546 et seq.), law enforcement can obtain content and metadata from social media companies through search warrants supported by probable cause. Meta, Google, X, Snapchat, and TikTok all maintain law enforcement compliance teams that respond to valid California warrants. Direct messages, deleted-but-not-purged content, IP login history, and account metadata are all obtainable.
3. Phone forensics at arrest. When a defendant is booked into the Cois M. Byrd Detention Center or any other Riverside County facility, the phone is inventoried. With a search warrant — and modern law enforcement obtains them aggressively in serious cases — the phone is forensically imaged using tools like Cellebrite or GrayKey. These tools can recover deleted texts, deleted photos, deleted app data, location history, and much of what people assume was permanently gone. The phone in your pocket at the time of arrest is one of the most important evidence sources in your case.
4. Cooperating witnesses. A person who received your DMs, screenshotted your post before you deleted it, was tagged in your photo, or has a copy of a group chat can simply hand the material over to police. No subpoena required. No legal process. Anything you sent to anyone exists outside your control as soon as it is sent.
5. Open-source investigation. Specialized investigators within law enforcement use tools to aggregate publicly available information — old blog posts, public records, archived versions of social media accounts, news mentions, court filings, real estate records, and more. The picture they assemble can be more complete than what an individual defendant believes is publicly visible about themselves.
The Most Important Warning: Do Not Delete
If you take one thing from this article, take this: do not delete social media content after you have been arrested, charged, or notified of an investigation.
The temptation is overwhelming. A post looks bad in retrospect, or a photo could be misread, or a comment could embarrass — and the instinct is to remove it. That instinct, acted on, makes the case substantially worse for three reasons:
Spoliation of evidence under Penal Code § 135. California law makes it a misdemeanor to willfully destroy or conceal evidence with intent to prevent it from being produced in a legal proceeding. A defendant who deletes posts after learning of charges or an investigation can face an additional charge under PC § 135 on top of the original case.
Consciousness of guilt at trial. Even if no separate spoliation charge is filed, the prosecution can — and does — argue at trial that the deletion of social media content shows the defendant knew the content was incriminating. CALCRIM 371 explicitly permits jury argument that suppression of evidence shows consciousness of guilt. The deletion becomes evidence of the defendant’s awareness that the original post was harmful.
Deletion does not actually delete. Modern phone forensics recovers deleted content. Platform archives retain content for periods that exceed the user-facing deletion. Cooperating witnesses and screenshots preserve content the defendant cannot control. The defendant ends up with the worst of both worlds: the original post is still recoverable, and now the deletion itself is evidence.
The right strategy after charges are filed or an investigation begins is the opposite of deletion. Stop posting. Lock down account privacy settings. Preserve everything. Talk to your defense attorney about what to do with the existing material. A defense attorney can sometimes preserve content under attorney work-product and review it strategically — but that conversation has to happen before anything is deleted.
What Not to Post With a Pending Case
While not deleting is rule one, not posting anything new is rule two. The categories that consistently harm defendants in Riverside County criminal cases include:
- Anything about the case itself — the arrest, the charges, the alleged victim, the police, the prosecution, your version of events, your innocence, your remorse, your indignation
- Photos or posts that contradict an alibi — check-ins, location tags, geotagged photos, time-stamped content
- Photos with weapons, drugs, money, or contraband — even if unrelated to the case, these become “character” evidence
- Posts about the alleged victim — even apologetic ones, even friendly ones; particularly in criminal threats, domestic violence, or stalking cases
- Posts that violate a protective order — Penal Code § 136.2 protective orders frequently bar contact, and a tagged photo or a public mention of the protected person can constitute a new criminal offense
- Direct messages discussing the case — to anyone other than your attorney
- GoFundMe or fundraiser content — these are public, indexed, and routinely cited by prosecution as admissions; the framing of the fundraiser often contains statements that contradict the defense narrative
Old Posts Can Surface Years Later
Prosecutors are not limited to recent activity. Years-old photos, jokes, comments, likes, and shared content can be introduced as evidence if the prosecution can argue the material is relevant to motive, intent, identity, character, or credibility. Posts that seemed harmless or funny at the time can be reframed in the courtroom in a way the original poster never imagined.
This is especially true in cases where character or motive are central. A decade-old joke, a song lyric quoted in a post, a comment on someone else’s content, a like on a politically charged article — all of these have ended up in front of Riverside County juries.
We routinely audit a client’s social media history early in the representation. The goal is not to delete (see above) but to identify everything the prosecution is likely to find, assess its relevance, and prepare to address it — through motion practice, voir dire, or affirmative narrative at trial.
Direct Messages, Group Chats, and “Private” Communications
The word “private” in the social media context is misleading. Direct messages between users are private from the public, but they are not private from:
- Subpoenas to the platform, where the messages are stored on platform servers
- Forensic recovery from the recipient’s phone if it is searched
- The recipient themselves, who can simply screenshot and turn over the content
- Group chat participants beyond the original two parties
- Cloud backups on iCloud, Google Drive, or similar services, which sync messages and are subject to their own subpoena practice
Encrypted messaging applications — Signal, WhatsApp, Telegram, iMessage with end-to-end encryption — do offer meaningfully better protection against platform-level subpoena, because the content is not stored unencrypted on the platform’s servers. But they do not protect against the recipient’s cooperation, recipient’s phone forensics, or screenshots. A defendant who believes Signal makes their messages “uncatchable” is operating on a misunderstanding that has cost serious cases.
Social Media at the Southwest Justice Center
When a Riverside County criminal case proceeds to preliminary hearing and trial at the Southwest Justice Center, social media evidence faces evidentiary requirements:
- Authentication. California Evidence Code § 1400 et seq. requires that social media evidence be authenticated — shown to be what the prosecution says it is. This typically requires testimony from a custodian of records, the defendant or witness who created or received the content, or forensic evidence connecting the account to the defendant.
- Hearsay analysis. Statements within social media content may or may not be admissible depending on who said them and for what purpose they are offered.
- Best-evidence and chain-of-custody concerns — particularly for screenshots, where authentication can be contested.
A defense attorney experienced with social media evidence challenges those foundations rather than treating the prosecution’s exhibits as automatic. Many social media exhibits we have seen offered into evidence had foundation problems that, when raised, resulted in exclusion or limited use.
What to Do Right Now if You Have a Pending Case
If you are facing a criminal investigation or charges in Riverside County, take these steps today:
- Stop posting — anywhere, on any platform, about anything, until the case is resolved
- Do not delete existing content — see above; preserve everything as-is
- Set all accounts to maximum privacy — friends-only, private profiles, not searchable
- Stop discussing the case in DMs — except with your defense attorney, on attorney-client-privileged channels
- Tell family and friends not to post about you, the case, or the alleged victim — third-party posts can be subpoenaed and become evidence
- Audit any GoFundMe or fundraiser — these are highly visible and often counterproductive; talk to your attorney before launching one
- Save your passwords and recent screenshots of your accounts, in case accounts are later suspended, deactivated, or compromised
- Bring a complete picture to your defense attorney — every account, every username, every email, every old account you may have forgotten about
Talk With a Riverside County Defense Attorney
Social media evidence has become central to criminal defense in Riverside County. The question is not whether your online life will be examined — it is what is found, how it is framed, and whether your attorney is prepared to address it.
Learn more about attorney Nic Cocis and his 25+ years of trial experience defending Riverside County criminal cases.
Initial consultations are free and confidential. Call (951) 400-4357 today, or use the contact form below to schedule a consultation directly with attorney Nic Cocis.
