The original live video of last week’s Christchurch attacks was viewed 4,000 times before it was removed, Facebook has said.
On Friday, a gunman live-streamed for 17 minutes the attack on two mosques that killed 50 people.
Fewer than 200 people had watched it live and the first user report of the video had come 12 minutes after it had ended, Facebook said.
But by then a copy had been placed on alt-right file-sharing site 8chan.
Once alerted to the video, Facebook removed the original and hashed it – essentially made a digital fingerprint – meaning that material that was visibly similar to the original could be automatically detected and removed.
And within 24 hours, it had blocked 1.2 million copies at the point of upload and deleted another 300,000.
However, copies that had been edited or recorded from a screen had proved harder to spot.
It said it was working with the New Zealand Police on its investigation.