The situation
A medium-sized contractor company in the construction industry was being targeted by defamatory comments posted from an anonymous Facebook account. The posts were damaging the company’s reputation, but the anonymity of the account made it unclear who was responsible or how to stop the attacks.
Details in this case study have been altered to protect client confidentiality. The core facts, forensic methodology, and outcomes are accurate.
What we found
NDF’s forensic analysis of the posts and available metadata revealed identifiable patterns in the content, timing, and style of the defamatory material. These patterns, combined with industry knowledge and contextual analysis, allowed NDF to narrow the pool of likely suspects to four individuals within the industry.
How we responded
NDF conducted a forensic analysis focused on attribution:
- Post and metadata analysis, examining the content, timing, language patterns, and any available technical metadata from the anonymous Facebook posts
- Pattern recognition, identifying consistencies across posts that pointed toward a limited set of individuals
- Suspect narrowing, reducing the field to four industry individuals based on the forensic evidence
- Legal coordination, providing the findings to the client’s solicitor, who sent letters to the identified suspects
The outcome
When the solicitor’s letters were received, one of the four suspects responded with extreme anger, a reaction that strongly suggested they were the author of the defamatory posts. Days later, the defamatory post was removed from Facebook without any further legal intervention being required. The matter was resolved without court proceedings.
Lessons for similar organisations
- Online anonymity is rarely absolute. Even without direct access to platform data, forensic analysis of publicly available information can significantly narrow the field of suspects.
- Behavioural responses are evidence. An extreme reaction to a formal inquiry can be as telling as technical evidence. The combination of forensic analysis and legal pressure often produces results.
- Early forensic involvement saves legal costs. By narrowing suspects before litigation, the client avoided the cost and delay of broad-based discovery or court applications to compel platform disclosure.