I have a case where IEF was used to examine a computer but unfortunately at this time I do not own IEF.
What criteria does IEF use to carve out Facebook pictures?
When reading the IEF report it appears that the link(s) IEF is referring to are temporary internet cache links.
I guess my question would be, How does IEF determine that any particular link contains a Facebook image?
Thanks, and have a happy and safe 4th of July weekend.
Larry
Hi Larry,
To identify pictures as being from Facebook, IEF looks at the filename for a pattern that is consistent with how Facebook names JPG files. This also explains why they are in the Temporary Internet Files folders.
If you're interested in trying IEF for 30 days for free, please feel free to contact me directly jad (at) magnetforensics (dot) com .
Happy 4th of July!
Jad
Hello,
Which dept do you work for?
I have a case where IEF was used to examine a computer but unfortunately at this time I do not own IEF.
What criteria does IEF use to carve out Facebook pictures?
When reading the IEF report it appears that the link(s) IEF is referring to are temporary internet cache links.
I guess my question would be, How does IEF determine that any particular link contains a Facebook image?
Thanks, and have a happy and safe 4th of July weekend.
Larry
On this subject, I'm currently examining a Windows 10 machine, IEF has thrown out some images in the 'Facebook Pictures' section but they are full screenshots of all kinds of internet activity and PC setup etc. They don't look like they are in any way related to Facebook. The file paths are \Windows\SysWOW64\aamdata\ss1\ and the file names appear to be dates/times.
Can anyone help me with how they got there?
Here is a link to my response from a similar post. I hope this helps.
https://www.forensicfocus.com/Forums/viewtopic/t=16652/