±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 4
New Yesterday: 6
Overall: 27389
Visitors: 44

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Facebook URLs

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2 
  

Re: Facebook URLs

Post Posted: Fri Nov 16, 2012 1:08 pm

Just a quick note that Facebook has changed its CDN URLs.
At the time of the question, one could have assumed a generic format of 5 number groups (2 IDs, 3 pseudo random obfuscators - one for each ID, one for all) plus image type indicator, shortened to three number groups for certain purposes (1 ID, 2 pseudo random; e.g. profile pictures without the content ID and its random number, or album pictures without the UID and its random number).
Today only file names with three number groups should be retrieved through a facebook page. However, the CDN retains files matching the old naming convention.  

C.R.S.
Senior Member
 
 
  

Re: Facebook URLs

Post Posted: Tue Dec 04, 2012 11:57 am

One thing I have noticed in my current examination (unconnected with the one that spawned the original post).

As stated before, Facebook uses two types of Image URLs :
<num 1>_<num 2>_<facebook ID num>_<num 4>_<num 5>_<size letter>.jpg
<num1>_<num 2>_<num 3>_<size letter>.jpg

I have noticed that when a image has both the long and short format (maybe the suspect visited the image previously before the files were renamed to the shorter format), in this instance both the first, second, and third groups of the short name correspond to the first, second, and last groups in the long file name.

That is to say that one can convert a long filename to a short one by taking out groups 3 and 4.  

twjolson
Senior Member
 
 
  

Re: Facebook URLs

Post Posted: Tue Dec 04, 2012 1:05 pm

- twjolson

As stated before, Facebook uses two types of Image URLs :
<num 1>_<num 2>_<facebook ID num>_<num 4>_<num 5>_<size letter>.jpg
<num1>_<num 2>_<num 3>_<size letter>.jpg


Again: this info is outdated - in fact, I only commented on this, because it is outdated for the use in CDN exploitation, but might still be helpful for forensic artifacts.

The generic format formerly was

CIDrandom_CID_PID_PIDrandom_totalrandom_type.jpg

and could have been shortend to

CIDrandom_CID_totalrandom_type.jpg

for the purpose of privacy friendly linking. In this case, PIDrandom made it (a bit) difficult to check a PID against a shortened file name. The file with the short name could have been retrieved for _every_ photo having the long name. However, e.g. when parsing an album, photos were randomly delivered with long and short names.

Besides the generic format, there were special photo types, e.g. the pre-timeline profile picture, named like this:

PIDrandom_PID_totalrandom_type.jpg

Their type indicator did not correspond to type indicators in albums/to the generic naming convention. So the subject of a "n" profile picture might have been found in a better resolution under generic naming as an "n" album picture in the "profile pictures" album.

Today's three number groups are completely different.  

C.R.S.
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 2 of 2
Go to page Previous  1, 2