Simply copy and paste the text below and ajust as necessary.

It is important to think outside the box, rember, Facebook will only give you what you ask for, and if you do not know what to ask for, then very important information will be ommitted.

Facebook Specific Discovery Requests:

The information sought for preservation and or productions is in relation the user(s) of and/or subscriber to your products and services listed herein below (hereinafter called “SUBJECT” [includes both singular and plural]).

Request for special handling

SUBJECT has a demonstrated history of going to extreme efforts to obfuscate their (plural includes singular) online activities, with multiple user accounts for different platforms.  As such, this production requests requires special handling as follows:

Phase One:

Using the limited information we provided herein, you should take reasonable steps to cross-reference the user information we have listed herein below, in order to identify any and all additional user accounts that we have not specifically listed, past and present, that were established or administered by SUBJECT. This cross referenceing should be readily available by analyzing user metrics, such as where a Mobile Facebook App switches profiles on the same device, or in the same session.

Phase Two:

Only after adding all additional account identifiers to the list we have specifically identified, you should then compile the historical log file records for the combined list of users (phase 1 and phase 2).

Account identifiers subject to this request (Phase 1)

  1. All Facebook AND Instagram AND WhatsApp account user information associated with the following email addresses, past or present:
    1. [email protected]????????.com
    2. [email protected]????????.net
  2. All Facebook AND Instagram AND WhatsApp account user information associated with the following phone numbers, past or present:
    1. +1-555-111-2222
    2. +98-111-222-3333
  3. All Facebook AND Instagram AND WhatsApp account user information associated with the following Instagram accounts, past or present:
    1. @?????XXXXX
    2. @?????ZZZZZ
  4. Any and all additional user account information, email addresses, phone numbers, facebook, whatsapp or Instagram accounts, that you identify as having ever been associated with:
    1. Any users associated with the above listed email addresses
    2. Any users associated with any additional email addresses that you identify as having been associated with any of the above account identifiers or users
    3. Any of the above phone numbers
    4. Any users associated with any additional phone numbers that you identify as having been associated with any of the above phone numbers
  5. Jurisdiction and IP Addresses
    1. It has been noted that is some cases, Facebook has only provided IP addresses that originate within the jurisdiction of the relevant case. We are specifically requesting ALL IP ADDRESSES without regard to jurisdiction, because it is likely that the user has used sophisticated means to obfuscate his/her activities, including the use of proxy connections.
  6. Comprehensive History Request
    1. It has been noted in the past that is some cases, Facebook has only provided a very limited history of IP address connections, sometimes only the last connection to any given account that us subject to requests such as this. Whereas, this request is for production of ALL AVAILABLE HISTORICAL RECORDS associated with the user accounts.
  7. Switched Accounts for both Facebook and Instagram accounts
    1. This request should be construed to include every Facebook and Instagram account past or present, that the user been associated with the above user accounts (Phase 1 and 2) using the “Account Switching” provision for the Facebook and Instagram mobile apps.
  8. For each associated switched account that you identify, but has not been specifically included in the above list, provide all the information that has been requested in this production request, as if it were specifically requested.
  9. Facebook and Instagram Account User Information
  10. Produce the following information for each User account associated with the user(s), past or present, even if not specifically identified in this production request.
    1. The first and last names given when first establishing the Facebook User account.
    2. Date of birth
    3. If applicable, each and every name used for this account and the date such names were changed.
    4. Primary email address and any other email addresses past or present, associated with the account(s)
  11. Password recovery and Security Challenge information:
    1. Provide the current recovery e-mail address.
    2. If applicable, each and every previous recovery e-mail address that has been used for this account and the date such addresses were changed.
  12. All other contact information including but not limited to telephone numbers
  13. The most recent phone number used to verify the user account(s) by way of phone call or SMS text message if applicable.
  14. If applicable, each and every previous phone number that has been used to verify, or in any way associated with the account(s), and the date such addresses were changed.
  15. If applicable, provide all other names associated with each account, if the display names have been changed, and the date of change.
  16. 2-factor authentication:
    1. All phone numbers, email addresses or other contact methods associated with any 2-factor authentication or password recovery provisions.
  17. All phone numbers used at any time past or present in response to any security or abuse challenges issued by the Facebook service.
  18. The details of any other method, or medium used in the process of verifying the user’s identity or details.
  19. Any additional information that may assist in positively identifying the Facebook Account Holder.
  20. Login Information
    1. Provide the connection log information for each and every account
    2. A comprehensive list of each and every historical IP Address connection made to each account
    3. The date, time for each connection
    4. Identify the time-zone used by your log system as captured by javascript etc.
    5. Identify all language preference settings captured during each session, for all languages listed for the device
  21. Provide the user agent details for each access including browser and version, operating system and version, and any other logged information for each connection/session.

