Facebook artifacts can be one of those artifacts that may not seem to apply to your specific case, but suddenly it gets thrust into the forefront of your investigation because of a conversation, wall post, association or other link made solely through the user Facebook account. Like general Internet history/activity, it’s one of those categories that you really can’t afford to not review.

Internet Evidence Finder (IEF) includes support for Facebook under the social media artifact category.

Finding & reviewing these types of artifacts are extremely simple when using Internet Evidence Finder. There are four search types that you can use in Internet Evidence Finder when looking for Facebook artifacts:

1. Full Search

   This is the default search type when using IEF to analyze NTFS, FATx, HFS+ & EXTx. This search type allows IEF to parse the file system of each volume and identify all the various objects (files, folders & unallocated space) to search them all. On NTFS partition, it also individually identifies file system objects such as the $MFT & $Logfile for targeted searching.



2. Quick Search

   This search type causes IEF to search specific file system objects and common files and folder locations that normally contain Internet-related artifacts. For example this type of search would target the default locations for supported browser histories, but would not check every single file/folder.

   

3. Sector Search

   This is the default search type when examining a drive/image that contains an unknown file system. This allows IEF to search each sector for known artifacts even if the file system itself cannot be read/interpreted.

   

4. Custom Search

   The custom search type allows the user to specify which areas of the volume to search by selecting/deselecting the various options.

   

When looking for Facebook artifacts, using IEF with the “Full search” type would be the recommended option since it would look everywhere (including unallocated space for deleted Facebook artifacts). As long as the browser history was not moved to a non-standard location, you could also use the “Quick search” option. The “Custom search” option would also work as long as you chose to search all files or common areas/folder locations. Once IEF is completed with the artifact search, Facebook artifacts are individually identified and categorized separately from common web browsing artifacts.

You can then review each Facebook artifact category separately by clicking on the respective artifact subcategory and viewing the details in the table view.

Each found artifact will have a file (if the artifact was found in a specific file) or physical offset (if the artifact was found in unallocated or when using the sector search option) displayed in the lower details pane so you can find the same artifact by using other 3rd party tools for validation and additional research.

As always, if you have any comments, suggestions or questions,
you can contact me directly at: lance (at) magnetforensics.com

As a forensic investigator, Facebook can be used as an online resource when conducting an investigation and can be a wealth of information. It can provide a glimpse into a person’s life, provide a mechanism to obtain photos of potential subjects, friends & family. Timeline comments can provide geographical information of where a particular person was on a specific date and they can reveal the identity of close friends and other details not readily apparent.

I recently assisted in a theft/stolen property case where we were able to get a complete family history and an idea of how the person lived by looking at photos and connecting family members together. Facebook provided us with links that allowed us to look up residence information based on connections and family ties. It also provided phone numbers that were listed in comments and later tied to fraudulent ads on Craigslist.

Facebook can also provide a wealth of information as a forensic artifact when conducting host-based forensics. In the past few years there have been several high-profile cases that involved Facebook artifacts even though the crime was not associated with traditional ‘computer-related’ offense. For example, here is a recent case where Facebook messages were found on a victim’s computer (and later on the suspect’s computer) and used to identify a suspect in a murder case.

“Riverside County sheriff’s Investigator Tony Pelato, a computer forensics expert, said he found Facebook chat messages in Guzman’s computer between Santhiago and Leal, inviting Leal to buy some liquor and meet her at a park near Roanoke Street where Leal was killed. The chat messages were written minutes before the shooting.”
Read more

Or this one:

“According to state police, detectives interviewed a young man named Bryan Butterfield a day after Cable was reported missing. Butterfield told police that someone had created a phony Facebook account in his name, and police traced it to Dube’s parents’ house in Orono.

Cable was frequently contacted by the fake Butterfield and agreed to meet with him at the end of her road to get some marijuana the night she went missing, according to the state police affidavit.

