Legal Disclaimer
The information listed below is purely informational in nature and not meant to be a substitute for legal advice. One should consult with their respective jurisdiction’s district attorney, prosecutor, judge, etc prior to using this language for any legal process in an actual investigation. AboutDFIR and its authors are not liable for any content, accuracy, or context.
Serving Preservation Letters/Search Warrants
As stated on this section’s home page, for every digital investigation where a Preservation Letter or Search Warrant is involved, Search.org’s ISP List should be your number one stop regarding proper steps to serve your legal process.
Instagram Preservation Letters
Serving a Preservation Letter to Instagram is an incredibly simple process. All you need is the identifier for the Instagram account, i.e. whatever comes after www.instagram.com/suspectusername. Type in the identifier, specify the timeframe of records you want to be preserved, check a box and hit submit! Simple as that! No fancy signed letter required. Facebook’s LE Portal is found here. This portal is used for serving legal process for Facebook and Instagram.
Search Warrant Language Template
Pursuant to Title 18, United States Code, Section 2703(f), you are requested to preserve all records relating to any Instagram account(s) associated with the registered email address suspect@domain.com from X date/time to Y date/time UTC including but not limited to:
- All user account information including but not limited to: account creation date, registered email address, registered phone number, associated payment methods (including billing address and name), and terms of service IP address
- The content of all messages, public and private, sent by the above user, including deleted and edited messages
- The content of all posts sent or received by the above user, including deleted posts and associated metadata
- A list of all users the above user followed and was followed by during the above timeframe
- All images, videos, and other media, including associated metadata, sent or received by the above user during the above timeframe
Alternative Language
Any and all content for the Instagram account(s) with the username suspectusername from X date/time to Y date/time UTC including but not limited to:
Any and all content relating to any Instagram account(s) associated with the registered phone number 1-123-456-7890 from X date/time to Y date/time UTC including but not limited to:
Notes
It may be possible to discover other account(s) owned by the suspect using the verbiage above. As long as probable cause supports it, it doesn’t hurt to see what else the suspect is doing beyond known account(s). It may help your case become stronger.
Also, Instagram usernames are NOT static. That’s why it’s crucial to have a timestamp associated with the specific username you’re looking for. They could be www.instagram.com/suspect.badguy one minute and wwww.instagram.com/badguy.suspect the next minute. If you only have usernames and no email or phone number associated with the account, you’re going to need to know as specific as possible timeframes for when he/she had the respective username(s). Instagram will not “round up” the usernames you give them. You need to know exactly which profile you’re looking to serve legal process on.
A common Instagram profile URL goes something like this: https://www.instagram.com/suspectusername. The bold text is the Instagram username. It is very important to obtain an accurate username for the purpose of serving legal process successfully.