An Empirical Study on Acquisition of Digital Evidences from Facebook Using Various Tools and Techniques

Abstract

The activities on Social Networking Sites have grown exponentially over the years, with majority of the population shifting to the virtual paradigm. The huge amount of information shared by users on Social Media not only act as breeding ground for criminals but also as a storehouse of evidence for Digital Forensic Investigators. Social Media Forensics, which is a branch of Digital Forensics, is used for collecting and analyzing user information from Social networking sites. Apart from the information available on social media, the different memory locations such as RAM, browser cache, browsing history etc. also include various artifacts useful in investigation. The available proprietary Social Media Forensic tools are expensive and might not be able to gather all evidences at a given time. Hence, the need of the hour is to use a combination of different tools and techniques to achieve best results. In this paper, we have conducted an empirical study to demonstrate different open-source tools and in-built native techniques for acquisition of user information and other artifacts from social media and the hard disk of computer system, followed by analysis of the same for various types of evidences. Although the scope of this study is limited to Facebook, the findings would be useful for Digital Forensic Investigators and Law Enforcement Personnel to investigate social media crimes in an efficient manner.