For a majority of mobile devices, social media apps store its configuration, user data, and history in SQLite databases. Being able to successfully extract all of the data possible from a physical device is only half the challenge the second challenge is the forensic devices’ ability to effectively parse through the extracted data and display useful information to the forensic examiner. 1ĬelleBrite UFED with Physical Analyzer is one of the leading forensic tools for extracting information from smartphones. A few of the more common digital forensic tools are CelleBrite Physical Analyzer, Magnet Forensics’ Internet Evidence Finder (IEF), XRY Mobile Forensic Tool, Access Data’s Forensic Tool Kit (FTK), and Guidance Software’s EnCase. laptop) and operating system, and in some instances multiple tools may be needed to conduct a complete extraction. (2012) downloaded photos off of the Internet and were able to reveal information about the creator, and in some cases, the GPS coordinates by forensically analyzing the metadata.Ī number of digital forensic tools are available to analyze social media artifacts from physical devices, although determining which tool is appropriate depends on the device (mobile phone vs. (2012), metadata is capable of providing investigators with information to answer the main questions of: who, what, when, how, where, and why. There are three types of metadata: descriptive, structural, and administrative ( Salama, Varadharajan, & Hitchens, 2012). Social media artifacts are primarily located in the browser cache (c.f., Cusack & Son, 2012).Īlong with cache files, social media posts may also contain embedded information, known as metadata, which is often defined as “data about data.” Metadata provides additional information about a file, such as when the file was created, last accessed or modified, its location, or name of the user account (c.f., Ball, 2005). In addition, these Internet browsers also maintain a “cache,” which is a repository for storing copies of previously visited websites that expedites the processing of information when reopening a site (c.f., Brown, 2006 Clancy, 2011).

First, these Internet browsers are great sources of potential digital evidence, including browsing history, searches, sites visited, and stored login and password information (c.f., Casey, 2011).

For traditional desktop computers and laptops, social media sites are accessed through an Internet browser (e.g., Safari, Internet Explorer), whereas social media may be accessed through apps or traditional Internet browsers depending upon the mobile device. Leshney, in Digital Forensics, 2016 Social media evidence on the physical deviceĭigital evidence from social media use may be found on traditional desktop computers and laptops as well as mobile devices, such as tablets and smartphones.

Ufed reader troubleshooting