±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36300
New Yesterday: 0 Visitors: 202

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Capturing Facebook pages

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

flamerescue150
Member
 

Capturing Facebook pages

Post Posted: Mar 22, 12 04:42

In the cival world...

Given that I have lawful access to log into a facebook account, what "forensic" methods could I use (other than screenshots) to capture all wall posts, messages, uploaded photos, etc?  
 
  

JLEllis
Member
 

Re: Capturing Facebook pages

Post Posted: Mar 22, 12 05:04

If you have access to the facebook account and the email address associated with the account you can use facebook's archive function (account settings menu).

An archive will pull all of the target's information.  
 
  

flamerescue150
Member
 

Re: Capturing Facebook pages

Post Posted: Mar 22, 12 17:20

Thank you, that is pretty much what i'm looking for.

I've requested an archive from facebook on my own account as a test, but it now says the archive download is pending and will notify me by email when it is ready. I do not have legal access to the suspect email account. Do I need the email to gain access to the download or can I access it directly from facebook?  
 
  

MindSmith
Senior Member
 

Re: Capturing Facebook pages

Post Posted: Mar 25, 12 14:47

@flamerescue150 - do you or don’t you have legal access to the account - as your last post seems to contradict your original post??

If you do have legal access to the account you could do:

1. As per JEllis’s suggestion, or
2. Logon with the user’s credentials and then using Webcase from Vere Soft - drill down through the user’s profile wall posts, friends profile, Photos, etc - while Webcase records each artifact in a forensically sound manner for later viewing in native form.
- Both these methods apply to an account you own or have legal access to - not to someone else’s account!

Methods 1 & 2 will give you current data from the account, but this data only covers 22 of the 57 categories of data stored for the account. The reason you cannot use the archive feature at present is due to the high number of requests already received (allegedly).

If you do not have legal access to the suspect’s account - then you have to go via your local Law Enforcement.

Ps an aside: legally under Facebook’s T&Cs the user of the account CANNOT share their login credentials with _anyone_
_________________
#include <std.disclaimer.H> 
 
  

ChopOMatic
Member
 

Re: Capturing Facebook pages

Post Posted: Mar 25, 12 15:44

My take was that OP was saying he does have legal access to the Facebook account but not the email account. Thus if the results were only available via email delivery it would be a problem.
_________________
Jerry Hatchett, CCE, EnCE

aka ChopOMatic 
 
  

Jonathan
Senior Member
 

Re: Capturing Facebook pages

Post Posted: Mar 25, 12 20:27

- MindSmith
legally under Facebook’s T&Cs the user of the account CANNOT share their login credentials with _anyone_


There are no legal consequences of sharing your Facebook credentials as far as I can see, part 14 of their terms stating: "If you violate the letter or spirit of this Statement, or otherwise create risk or possible legal exposure for us, we can stop providing all or part of Facebook to you". Not such a big deal.
_________________
Forensic Control
twitter.com/ForensicControl
St Bride Foundation, 14 Bride Lane, London, EC4Y 8EQ 
 
  

flamerescue150
Member
 

Re: Capturing Facebook pages

Post Posted: Mar 27, 12 22:46

Correct, I have legal access to the facebook account but not to the associated email account.

The built in archive feature of facebook works fairly nice and can be accessed directly from the logged in account. However, portions of the downloaded archive do not display in a usable format. When testing on my own account, my private messages/conversations displayed out of kilter and were unreadable. Additionally, for wall posts that I posted on a friend's wall... only the message was display and did not show who's wall I posted it on.

This being said, in a circumstance such as this I would say the built in archive function comes as close to best evidence as i can get without a subpoena to facebook since the data is provided directly from facebook?  
 

Page 1 of 2
Page 1, 2  Next