——END——

Did we miss something?

If you or your agency has an suggestions for imrpovement of this resource, please contact us with edit suggestions.

Simply copy and paste the text below and ajust as necessary.

It is important to think outside the box, rember, Facebook will only give you what you ask for, and if you do not know what to ask for, then very important information will be ommitted.

Production Request

This document is an addendum to a SUBPOENA FOR PRODUCTION OF RECORDS relating to a Facebook user (“SUBJECT”) described herein.

You are requested to produce all records described in this subpoena. This information is directly relevant to 

[Add justification here]

The information should be readily accessible to you by computer search, and accessing it should not prove to be unduly burdensome.

Due to the proprietary nature of your records and the absence of publicly available information, we are unable to identify the account holder(s) through any other means. Ergo, it is impossible to positively identify the defendants without your assistance in this matter.

REQUEST FOR EXPEDITED PRODUCTION:

Furthermore, due to the perishable nature of the originating I.P address logs held by the Internet Service Provider/s utilized by the SUBJECT in order to connect to your services, with retention policies often being only one to six months, we respectfully request that you make every effort to expedite this request to avoid the loss of extremely important IP address log evidence held by the yet to be identified originating ISP.

OBJECTIONS

In the interests of expedience, if for any reason you reasonably object to any specific items in this production request, simply produce the records for which you do not object and preserve all other requested information and evidence until such time that your objections are addressed. It could be that your limited production may suffice for our needs, without need for your information that is subject of your objections.

THIS IS NOT A REQUEST FOR THE CONTENTS OF ANY PRIVATE MESSAGES or other communications sent to or from the user(s) described herein and protected by relevant laws. If you construe any requests herein to be protected by applicable laws, we request that you ignore only those specific requests and provide whatever information you are able at this time, and advise the basis for any objections.

[IF you do seek private communications, then you may need court order, check with prosecutor]

Request for flexibility

If this request is descriptively deficient in any way, then use your best judgment to discern our intent and produce what is requested and any other information that will help us identify the individual that utilized or accessed the services described herein. Furthermore, if you require any clarifying language please contact us at your earliest convenience.

Production delivery instructions: XXXXXXXX
A scanned and email of the original response would also be helpful in expediting the resolution of this case.
(If electronic production alone is acceptable, then give clear instructions)

 

 

ATTACHMENT A

The information sought for preservation and or productions is in relation the user(s) of and/or subscriber to your products and services listed herein below (hereinafter called “User” [includes both singular and plural]).

 

  1. Request for special handling

The defendant in this case has a demonstrated history of going to extreme efforts to obfuscate her online activities, with multiple user accounts for different platforms.  As such, this production requests requires special handling as follows:

  1. Phase One:

Using the information we provided herein, you should take reasonable steps to cross-reference the user information we have listed herein below, in order to identify additional user accounts that we have not listed, past and present, that were established or administered by (Insert Nina’s full name)

  1. Phase Two:

Only after adding all additional account identifiers to the list we have specifically identified, should you compile the historical log file records.

  1. Account identifiers subject to this request (Phase 1)
    1. All Facebook AND Instagram AND WhatsApp account user information associated with the following email addresses, past or present:
      1. [email protected]
      2. [email protected]
  1. [email protected]
  2. [email protected]
  3. [email protected]
  1. [email protected]
  2. [email protected]
  3. [email protected]
  1. All Facebook AND Instagram AND WhatsApp account user information associated with the following phone numbers, past or present:
    1. 929-373-9269
    2. 917-721-7221
  • 650-666-7002
  1. 917-783-8926
  2. 917-808-9635
  3. 646-714-8015
  • 929-373-9269
  1. All Facebook AND Instagram AND WhatsApp account user information associated with the following Instagram accounts, past or present:
    1. @temporary_palaces
    2. @elle_blomqvist
  • @elle.blomqvist
  1. @welcometoearthxaea12
  2. @ilumblom
  3. @NinelleEfremova
  • @temporary_palaces
  1. Any and all additional user account information, email addresses, phone numbers, facebook, whatsapp or Instagram accounts, that you identify as having ever been associated with:
    1. Any users associated with the above listed email addresses
    2. Any users associated with any additional email addresses that you identify as having been associated with any of the above account identifiers or users
  • Any of the above phone numbers
  1. Any users associated with any additional phone numbers that you identify as having been associated with any of the above phone numbers
  1. Jurisdiction and IP Addresses

It has been noted that is some cases, Facebook has only provided IP addresses that originate within the jurisdiction of the relevant case. We are specifically requesting ALL IP ADDRESSES without regard to jurisdiction, because it is likely that the user has used sophisticated means to obfuscate his/her activities, including the use of proxy connections.

