Offence of defamation on Facebook

Phoebe010,

Do you have
a) The victim's computer?
b) The suspect's computer?
c) Any material from Facebook themselves?
d) A download/screenshot of the offending page?

Otherwise I don't know where to begin advising you.
It would also help to know what forensic software you are using (I use custom built EnScripts and search terms when recovering facebook pages)

Paul

Thank u Paul

Yes, u r right i'll tell u more details about this case.

The prosecutor want to seizure the pc of the authors of this crime and call me for the forensics acquisition data and forensic analysis.

I told him that it will very difficult to find something to demonstrate their guilty, because fb based on Ajax and on hd it's probably that nothing remains.

It woud be better to intercept data.

So i posted this message to receive a kind advise in order to know an alternative way to investigate in the case.

ty very much

I told him that it will very difficult to find something to demonstrate their guilty, because fb based on Ajax and on hd it's probably that nothing remains.

To be honest I haven't looked at a case like this yet but my colleagues tell me you are right. Nevertheless it might be a good idea to examine web browser history and cache records if they exist, especially if you have any times that the defamatory material was posted. You might also find copies of any photos that went with the posting (if there were any)

I would also get the appropriate permissions in law (which I would have to do in the UK) and request Facebook to release any material that they retain.

It woud be better to intercept data.

I agree, but this is a rarity in the kind of 'after the event' analysis that I usually undertake. Besides, intercepting data needs all sorts of special legal permissions before it can be done in the UK.

Paul

Sure! the idea about photos is very good, ty.

If that was possible, you could aquire in a forensically manner the photos and present them and their content in the trial.

ty very much…

performing a sniffing session is impossible since you are conducting a post-mortem examination.

if i were you, i would try some browser forensics. but everything depends on the specific situation you are working on, details that we don't have.

Thank you Rampage. …Yeah u mean the browser artifacts, ty

FB keep records of any profile nd wall posts. You need to work with LE to get FB to supply the info you are looking for, including possibly any emails, IP addresses used, email address used by the impersonator, etc. If you look at cryptome.org - you will find alleged 'leaked' docs on what info FB keep, and legally have to keep and how LEA's can request this info, though as you are not in US - it can be a very slow and tedious process to get the info you may be looking for as for all intents and purposes the offender may have wiped their computer, used other computers, etc. You may also want to preview friends profiles connected to the offender and may be able to get some shared posts from those contacts as well.

If it is simply FB chat - then your job will mostly certainly be that much moe challenging. An Intercept for defamation is something most LEAs may not agree to - but good luck trying. Also an intercept may not yield the evidence you want - if the offender stops defaming person X during the tap authorisation period. Best bet - befriend the offender & log all chats on your side or get a known friend to assist with this.

Just a thought.

what do you mean by browser artifacts?

Hi Mind

Thank u very much! i found your post very very interesting e useful also to careful thinking over )

cyl, ill write u about it