hello all …
i am working on an new case and i need help … there is a person who leak a secret file from a PC on facebook ( PDF ) file so maybe he is used a facebook file attachment's feature !! 
where to start search ?
Two potential sources of evidence to analyze
1. Computer used to upload the PDF file
2.
If you have a forensic image of the computer used to upload the PDF file you can analyze internet access of the Facebook site as well as build a time line of how the PDF file first came to exist on the computer itself before being uploaded to Facebook.
If you have access to Facebookâs law enforcement portal you can download a complete archive of the target Facebook profile which will include evidence of the PDF file being uploaded.
I recommend preserving both the computer and the online Facebook profile in order to connect both sources of evidence.