  1. Comprehensive History Request

It has been noted in the past that is some cases, Facebook has only provided a very limited history of IP address connections, sometimes only the last connection to any given account that us subject to requests such as this. Whereas, this request is for production of ALL AVAILABLE HISTORICAL RECORDS associated with the user accounts.

  1. Switched Accounts for both Facebook and Instagram accounts
    1. This request should be construed to include every Facebook and Instagram account past or present, that the user been associated with the above user accounts using the “Account Switching” provision for the Facebook and Instagram mobile apps.
    2. For each associated switched account, provide all the information that has been requested in this production request, as if it were specifically requested.
  2. Facebook and Instagram Account User Information
    1. Produce the following information for each User account associated with the user(s), past or present, even if not specifically identified in this production request.
      1. The first and last names given when first establishing the Facebook User account.
      2. If applicable, each and every name used for this account and the date such names were changed.
  • Primary email address and any other email addresses past or present, associated with the account(s)
  1. Password recovery and Security Challenge information:
    1. Provide the current recovery e-mail address.
      1. If applicable, each and every previous recovery e-mail address that has been used for this account and the date such addresses were changed.
    2. All other contact information including but not limited to telephone numbers
  • The most recent phone number used to verify the user account(s) by way of phone call or SMS text message if applicable.
    1. If applicable, each and every previous phone number that has been used to verify, or in any way associated with the account(s), and the date such addresses were changed.
  1. 2-factor authentication:
    1. All phone numbers, email addresses or other contact methods associated with any 2-factor authentication or password recovery provisions.
    2. All phone numbers used at any time past or present in response to any security or abuse challenges issued by the Facebook service.
  • The details of any other method, or medium used in the process of verifying the user’s identity or details.
  1. Any additional information that may assist in positively identifying the Facebook Account Holder.
  1. Login Information
    1. Provide the connection log information for each and every account
      1. A comprehensive list of each and every historical IP Address connection made to each account
      2. The date, time for each connection
  • Identify the time-zone used by your log system
  1. Provide the user agent details for each access including browser and version, operating system and version, and any other logged information for each connection/session.
  1. User Agent Details:
    1. The user agent details for each user connection including browser and version, operating system and version, and any other logged information.

Simply copy and paste the text below and ajust as necessary.

It is important to think outside the box, rember, Facebook will only give you what you ask for, and if you do not know what to ask for, then very important information will be ommitted.

Production Request

This document is an addendum to a SUBPOENA FOR PRODUCTION OF RECORDS relating to a Facebook user (“SUBJECT”) described herein.

You are requested to produce all records described in this subpoena. This information is directly relevant to 

[Add justification here]

The information should be readily accessible to you by computer search, and accessing it should not prove to be unduly burdensome.

Due to the proprietary nature of your records and the absence of publicly available information, we are unable to identify the account holder(s) through any other means. Ergo, it is impossible to positively identify the defendants without your assistance in this matter.

REQUEST FOR EXPEDITED PRODUCTION:

Furthermore, due to the perishable nature of the originating I.P address logs held by the Internet Service Provider/s utilized by the SUBJECT in order to connect to your services, with retention policies often being only one to six months, we respectfully request that you make every effort to expedite this request to avoid the loss of extremely important IP address log evidence held by the yet to be identified originating ISP.

OBJECTIONS

In the interests of expedience, if for any reason you reasonably object to any specific items in this production request, simply produce the records for which you do not object and preserve all other requested information and evidence until such time that your objections are addressed. It could be that your limited production may suffice for our needs, without need for your information that is subject of your objections.

THIS IS NOT A REQUEST FOR THE CONTENTS OF ANY PRIVATE MESSAGES or other communications sent to or from the user(s) described herein and protected by relevant laws. If you construe any requests herein to be protected by applicable laws, we request that you ignore only those specific requests and provide whatever information you are able at this time, and advise the basis for any objections.

[IF you do seek private communications, then you may need court order, check with prosecutor]

Request for flexibility

If this request is descriptively deficient in any way, then use your best judgment to discern our intent and produce what is requested and any other information that will help us identify the individual that utilized or accessed the services described herein. Furthermore, if you require any clarifying language please contact us at your earliest convenience.

