I'm involved in a lawsuit about an alleged unauthorized login to my social media account more than two years ago. My account download only includes six months of login IPs, and an attorney told me the site deletes them after nine months.
Could older IP data still exist somewhere, such as in a deletion log or backup? What should I ask the attorney?
That depends on the site's actual retention and logging setup. The six months in your download tells you what's available through that feature, not necessarily everything the company retains. But if the nine-month deletion policy covers the relevant records, the IP may simply be gone.
Ask your attorney whether they can find out if separate authentication logs, security audit trails, raw server logs or backups cover the date in question. A subpoena can request records, but it can't bring back data that no longer exists.
I wouldn't count on a deletion log containing the deleted IP. A cleanup job might record that it ran, or how many records it removed, without preserving each record's contents.
Backups are a separate question. They might contain older data, but that depends on the site's backup and deletion practices. Your attorney can ask whether any relevant backup exists and whether the information is retrievable from it.
Also ask about records other than the login IP itself. The site might retain device or location information separately from its login history, though there's no guarantee it does, or that those records would identify the login you're investigating.
Answers are reviewed before publication.
d9!regwatch_481:
That could give the attorney another avenue to check, but device or location data wouldn't necessarily establish who used the account.