OSINT Jet · Public-post chronology

Social Media Timestamp OSINT: Work Out What Happened First

Two posts appear to contradict each other: one says an announcement came first, another says a video did. Sorting visible dates is easy. Establishing the order of the underlying events takes more care. A post time, an edit time and a screenshot time are different observations.

Write the events before comparing their clocks

“Was the public demonstration video available before the launch announcement?” asks about publication. “Was the demonstration filmed before the announcement?” asks about recording. A timestamp answering the first question may say nothing decisive about the second.

For each item, name the object and event: this post was published, this version was edited, this file was recorded, or this page was captured. Keep reposts as separate objects. A later copy can preserve an older scene, and an older post can carry text changed later. Read the surrounding conversation before treating its current wording as the original announcement.

The broader social media OSINT workflow covers profiles and context. Here the deliverable is smaller: an event-order finding that shows which dates were comparable.

A clock needs both a value and a meaning

Platform definitions matter. YouTube says snippet.publishedAt may differ from upload time: a previously private video later made public can carry the later publication time. Its reference describes exceptions for private-owner and unlisted cases. Read the definition matching your record; do not call every date a recording date. See YouTube’s video reference.

Normalize only what the source tells you

A timestamp with Z denotes UTC; a signed offset expresses how its local time relates to UTC. Keep the raw string and put the conversion in another column. The W3C date-time note explains these formats. A value without an offset must not silently inherit your computer’s timezone.

A country in a profile is not evidence of the timezone used to display a post. If a platform shows a date without a time, retain date-level precision until you find a stronger source. If a screenshot says “2h,” do not manufacture an exact minute by subtracting two hours unless the capture moment and display rule are established.

Use an explicit offset when available. If converting a named location’s clock, use the rules for the date being investigated, and document the tool and assumptions. Do not apply today’s offset to every historical date. With an unknown offset, an unresolved time window may be the honest output.

Worked example: a screenshot does not settle the race

Invented training case. A project announcement has a timestamp of 2026-09-03T10:20:00Z. A screenshot of a related video, supplied without its original post URL, shows only “3 September.” A reviewer claims the video must have been public before the announcement because they share a date.

The screenshot cannot support that order. Even granting a UTC interpretation for a separate illustrative calculation, a date-only record spans the day; 10:20 falls inside it. Without a known display timezone, uncertainty is wider. The correct initial result is “order unresolved,” not “video first.”

Now suppose a reliable original platform record is obtained. It identifies the same public video and supplies 2026-09-03T10:42:00Z as its publication time. That supports a narrower finding: this video’s recorded publication was 22 minutes after the announcement’s recorded publication. It does not establish when the demonstration was filmed, or whether another copy existed earlier.

Attach objects to the result: “Announcement A is recorded at 10:20 UTC and public video B at 10:42 UTC on 3 September. B follows A by 22 minutes in these publication records. Recording time and earlier copies remain outside this finding.”

Use intervals when a point would invent precision

If A is supported only within a window and B has an exact time, compare the whole window. You can say A preceded B only when the latest possible A is earlier than B. If the windows overlap, leave the sequence unresolved. This is a reasoning rule, not a confidence percentage.

Object / source URL:
Event being dated:
Timestamp exactly as shown:
Field meaning / platform reference:
Timezone or explicit offset:
Earliest and latest supported time:
Retrieval time and preserved copy:
Relation to the other event:
What could change the finding:

Distinguish a broad window from competing interpretations. If you do not know whether a date means publication or editing, conversion to UTC will not resolve the ambiguity. Establish the event definition first. A neat spreadsheet can otherwise conceal incomparable clocks.

Finish with a reproducible handoff

Keep direct post URLs, original timestamp strings, conversion steps and observation dates together. Label archive capture time separately. If a source disappears later, your note should clarify what you actually saw, rather than imply that the live page still displays it.

For a simple pair of posts, the worksheet is enough. When accounts, copied videos and company announcements form a larger story, a structured case can preserve those relationships. OSINT Jet’s AI investigation offering is designed to organize clues into a reviewable report. Include raw timestamps and unresolved event definitions in the brief; do not assume an automatic chronology is independently verified.

If chronology changes a consequential business decision, the manual investigation route offers an initial request with scope and price before paid work. Ask a bounded question, such as which public announcement is supported as earlier. The report template helps keep the answer and remaining limits visible.