Social media forens...
 
Notifications
Clear all

Social media forensic collections  

  RSS
Jonathan
(@jonathan)
Senior Member

I'd like to ask what tools/ methodologies people are using for admissible collection of data from social media services when you have possession of the subject's log in credentials.

Any feedback most appreciated.

Quote
Posted : 18/05/2014 3:30 pm
ludlowboy
(@ludlowboy)
Member

AFENTIS had a tool that was available on this website. The link was-

http//www.forensicfocus.com/Downloads/d_op=viewdownloaddetails/lid=161/

I have not used it myself but it may give you what you need.

ReplyQuote
Posted : 19/05/2014 1:01 am
BRAVEHEART
(@braveheart)
Junior Member

I'd like to ask what tools/ methodologies people are using for admissible collection of data from social media services when you have possession of the subject's log in credentials.

Any feedback most appreciated.

Hello Jonathan,

Option 1 - Image the subject's digital devices and run IEF (Internet Evidence Finder).

Option 2 - Use preservation and search warrant and request social media services to release the required data and this should include any deleted or amended data.

Option 3 - Use the settings options available in social media services, such as facebook for example and ask the subject to download data.

More options might be available as well depending on circumstances and case, and the type of data that is actually required and its importance in connecting it to the case.

BH.

ReplyQuote
Posted : 19/05/2014 3:00 am
BRAVEHEART
(@braveheart)
Junior Member

An article by Attorney Benjamin Wright who teaches at SANS . . . .

http//www.forensicmag.com/articles/2012/12/social-media-and-changing-role-investigators

ReplyQuote
Posted : 19/05/2014 3:54 am
Jonathan
(@jonathan)
Senior Member

Thank you ludlowboy and Braveheart - your option 3 appears to be the a reasonable method.

Jonathan

ReplyQuote
Posted : 19/05/2014 2:22 pm
lars
 lars
(@lars)
Junior Member

Thank you ludlowboy and Braveheart - your option 3 appears to be the a reasonable method.

If you are going that route, I'd suggest that you either ask the subject to give you the download link or observe them downloading it and then preserve the archive immediately. For most of the popular services (e.g. Facebook & Twitter), the download is a zip archive containing files most people would be able to tamper with if they wanted to before re-zipping and providing them to you.

Another option for credentialed access is X1 Social Discovery. At $1499, it's not cheap, but it works well.

Cheers,
Lars

ReplyQuote
Posted : 19/05/2014 10:47 pm
Jonathan
(@jonathan)
Senior Member

Thanks Lars, good points.

X1 Social Discovery looks good, will have a play with the trial version.

ReplyQuote
Posted : 20/05/2014 10:09 pm
nico248
(@nico248)
New Member

Hello,
If your intesrested, i have publish a freemind for digital forensic investigations
https://omnia-projetcs.googlecode.com/svn/trunk/OFD/Digital_forensic_helper_ENG.mm

Bests regards,

ReplyQuote
Posted : 21/05/2014 12:43 am
ThePM
(@thepm)
Active Member

In my testing last year, I found that X1 Social Discovery did a great job of collecting and indexing data from social media sites, but it was clearly behind when it came to reporting. I reported this to X1 and their response was that they were not focusing on reporting since this was at it's base an e-discovery product and they were relying on an external software to do the reporting… I have not tested since, but according to their release notes, there weren't any major overhaul of their reporting engine.

ReplyQuote
Posted : 21/05/2014 1:38 am
AFENTIS_Forensics
(@afentis_forensics)
Junior Member

keep in mind the excellent guidance from Judge Grimms on social media evidence and authentication of records. essential reading.

we have released the toolkits we developed for many popular social media platforms - http//afentis.com/forensic-software/ - free licences to law enforcement or you might want to join the beta team in exchange for a free licence.

Kind regards,
Ross @afentis

ReplyQuote
Posted : 21/05/2014 2:39 am
feerism
(@feerism)
New Member

hello,

another tool to download facebook profile, by Belkasoft

Belkasoft Facebook Profile Saver

ReplyQuote
Posted : 21/05/2014 3:40 pm
rondata
(@rondata)
New Member

In my testing last year, I found that X1 Social Discovery did a great job of collecting and indexing data from social media sites, but it was clearly behind when it came to reporting. I reported this to X1 and their response was that they were not focusing on reporting since this was at it's base an e-discovery product and they were relying on an external software to do the reporting… I have not tested since, but according to their release notes, there weren't any major overhaul of their reporting engine.

X1 Social Discovery was originally designed as a collection tool which delivered to/or imported into court-ready type software. We know that there are some great products out there that are somewhat of a staple in the legal communities such as concordance, summation etc. we didn't feel a need at the time to build upon what was already considered good review tools and focused on another tough area which was collection.

Having said that, we do listen to our customers and we have realized we have a real need for better deliverable and reporting options. On our side we have been working on this and having heard many suggestions (and realizing the challenge of building something so specific that meets everyone's individual needs) we have decided to start with building on one of the most requested reporting enhancements we receive –which is a more comprehensive PDF deliverable. We *do* plan to keep building in this area. )

Rhonda Rondeau
Product Manager - X1 Social Discovery

ReplyQuote
Posted : 23/05/2014 6:59 pm
Share: