I really don't think I have the credentials to answer question 1. Just one side note, IP, at least alone, cannot be used to correlate a person to a user account, in court (but you probably already know that better than me as a lawyer). However, I certainly do agree that IP is very useful, if not crucial, as an artifact for the bigger argument.
2. As far as computer artifacts go, this YouTube video is a pretty good resource for how and what type of artifacts remain from social messaging activities if you chose to file carve a hard drive.
https://www.youtube.com/watch?v=57RWdYhNvq8
3. From what I have seen so far in term other people's forensics research, it seems that most of the more forensic identifications of social media activities come from or end up either from physically acquired devices (such as hard drives or phone), probably through a warrant of the hard drive in real life, and then trying to rebuild the event with some software or direct interactions with the person's Facebook account (such as keeping tabs on his/her posts or seeing what groups he/she follows), probably through a warrant as well, unless it was public information.
↧