Evidence artifacts vary depending on the social media channel and the device.

• A. Sometimes
• B. False
• C. Not enough information
• D. True

Answer: (D)

Artifacts recovered in digital forensics depend on where the data lives and how the app on a given device handles it. Social media platforms store and present data in different ways, with distinct data schemas, APIs, and retention policies. Some content stays on the device in local caches or databases, while other data lives in the cloud or is accessible only through platform-provided exports. On the device side, differences between operating systems and app versions mean distinct file formats, storage locations, and encryption levels. Because of these variations, the same channel on different devices can leave different traces, and different channels can leave different traces on the same device. That makes the statement true.