With 1.2 billion monthly active users on Facebook alone, it’s not surprising that social media networks can be a rich source of information for investigators. And because Americans spend more time on social media than any other major Internet activity, including email, social media information and evidence is plentiful. You just need to know how to get it.
Finding, preserving and collecting social media evidence often requires some forensic skills, as well as an understanding of the laws that govern its collection and use. It’s important for investigators to be aware of both the possibilities and limitations of social media forensics.
1. Social Media Forensics for
Investigators
Andrew Neal, Director of Forensic Technology and Consulting at
TransPerfect Legal Solutions
1
2. Andrew Neal
Andrew Neal is an advisor, strategist and leader in the
digital evidence and information security community with
more than 30 years of experience. The execution and
management of large digital forensics and e-discovery
operations for corporations, law firms and government
agencies frequently takes Andrew across the country and
around the world.
He leads investigations involving intellectual property
theft, security breaches, regulatory issues, and other
highly confidential matters. Andrew is a Director on the
Forensic Technology and Consulting team at
TransPerfect Legal Solutions, serving the needs of clients
while planning and managing the growth of the
organization.
4. There are more than 200 active, non-dating, social
networking sites.
1 billion Facebook users.
More than 800 online sites allow account creating and
content posting.
280 million twitter users
67% of Americans are on social media.
Social Media by the Numbers
5. Social Media by the Numbers
Social media has replaced Porn as the top web activity.
YouTube has more than 1 billion unique monthly
visitors.
500 million tweets per day.
350 million photos are uploaded to Facebook daily.
YouTube reaches more adults than any cable network.
6. Social Media by the Numbers
22% of Americans use social media several times a
day.
45-54 year olds are the fastest growing social media
sector.
More than half of Facebook users access via mobile
devices.
20 million twitter accounts are fake
25% of Facebook users don’t bother with privacy
settings.
11. Social Media Evidence
What is Social Media Forensics?
The application of computer investigation and analysis
techniques to gather evidence from online sources, suitable
for presentation in a court of law.
12. Social Media Evidence
What Makes it Forensic?
- Defensibility
- Reproducible results
- Accepted tools and techniques
- Proper evidence handling & documentation
- Objectivity
- Application of the scientific method
- Preservation of metadata
13. Social Media Evidence
Sources for Social Media/Web Evidence
- 200+ Social media outlets
- 800+ Online services
- Blogs
- Company or personal websites
- Group, club or special interest forums
- Government web sites
- Archival sites
14. Social Media Evidence
Collection Methods
- Screen scrape / Screen shot
- Manual documentation
- Open source tools (HTTrack)
- Commercial tool (X1)
- Web service (Pagefreezer)
- Forensic recovery
- Content subpoena
16. Social Media Evidence
Twitter Anatomy
RT @andreyavich: I am doing a social media forensics webinar today!
#isight #tlsftac #socmed #forensics http://ow.ly/123456
RT = re-tweet
@xxxxxx = a twitter user name
#xxxxxx = ‘hashtag’, a subject or reference identifier
http://xxx = a link, usually shortened to fit in the tweet
Remember, you only have 140 characters!
23. Social Media – Example 2
Expert presents an opinion about a
highly technical matter in a
hearing…
24. Social Media – Example 2
Expert presents an opinion about a
highly technical matter in a
hearing…
…but explicitly contradicts herself
in a very detailed article posted on
her promotional and CV website.
25. Social Media Evidence
Additional Facts
Manage & conduct case as normal
There is no native format
Exact collection may not be possible
There is no clear content ownership
27. Social Media Evidence
Technical Challenges
Changing Technical Landscape
Provider Limitations
Content Diversity and Volume
Transitory Nature
Validated Tools
28. Social Media Final Thoughts
Constant Evolution
Social Media Crime & Litigation Increasing
Social Media Legislation
Technical & Legal Slow to Catch Up
Increasing Privacy Awareness
30. Thank-you for participating
If you have any questions, please feel free to email:
Andrew Neal, Director, Forensic Technology and Consulting,
TransPerfect Legal Solutions
ANeal@TransPerfect.com
Joe Gerard, Vice President Marketing and Sales
j.gerard@i-sight.com