±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36125
New Yesterday: 1 Visitors: 125

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Social networking solutions

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

paul206
Senior Member
 

Social networking solutions

Post Posted: May 14, 12 23:04

I do internal investigations and my boss asked me to find out what other organizations are doing to investigate Facebook abuse. We are on a budget freeze at the moment and are hoping someday to purchase current copies of Internet Evidence Finder and CacheBack. Right now I am using a very old copy of IEF that doesn't help much with Facebook. We figure that someday we will have to buy a network monitoring package that will catch them in the act but we don't know quite what to do until then short of installing keyloggers on all our computers. I can show them going to the login page from the history but nothing beyond that of course. What are other people doing for this or perhaps it is not much of an issue elsewhere.  
 
  

armresl
Senior Member
 

Re: Social networking solutions

Post Posted: May 15, 12 12:24

What is your position with the company?
_________________
Why order a taco when you can ask it politely?

Alan B. "A man can live a good life, be honorable, give to charity, but in the end, the number of people who come to his funeral is generally dependent on the weather. " 
 
  

paul206
Senior Member
 

Re: Social networking solutions

Post Posted: May 15, 12 17:18

I am a forensic examiner for a state government agency. I do not do criminal investigations I do internal HR investigations on employees. We have been increasingly frustrated trying to show excessive Facebook activity and understand that ultimately the way to see it is with real time monitoring but it will be a long time before we have the money for something like NetWitness.  

Last edited by paul206 on Jun 20, 12 01:32; edited 1 time in total
 
  

macguy
Newbie
 

Re: Social networking solutions

Post Posted: May 15, 12 18:57

why not just block the url in question?  
 
  

paul206
Senior Member
 

Re: Social networking solutions

Post Posted: May 15, 12 19:43

Because it is allowed and we don't have a proxy server and if we did we wouldn't block it anyway because we have our own Facebook page. Here is part of our internet use policy:

11. Personal Use. Moderate personal use of the Internet will be tolerated but excessive personal use is prohibited. Our policy does not allow for unrestricted personal use of the Internet. Users must adhere to other departmental and state acceptable use polices which prohibits employees from visiting certain web sites at any time.

50% of my investigations involve excessive personal use and 25% are for porn. The other 25% are real investigations for misuse, harassment, etc.  

Last edited by paul206 on Jun 20, 12 16:58; edited 1 time in total
 
  

pragmatopian
Senior Member
 

Re: Social networking solutions

Post Posted: May 15, 12 20:58

- paul206
We have been increasingly frustrated trying to show excessive Facebook activity and understand that ultimately the way to see it is with real time monitoring but it will be a long time before we have the money for something like NetWitness.


You don't really need NetWitness if all you need to monitor is Facebook usage. Just extract the relevant lines from your gateway logs, dump them into a database and slice and dice as you see fit. Microsoft Log Parser works well for logs from ISA, and there are plenty of free or cheap tools that can handle most other log formats.  
 
  

paul206
Senior Member
 

Re: Social networking solutions

Post Posted: May 17, 12 00:27

Thanks very much. I will talk to my boss about it. Only problem is that our routers and gateway don't belong to us. We have to request the logs when we want to see them from the state agency that supplies and administers them.  
 

Page 1 of 2
Page 1, 2  Next