Archiving X posts as evidence for journalism and research

Posts disappear. Accounts get deleted, suspended or made private. Videos are removed after copyright claims, or by the poster once a story gets attention. For journalists, researchers, human-rights workers and lawyers, a post that matters today may be gone tomorrow, and a lone screenshot is easy to dispute.

This guide sets out a practical workflow for preserving X posts in a way that holds up better to scrutiny later. It draws on widely used open-source investigation practice, such as the principles in the Berkeley Protocol on Digital Open Source Investigations. It is not a legal standard. Courts, editors and ethics boards each have their own requirements, so check with them for high-stakes work.

The core idea: layers of preservation

No single method is enough. A screenshot shows what you saw, but it's easy to fake. A web archive is independent, but it may fail to capture video. A downloaded file preserves the media but loses context. Together they corroborate each other.

For each important post, aim to capture:

1. A full-page screenshot or recording of the post as you saw it.
2. An independent web-archive copy made by a third party.
3. The original media files (video, images) at the best available quality.
4. Cryptographic hashes of your files.
5. A capture log recording who captured what, when, how and from where.

Step 1: Capture the post as you see it

• Open the post's own page (the URL with /status/ and a long number), not just the timeline view.
• Take a full-page screenshot that includes the URL bar, the account name and handle, the post text, the date and time, and engagement counts. Browser built-ins work: in Firefox, right-click → Take Screenshot → Save full page; in Chrome, DevTools has a "Capture full size screenshot" command.
• For a video, consider a screen recording of the post playing, with the URL visible. It documents that the video played in that post at that time.
• Capture replies and quote posts if they're relevant context, as separate screenshots.
• Note that the time shown on X is in your device's timezone. Write down your timezone in the log. Each post's ID also encodes its creation time, which tools can decode, a useful cross-check.

Step 2: Create an independent archive

Third-party archives give you a copy that you didn't make yourself, which is valuable if your own captures are ever questioned.

• Internet Archive Wayback Machine: go to web.archive.org, paste the post URL into Save Page Now, and save the resulting archive URL. Captures of X pages don't always work fully (X relies heavily on JavaScript and may block or limit archivers), so open the archived copy and check what it actually shows.
• archive.today (archive.ph) uses a different capture method and sometimes succeeds where the Wayback Machine doesn't. Again, check the result.
• Save every archive URL in your log, even failed attempts, with the time.

Be aware that public archiving makes the content more visible. For sensitive material (victims, minors, private individuals), don't create public archives. Keep your preservation private (see the ethics section).

Step 3: Preserve the original media

Screenshots don't preserve video, and archives often miss it. Save the media files themselves:

• Use a tool that saves the highest-quality variant the post serves. For public posts, TwitterDownloaderX lists the variants X has and doesn't re-encode or watermark the file, which matters for evidence. You want X's file, not a modified copy.
• Keep the file exactly as downloaded. Do your analysis (trimming, enhancing, frame grabs) on a working copy, never on the master.
• Name files consistently, for example 2026-10-14_1430UTC_handle_postid_1080p.mp4.
• Download images too, and any linked media you need.

For your own account's content, the official X data archive is an additional, authoritative source.

Step 4: Hash your files

A cryptographic hash is a short fingerprint of a file. If even one byte changes, the hash changes. Recording a hash right after capture lets you show later that the file hasn't been altered since.

Use SHA-256:

• Mac / Linux: shasum -a 256 file.mp4 (or sha256sum file.mp4 on Linux)
• Windows (PowerShell): Get-FileHash file.mp4 -Algorithm SHA256

Record the hash in your log next to the filename. Hash the screenshots too.

A hash proves integrity from the moment you made it, not authenticity of the original content. A fake video hashed today still has a valid hash. Verification is a separate step.

Step 5: Keep a capture log

A simple spreadsheet is enough. For each item, record:

• post URL and post ID
• account handle and display name at the time of capture (both can change)
• date and time of capture, with timezone
• who captured it
• method and tool (browser and version, screenshot tool, downloader)
• filenames and SHA-256 hashes
• archive URLs (Wayback, archive.today) and whether they captured the media
• notes: deleted later? edited? visible only when logged in?

Store the log with the files, and back both up in at least two places. If several people work on an investigation, record chain of custody: who had the files, and when they were moved or copied.

Step 6: Extract and record metadata, carefully

• X strips most embedded metadata (such as camera GPS and device info) from uploaded media, so don't expect location data in downloaded files. Its absence isn't suspicious.
• The metadata that matters is platform context: post time, account details, the post text, replies, and where the video appeared first.
• Tools like MediaInfo or ffprobe show technical details (resolution, codec, duration). Record them. They can help match copies of the same video across platforms.

Verification is a separate job

Preserving a post isn't the same as verifying it. Before relying on a video:

• Find the earliest upload. Search for the same clip on other platforms; reverse-search key frames.
• Check the account. Creation date, history, whether it usually posts original content.
• Geolocate and chronolocate using landmarks, signage, shadows and weather.
• Contact the uploader when it's safe, both to verify and to ask permission for use.

Ethics and safety

• Minimise harm. Content may show victims, children or bystanders. Preserve what you need, restrict access, and blur faces in any published version where appropriate.
• Respect privacy. Archiving a public figure's statement is different from archiving a private person's post that went viral. Public archiving tools make content more findable. Use private preservation for sensitive cases.
• Don't bypass protections. Accessing protected accounts, using someone else's credentials or misrepresenting yourself to gain access raises serious ethical and often legal problems. Our tool deliberately only reads public posts.
• Copyright still applies. Preserving for research or reporting is a recognised purpose in many legal systems, but publishing the full video is a separate decision. See our fair use guide.
• Protect yourself. For investigations into dangerous subjects, consider operational security: separate accounts, devices and secure storage.

Troubleshooting

The Wayback Machine capture shows a blank page or a login wall. This is common with X. Try archive.today, and rely more on your own screenshots, recordings, files and hashes. Document the failed attempt.

The video can't be downloaded. It may be age-restricted, withheld in your country, or from a protected account. See why some X videos can't be downloaded. A screen recording may be the only option, so document it carefully.

The post was deleted before I captured it. Check the Wayback Machine and archive.today for existing captures by others, and search for quote posts or replies that reproduce it. Record where each copy came from.

Timestamps differ between my screenshot and the archive. Usually a timezone difference. Convert everything to UTC in your log.