A "someone has been in my account" report is usually a mix of real artefacts and anxiety. The useful work is separating them: what the account actually records, what it doesn't, and what a forensic examiner can still recover.

This is the checklist we run before anyone spends money on recovery — written for account owners, not for intruders.

1. Start with the record the platform keeps for you

Instagram and Facebook both keep a login history. In the app: Settings → Accounts Centre → Password and security → Where you're logged in . On the web: Settings → Login activity .

You are looking for a device, city or time you don't recognise. Two warnings:

VPN users get false positives. If you or your household use a VPN, a foreign city is expected.

The list is pruned. Logins fall off after a while, so absence of a strange entry proves nothing.

Screenshot it with a timestamp before you change anything. If the case later goes to a lawyer or the police, that screenshot is evidence and the account state is not.

2.…