±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 5
New Yesterday: 5
Overall: 27203
Visitors: 87

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Facebook URLs

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Facebook URLs

Post Posted: Sat May 26, 2012 3:13 pm

Hello,

Is there a paper out describing the facebook URLs? So, if I can determine what each type means, what profiles they may have come from, etc.

Barring that, has anyone done a bunch of testing with facebook URLs that I can pick your brain?

Any help would be appreciated.  

twjolson
Senior Member
 
 
  

Re: Facebook URLs

Post Posted: Sun May 27, 2012 7:51 pm

I seem to recall a poster under the name DangerMouse mentioned doing a paper on Facebook a while back. Send him an email or PM.aybe he can help you. It's my understanding that while Facebook assigns url's for its members initially, they can be changed to a vanity url.
_________________
Ed

I'm not a cellular technology expert, but I did stay at a Holiday Inn Express last night. 

hcso1510
Senior Member
 
 
  

Re: Facebook URLs

Post Posted: Tue May 29, 2012 9:37 am

I am looking for interpreting picture URLs, rather than profile URLs (those are pretty easy.)

I sent him a message, but more help would be appreciated (since I don't know when/if he will log in before this case is put to bed).  

twjolson
Senior Member
 
 
  

Re: Facebook URLs

Post Posted: Wed May 30, 2012 9:59 am

- twjolson
Hello,

Is there a paper out describing the facebook URLs? So, if I can determine what each type means, what profiles they may have come from, etc.

Barring that, has anyone done a bunch of testing with facebook URLs that I can pick your brain?

Any help would be appreciated.


Some time ago I've seen an article called "Facebook Forensics". Maybe it helps?  

Belkasoft
Senior Member
 
 
  

Re: Facebook URLs

Post Posted: Wed May 30, 2012 11:14 am

When I was in college I wrote a paper on Facebook Forensics discussing both the legal and technical aspects of such a case. I did my technical testing using my Facebook account, friend profiles, and public data posted by people I did not know.

My recommendation is to do some testing on your own using Wireshark and your Facebook account. Since Facebook does not store much information in cache, watching the data using wireshark will prove beneficial.

Take a look at the bottom of this user manual from X1 Discovery. They documented Facebook metadata for reference. This data along with your testing should get you what you need.

www.x1discovery.com/do...Manual.pdf

Thanks

Jeromey


- twjolson
Hello,

Is there a paper out describing the facebook URLs? So, if I can determine what each type means, what profiles they may have come from, etc.

Barring that, has anyone done a bunch of testing with facebook URLs that I can pick your brain?

Any help would be appreciated.
 

jeromey
Newbie
 
 
  

Re: Facebook URLs

Post Posted: Fri Jun 01, 2012 7:11 am

Thank you for the replies. The suggested resources may not have everything I need, but it's a great start. I can research the rest, I think.  

twjolson
Senior Member
 
 
  

Re: Facebook URLs

Post Posted: Wed Jun 06, 2012 8:28 am

Ok, so after research, this is what I got, in case anyone after me needs this information. Facebook has a couple of different ways of naming images, so the below may not be correct for all image URLs. This is not meant to be exhaustive, as I could not decipher everything, and I restricted myself to pre-timeline profiles.

Small Profile Pictures : URL begins with profile., the image name is three sets of numbers and a q. OF the three, the middle number group is the users profile number. This seems to be true for every small profile image, regardless of where its found (feed, photo comments, etc). For example, profile.ak.fbcdn.net/h...9865_[user number]_4231_q.jpg.

Main Profile Picture : The main profile (non-timeline) picture is the same as above, but it has n in the filename. Example, profile.ak.fbcdn.net/h...0769_[user number]_2844677_n.jpg

Photo Album Photos thumbnails : Those preceded by photos- are thumbnails seen while browsing the photo album. They have five number groups in the file name (third is the user's profile number), and end with an a. Example, photos-h.ak.fbcdn.net/...0088_[user number]_2004440_6585801_a.jpg

Photo Album Full Size : These are preceded with sphotos (or sometimes a[num].sphotos), have five groups of numbers in the filename, of which the 3rd group is the user's profile. They will end in N, but I suspect they could end in o. The file name between the thumbnail and full size image will be the same, save for the image size letter (a vs. n/o) Example, a3.sphotos.ak.fbcdn.ne...494_[users number]_3682467_1173265838_n.jpg

Alternate naming convention for images : The other photos- image filename is a letter, and three number groups (rather than 5). Of the three groups, the first group is the users profile number. Example, photos-b.ak.fbcdn.net/...327/a[user number]_1432859_1161200.jpg

External Images : Images from websites other than Facebook (fbcdn.net). They have the form of external.ak.fbcdn.net/safe_image.php? and then an encoded URL. I noticed a lot coming from upload.wikimedia.org with a "&crop" string at the end. I don't know why.

Advertisments : preceded by creative. Example, creative.ak.fbcdn.net/...88ae8.jpg.


Image Sizes :
Each image has a letter as part of the file name. I've seen a, n, o, q, s, and these seem to be generic image sizes.
a : Seen in thumbnail images. Limited to 180 pixels on width.
n : Seen in main profile picture, Feed image thumbnail, and full size album picture. No common size was seen, but they are typically 'bigger'
o : Also seen in full size images. This one seemed to be larger than the n images.
q : Seen only in small profile images. File size was 50x50.
s : Only seen in Friend's Photos on the side of the main page. These seem to be limited to 130 pixels width.  

twjolson
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next