Forensic Analysis of Social Media Activity
The Threat of Forensic Analysis of Social Media Activity
Once, I had a very interesting conversation with a friend about social media. It started with her casually mentioning that the videos she views on social media do not download to her laptop. I found this belief quite amusing. This is a very common myth, and I would like to start this chapter with it.
Forensic analysis of social media activity is part of the forensic analysis of browsers, but I will discuss it separately, as not all users are interested in comprehensive forensic analysis of browsers.
In this chapter, I will explain what information about your social media activity can be extracted by malicious actors if they gain physical access to your computer. This can occur through a legal visit by law enforcement with a search and seizure of equipment, or through illegal access to your device.
Myth
All activity on social media: watching videos, viewing photos, listening to music, chatting, voice messages – is not downloaded to the user's computer and is not stored on it.
Reality
All activity on social media: watching videos, viewing photos, listening to music, chatting, voice messages – is downloaded to the user's computer and is stored on it (although not always for a long time).
Where does this myth come from? It’s clear: you log into the social media site and gain access to information – messages, videos, music. Without the internet, nothing will download for you, which means nothing is stored on your computer except for the history of visited pages. Logical?
Following this logic, if there is an accidental internet disconnection while using social media, all information should disappear from your browser, but it doesn’t, does it? This can only mean one thing: information is indeed stored on your computer.
Let’s break down in detail what information is stored, where, and why, and then we will move on to the process of its extraction and analysis.