AboutDFIR.com – The Definitive Compendium Project
Digital Forensics & Incident Response

Legal Disclaimer

The information listed below is purely informational in nature and not meant to be a substitute for legal advice. One should consult with their respective jurisdiction’s district attorney, prosecutor, judge, etc prior to using this language for any legal process in an actual investigation. AboutDFIR and its authors are not liable for any content, accuracy, or context.

Serving Preservation Letters/Search Warrants

As stated on this section’s home page, for every digital investigation where a Preservation Letter or Search Warrant is involved, Search.org’s ISP List should be your number one stop regarding proper steps to serve your legal process.

Facebook Preservation Letters

Serving a Preservation Letter to Facebook is an incredibly simple process. All you need is the identifier for the Facebook account, i.e. whatever comes after www.facebook.com/suspectusername. Type in the identifier, specify the timeframe of records you want to be preserved, check a box and hit submit! Simple as that! No fancy signed letter required. Facebook’s LE Portal is found here. This portal is used for serving legal process for Facebook and Instagram.

Preservation Letter/Search Warrant Language Template

Pursuant to Title 18, United States Code, Section 2703(f), you are requested to preserve all records relating to any Facebook account(s) associated with the registered email address suspect@domain.com from X date/time to Y date/time UTC including but not limited to:

  • All user account information including but not limited to: account creation date, registered email address, registered phone number, associated payment methods (including billing address and name), and terms of service IP address
  • The content of all messages, public and private, sent by the above user, including deleted and edited messages
  • The content of all wall posts sent or received by the above user, including deleted wall posts and associated metadata
  • A list of all groups the above user was a member of and/or owned during the above timeframe
  • All images and media sent or received by the above user during the above timeframe 

Alternative Language

Any and all content for the Facebook account(s) with the username suspectusername from X date/time to Y date/time UTC including but not limited to:

Any and all content relating to any Facebook account(s) associated with the registered phone number 1-123-456-7890 from X date/time to Y date/time UTC including but not limited to:


It may be possible to discover other account(s) owned by the suspect using the verbiage above. As long as probable cause supports it, it doesn’t hurt to see what else the suspect is doing beyond known account(s). It may help your case become stronger. 

Also, Facebook URLs are NOT static. That’s why it’s crucial to have a timestamp associated with the specific username you’re looking for. They could be www.facebook.com/suspect.badguy one minute and wwww.facebook.com/badguy.suspect the next minute. If you only have usernames and no email or phone number associated with the account, you’re going to need to know as specific as possible timeframes for when he/she had the respective username(s). Facebook will not “round up” the usernames you give them. You need to know exactly which profile you’re looking to serve legal process on.

A common Facebook profile URL goes something like this: https://www.facebook.com/suspectusername. The bold text is the Facebook username. Sometimes it’s also displayed similarly but with a seemingly random string of numbers replacing the bold username. This string of numbers is the Facebook ID. Either of these can be used to properly identify your target Facebook account.