Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Social Media Forensics for Investigators


Published on

With 1.2 billion monthly active users on Facebook alone, it’s not surprising that social media networks can be a rich source of information for investigators. And because Americans spend more time on social media than any other major Internet activity, including email, social media information and evidence is plentiful. You just need to know how to get it.

Finding, preserving and collecting social media evidence often requires some forensic skills, as well as an understanding of the laws that govern its collection and use. It’s important for investigators to be aware of both the possibilities and limitations of social media forensics.

Published in: Business

Social Media Forensics for Investigators

  1. 1. Social Media Forensics for Investigators Andrew Neal, Director of Forensic Technology and Consulting at TransPerfect Legal Solutions 1
  2. 2. Andrew Neal Andrew Neal is an advisor, strategist and leader in the digital evidence and information security community with more than 30 years of experience. The execution and management of large digital forensics and e-discovery operations for corporations, law firms and government agencies frequently takes Andrew across the country and around the world. He leads investigations involving intellectual property theft, security breaches, regulatory issues, and other highly confidential matters. Andrew is a Director on the Forensic Technology and Consulting team at TransPerfect Legal Solutions, serving the needs of clients while planning and managing the growth of the organization.
  3. 3. Why does Social Media matter? Social Media by the Numbers
  4. 4. There are more than 200 active, non-dating, social networking sites. 1 billion Facebook users. More than 800 online sites allow account creating and content posting. 280 million twitter users 67% of Americans are on social media. Social Media by the Numbers
  5. 5. Social Media by the Numbers Social media has replaced Porn as the top web activity. YouTube has more than 1 billion unique monthly visitors. 500 million tweets per day. 350 million photos are uploaded to Facebook daily. YouTube reaches more adults than any cable network.
  6. 6. Social Media by the Numbers 22% of Americans use social media several times a day. 45-54 year olds are the fastest growing social media sector. More than half of Facebook users access via mobile devices. 20 million twitter accounts are fake 25% of Facebook users don’t bother with privacy settings.
  7. 7. Social Media Environment
  8. 8. Social Media Environment
  9. 9. Social Media Impacts Entertainment Information Communications Influence Evidence
  10. 10. Social Media Stakeholders Users Content Owners Investigators Service Providers Courts & Attorneys Law Enforcement Companies & Marketers The Public
  11. 11. Social Media Evidence What is Social Media Forensics? The application of computer investigation and analysis techniques to gather evidence from online sources, suitable for presentation in a court of law.
  12. 12. Social Media Evidence What Makes it Forensic? - Defensibility - Reproducible results - Accepted tools and techniques - Proper evidence handling & documentation - Objectivity - Application of the scientific method - Preservation of metadata
  13. 13. Social Media Evidence Sources for Social Media/Web Evidence - 200+ Social media outlets - 800+ Online services - Blogs - Company or personal websites - Group, club or special interest forums - Government web sites - Archival sites
  14. 14. Social Media Evidence Collection Methods - Screen scrape / Screen shot - Manual documentation - Open source tools (HTTrack) - Commercial tool (X1) - Web service (Pagefreezer) - Forensic recovery - Content subpoena
  15. 15. Social Media Evidence Evidence Samples
  16. 16. Social Media Evidence Twitter Anatomy RT @andreyavich: I am doing a social media forensics webinar today! #isight #tlsftac #socmed #forensics RT = re-tweet @xxxxxx = a twitter user name #xxxxxx = ‘hashtag’, a subject or reference identifier http://xxx = a link, usually shortened to fit in the tweet Remember, you only have 140 characters!
  17. 17. Social Media Evidence Twitter Feeds
  18. 18. Social Media Evidence Facebook Posts
  19. 19. Social Media Evidence LinkedIn Posts & Data
  20. 20. Social Media Evidence GeoLocation
  21. 21. Social Media – Example 1 Litigant’s Page was Private…
  22. 22. Social Media – Example 1 Boyfriend’s Page was not…
  23. 23. Social Media – Example 2 Expert presents an opinion about a highly technical matter in a hearing…
  24. 24. Social Media – Example 2 Expert presents an opinion about a highly technical matter in a hearing… …but explicitly contradicts herself in a very detailed article posted on her promotional and CV website.
  25. 25. Social Media Evidence Additional Facts Manage & conduct case as normal There is no native format Exact collection may not be possible There is no clear content ownership
  26. 26. Social Media Evidence Ethical Challenges Public vs. Private Pretexting Terms of Service Licensing & Jurisdiction
  27. 27. Social Media Evidence Technical Challenges Changing Technical Landscape Provider Limitations Content Diversity and Volume Transitory Nature Validated Tools
  28. 28. Social Media Final Thoughts Constant Evolution Social Media Crime & Litigation Increasing Social Media Legislation Technical & Legal Slow to Catch Up Increasing Privacy Awareness
  29. 29. Resources
  30. 30. Thank-you for participating If you have any questions, please feel free to email: Andrew Neal, Director, Forensic Technology and Consulting, TransPerfect Legal Solutions Joe Gerard, Vice President Marketing and Sales