October 03 2019
At Keith Borer Consultants we examine mobile phones on a daily basis for messages exchanged via social media platforms such as Facebook and Instagram. Providing the messages of interest have not been deleted from online accounts, Keith Borer Consultants can provide an online examination of social media accounts in order to download the account archive. This avenue of investigation is rarely pursued by the Police due to the burden of the protocol they must follow, however we can utilise this method of examination with consent from your client to access their account. On many occasions, this has provided critical information overlooked by the prosecution investigation.
GDPR came into force on 25th May 2018. Article 15 refers to the ‘Right of access by the Data subject’. Data controllers, Facebook or Instagram for example, hold and control information on the users of their platforms. By right, users of such social media platforms can request to be sent a copy of all their stored data; this is what we refer to as the social media archive.
Keith Borer Consultants can utilise this right of access to download a user’s social media archive, which may contain information relevant to your particular case such as messages, location data, account information and login information. One benefit of this is that we do not typically require the user’s mobile phone. Generally speaking, social media applications require an internet connection to fully function. During the examination of a mobile telephone, the phone must be isolated from the network and prevented from connecting to the internet in order to preserve evidence. This lack of connection can result in the application’s content not loading or being visible during examinations.
It is common for Facebook or Instagram messages not to be contained in the electronic download of a mobile telephone. If messages of interest are not extracted from the phone, and cannot be viewed on the device, this could result in potential evidential messages being missed.
Whilst we can conduct an online examination of a client’s social media account without the mobile telephone, this method of examination is not, however, suited for deleted material as the archives only include ‘live’ data within them. An examination the digital devices associated with the social media accounts may permit recovery of this information.
Our team has conducted in-house testing of Facebook, Instagram, Snapchat, Tinder and Twitter to identify the process required to obtain the archives and, most importantly, to verify what the archives contain and the potential limitations of the data. We can also provide bespoke functionality testing in relation to any services relevant to your case.
Should you require us to conduct an online examination of your client’s social media account we will request that we are provided with the following:
If you have a case involving social media, please do not hesitate to contact the Digital Forensics team in Durham on 0191 332 4999. Our experts are available to discuss your case and advise on the best approach to obtain the information you require.
