±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 5
New Yesterday: 5
Overall: 27325
Visitors: 70

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Facebook Private Messages

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Facebook Private Messages

Post Posted: Thu Aug 29, 2013 9:59 am

I have a case that requires the retreaval of Facebook Private Messages from a laptop computer. Has anyone come across this in the past and if so where would be the best place to start looking for these files. The IE is set to delete history when closed so there is no internet history on the computer. Any help that you can provide would be great.  

frostyx4
Newbie
 
 
  

Re: Facebook Private Messages

Post Posted: Thu Aug 29, 2013 10:15 am

Is it a specific message to a person?
Often the best bet is to get it from the other persons computer if possible. If the person has deleted the messages from their account then chances of recovering them are slim.

Do you know the content of the messages? Often a keyword search for some unusual terms used is a good start.

Failing that there will be artifacts left behind in a few places such as RAM, web browser cache, the pagefile, unallocated clusters and system restore points.

IEF from Magnet forensics is a good tool for recovering facebook data.
Good luck  

Ali-B
Member
 
 
  

Re: Facebook Private Messages

Post Posted: Thu Aug 29, 2013 4:20 pm

If you can get into the Facebook account you can download them fairly easily.  

sgreene2991
Member
 
 
  

Re: Facebook Private Messages

Post Posted: Thu Aug 29, 2013 6:43 pm

- sgreene2991
If you can get into the Facebook account you can download them fairly easily.


With the appropriate court order or written authorisation of the account holder, this may be a good option, however trying to access without this would be considered a criminal offence in many places Wink  

Adam10541
Senior Member
 
 
  

Re: Facebook Private Messages

Post Posted: Thu Aug 29, 2013 11:40 pm

There are no files for Facebook private messages. They are stored on Facebook servers only. However, there are some chances that you can find them in hibernation or pagefile. You can download our Belkasoft Evidence Center, which supports analysis of both types of files and is free to try at belkasoft.com/trial.
_________________
Digital Evidence Extraction Software
belkasoft.com 

Belkasoft
Senior Member
 
 
  

Re: Facebook Private Messages

Post Posted: Tue Sep 03, 2013 4:19 pm

- Adam10541
- sgreene2991
If you can get into the Facebook account you can download them fairly easily.


With the appropriate court order or written authorisation of the account holder, this may be a good option, however trying to access without this would be considered a criminal offence in many places Wink


I didn't say hack, I just said access Razz I've been given permission to access an account as well as court orders.  

sgreene2991
Member
 
 
  

Re: Facebook Private Messages

Post Posted: Wed Sep 04, 2013 6:07 am

Good afternoon Frostyx4,

Facebook communications are stored directly on the system servers, and so whilst you may find cached copies on the localhost of the sender/recipient, you may be best going to the source.

You can secure a production order/subpoena to have copy records served direct, or if you have authorised access to the account for either party to the exchange, then consider using an automated tool to log in and capture the communications. www.facebookforensics.com might do the trick, as well as capture all media/timeline/posts, generate audit logs and screen captures. If you want to send me a PM, I'll be able to give you some advice on Data Retention policies at FB and arrange for a licence - hope it helps with your casework.

Regards,
Ross  

AFENTIS_Forensics
Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next