Production delivery instructions: XXXXXXXX
A scanned and email of the original response would also be helpful in expediting the resolution of this case.
(If electronic production alone is acceptable, then give clear instructions)

 

 

ATTACHMENT A

The information sought for preservation and or productions is in relation the user(s) of and/or subscriber to your products and services listed herein below (hereinafter called “User” [includes both singular and plural]).

 

  1. Request for special handling

The defendant in this case has a demonstrated history of going to extreme efforts to obfuscate her online activities, with multiple user accounts for different platforms.  As such, this production requests requires special handling as follows:

  1. Phase One:

Using the information we provided herein, you should take reasonable steps to cross-reference the user information we have listed herein below, in order to identify additional user accounts that we have not listed, past and present, that were established or administered by (Insert Nina’s full name)

  1. Phase Two:

Only after adding all additional account identifiers to the list we have specifically identified, should you compile the historical log file records.

  1. Account identifiers subject to this request (Phase 1)
    1. All Facebook AND Instagram AND WhatsApp account user information associated with the following email addresses, past or present:
      1. [email protected]
      2. [email protected]
  1. [email protected]
  2. [email protected]
  3. [email protected]
  1. [email protected]
  2. [email protected]
  3. [email protected]
  1. All Facebook AND Instagram AND WhatsApp account user information associated with the following phone numbers, past or present:
    1. 929-373-9269
    2. 917-721-7221
  • 650-666-7002
  1. 917-783-8926
  2. 917-808-9635
  3. 646-714-8015
  • 929-373-9269
  1. All Facebook AND Instagram AND WhatsApp account user information associated with the following Instagram accounts, past or present:
    1. @temporary_palaces
    2. @elle_blomqvist
  • @elle.blomqvist
  1. @welcometoearthxaea12
  2. @ilumblom
  3. @NinelleEfremova
  • @temporary_palaces
  1. Any and all additional user account information, email addresses, phone numbers, facebook, whatsapp or Instagram accounts, that you identify as having ever been associated with:
    1. Any users associated with the above listed email addresses
    2. Any users associated with any additional email addresses that you identify as having been associated with any of the above account identifiers or users
  • Any of the above phone numbers
  1. Any users associated with any additional phone numbers that you identify as having been associated with any of the above phone numbers
  1. Jurisdiction and IP Addresses

It has been noted that is some cases, Facebook has only provided IP addresses that originate within the jurisdiction of the relevant case. We are specifically requesting ALL IP ADDRESSES without regard to jurisdiction, because it is likely that the user has used sophisticated means to obfuscate his/her activities, including the use of proxy connections.

  1. Comprehensive History Request

It has been noted in the past that is some cases, Facebook has only provided a very limited history of IP address connections, sometimes only the last connection to any given account that us subject to requests such as this. Whereas, this request is for production of ALL AVAILABLE HISTORICAL RECORDS associated with the user accounts.

  1. Switched Accounts for both Facebook and Instagram accounts
    1. This request should be construed to include every Facebook and Instagram account past or present, that the user been associated with the above user accounts using the “Account Switching” provision for the Facebook and Instagram mobile apps.
    2. For each associated switched account, provide all the information that has been requested in this production request, as if it were specifically requested.
  2. Facebook and Instagram Account User Information
    1. Produce the following information for each User account associated with the user(s), past or present, even if not specifically identified in this production request.
      1. The first and last names given when first establishing the Facebook User account.
      2. If applicable, each and every name used for this account and the date such names were changed.
  • Primary email address and any other email addresses past or present, associated with the account(s)
  1. Password recovery and Security Challenge information:
    1. Provide the current recovery e-mail address.
      1. If applicable, each and every previous recovery e-mail address that has been used for this account and the date such addresses were changed.
    2. All other contact information including but not limited to telephone numbers
  • The most recent phone number used to verify the user account(s) by way of phone call or SMS text message if applicable.
    1. If applicable, each and every previous phone number that has been used to verify, or in any way associated with the account(s), and the date such addresses were changed.
  1. 2-factor authentication:
    1. All phone numbers, email addresses or other contact methods associated with any 2-factor authentication or password recovery provisions.
    2. All phone numbers used at any time past or present in response to any security or abuse challenges issued by the Facebook service.
  • The details of any other method, or medium used in the process of verifying the user’s identity or details.
  1. Any additional information that may assist in positively identifying the Facebook Account Holder.
  1. Login Information
    1. Provide the connection log information for each and every account
      1. A comprehensive list of each and every historical IP Address connection made to each account
      2. The date, time for each connection
  • Identify the time-zone used by your log system
  1. Provide the user agent details for each access including browser and version, operating system and version, and any other logged information for each connection/session.
  1. User Agent Details:
    1. The user agent details for each user connection including browser and version, operating system and version, and any other logged information.