1.
Social Media Forensics for
Investigators
Andrew Neal, Director of Forensic Technology and Consulting at
TransPerfect Legal Solutions
1

2.
Andrew Neal
Andrew Neal is an advisor, strategist and leader in the
digital evidence and information security community with
more than 30 years of experience. The execution and
management of large digital forensics and e-discovery
operations for corporations, law firms and government
agencies frequently takes Andrew across the country and
around the world.
He leads investigations involving intellectual property
theft, security breaches, regulatory issues, and other
highly confidential matters. Andrew is a Director on the
Forensic Technology and Consulting team at
TransPerfect Legal Solutions, serving the needs of clients
while planning and managing the growth of the
organization.

3.
Why does Social Media matter?
Social Media by the Numbers

4.
There are more than 200 active, non-dating, social
networking sites.
1 billion Facebook users.
More than 800 online sites allow account creating and
content posting.
280 million twitter users
67% of Americans are on social media.
Social Media by the Numbers

5.
Social Media by the Numbers
Social media has replaced Porn as the top web activity.
YouTube has more than 1 billion unique monthly
visitors.
500 million tweets per day.
350 million photos are uploaded to Facebook daily.
YouTube reaches more adults than any cable network.

6.
Social Media by the Numbers
22% of Americans use social media several times a
day.
45-54 year olds are the fastest growing social media
sector.
More than half of Facebook users access via mobile
devices.
20 million twitter accounts are fake
25% of Facebook users don’t bother with privacy
settings.

7.
Social Media Environment

8.
Social Media Environment

9.
Social Media Impacts
Entertainment
Information
Communications
Influence
Evidence

10.
Social Media Stakeholders
Users
Content Owners
Investigators
Service Providers
Courts & Attorneys
Law Enforcement
Companies & Marketers
The Public

11.
Social Media Evidence
What is Social Media Forensics?
The application of computer investigation and analysis
techniques to gather evidence from online sources, suitable
for presentation in a court of law.

12.
Social Media Evidence
What Makes it Forensic?
- Defensibility
- Reproducible results
- Accepted tools and techniques
- Proper evidence handling & documentation
- Objectivity
- Application of the scientific method
- Preservation of metadata

13.
Social Media Evidence
Sources for Social Media/Web Evidence
- 200+ Social media outlets
- 800+ Online services
- Blogs
- Company or personal websites
- Group, club or special interest forums
- Government web sites
- Archival sites

14.
Social Media Evidence
Collection Methods
- Screen scrape / Screen shot
- Manual documentation
- Open source tools (HTTrack)
- Commercial tool (X1)
- Web service (Pagefreezer)
- Forensic recovery
- Content subpoena

15.
Social Media Evidence
Evidence Samples

16.
Social Media Evidence
Twitter Anatomy
RT @andreyavich: I am doing a social media forensics webinar today!
#isight #tlsftac #socmed #forensics http://ow.ly/123456
RT = re-tweet
@xxxxxx = a twitter user name
#xxxxxx = ‘hashtag’, a subject or reference identifier
http://xxx = a link, usually shortened to fit in the tweet
Remember, you only have 140 characters!

17.
Social Media Evidence
Twitter Feeds

18.
Social Media Evidence
Facebook Posts

19.
Social Media Evidence
LinkedIn Posts & Data

20.
Social Media Evidence
GeoLocation

21.
Social Media – Example 1
Litigant’s Page was Private…

22.
Social Media – Example 1
Boyfriend’s Page was not…

23.
Social Media – Example 2
Expert presents an opinion about a
highly technical matter in a
hearing…

24.
Social Media – Example 2
Expert presents an opinion about a
highly technical matter in a
hearing…
…but explicitly contradicts herself
in a very detailed article posted on
her promotional and CV website.

25.
Social Media Evidence
Additional Facts
Manage & conduct case as normal
There is no native format
Exact collection may not be possible
There is no clear content ownership

26.
Social Media Evidence
Ethical Challenges
Public vs. Private
Pretexting
Terms of Service
Licensing & Jurisdiction

27.
Social Media Evidence
Technical Challenges
Changing Technical Landscape
Provider Limitations
Content Diversity and Volume
Transitory Nature
Validated Tools

28.
Social Media Final Thoughts
Constant Evolution
Social Media Crime & Litigation Increasing
Social Media Legislation
Technical & Legal Slow to Catch Up
Increasing Privacy Awareness

29.
Resources
www.IACPSocialMedia.org
xxx.X1.com
www.PageFreezer.com
www.archive.org
www.topsy.com

30.
Thank-you for participating
If you have any questions, please feel free to email:
Andrew Neal, Director, Forensic Technology and Consulting,
TransPerfect Legal Solutions
ANeal@TransPerfect.com
Joe Gerard, Vice President Marketing and Sales
j.gerard@i-sight.com