Social media’s role in Nichole’s disappearance and death was a wakeup call for students, many of whom have become paranoid about online contacts, said Pattershall, Cable’s friend.”
Read more

Generally there are six specific categories of artifacts that can be individually identified when examining a computer hard disk:

1. Facebook Chat

   This artifact is most commonly found in memory as JavaScript Object Notation (JSON) text in a running computer and/or in the pagefile.sys & hiberfil.sys file(s).

   

2. Facebook Messages

   Facebook Chat and Messages are now the same artifact. But in older versions of Facebook these were two different artifacts. This artifact is most commonly found in memory of a running computer and/or in the pagefile.sys & hiberfil.sys file(s).

3. Facebook Wallpost/Status Update/Comments

   HTML that is carved from temporary internet files/web cache and memory

   

4. Facebook Webpage Fragment

   A fragment of HTML that is carved from temporary internet files/web cache and memory

5. Facebook Pictures

   A picture with a specific filename pattern found in temporary internet files/web cache. The filename contains three sets of numbers such as:

   ‘1221785571_1221785571_10150672801465915_n.jpg’

   The second set of numbers can indicate the Facebook UserID the photo belongs to and it can be queried through Facebooks ‘graph’ API here:
   https://developers.facebook.com/tools/explorer

6. Facebook URLs

   A URL in any web related (browser) artifact that references Facebook URLs. These artifacts commonly reference other Facebook users or specific Facebook activity

   “https://www.facebook.com/photo.php?fbid= 201526933901245715&set=at.10150672801465915.448027.507140714.552175374.1221785571&type=1& theater”

   201526933901245715 is the photo ID
   10150672801465915 is the album ID
   1221785571 is the user ID

   Viewed photos will appear in the cache file with the name:
   ‘1221785571_1221785571_10150672801465915_n.jpg’

   Viewing messages for profile currently being used:
   http://www.facebook.com/messages/joey.flowes

As always, if you have any comments, suggestions or questions,
you can contact me directly at: lance (at) magnetforensics.com

This episode is available as both a video or audio-only broadcast.

Internet Evidence Finder can natively read and parse EnCase evidence files (E01, Ex01, L01 & Lx01) and dd images, but it does not have anyway of decrypting evidence files that contain a copy of an encrypted source drive that may be using BitLocker, PGP, McAfee or other FDE solutions. If you point IEF to an evidence file that contains an encrypted source drive, IEF will process it like a non-encrypted drive looking for artifacts, but it will likely find none if the entire drive (or volumes) is encrypted.

To use the power of Internet Evidence Finder with encrypted drives, you will need to use a tool that has the ability to present a decrypted version of the data to the Operating System, then IEF can parse the decrypted version of the data. The most common tool is the Physical Disk emulator or network share feature within EnCase.

EnCase v6 & v7 has the ability to decrypt several of the common full disk encryption solutions. In the example above, a disk that is encrypted with BitLocker is immediately identified and the user is prompted for credentials that allow EnCase to virtually decrypt the data and present that data to the examiner in an unencrypted form for analysis.

This data, while still encrypted on the disk (and in the evidence file) is presented in a decrypted state for analysis:

You can use this feature inside of EnCase to present the unencrypted version of this data to the Operating System by using either the Physical Disk Emulator (PDE) or Network Share feature of EnCase. The difference of the two options is this:

• “Mount as Emulated Disk” (PDE) takes the evidence file and presents the physical device as if it was a locally attached drive. The device will show up in Computer Management console and as far as the OS is concerned, it’s the same as a physical hard drive being connected to the examiner machine.
• “Mount as Network Share” presents each object on the disk (and volume) and its own logical object. For example, it will actually present “Unallocated” space as a file object, so you can use a third part tool to point specifically at that file (object).

Either of these options will work with IEF, but understanding the difference between the two will help guide you to which option you choose inside Internet Evidence Finder. For example, if you choose to present the data via the PDE feature, then in IEF you would want to choose the “Drives” option to process the entire drive, in its unencrypted form.

When using the Network share option, you would want to use the “Files & Folders” option inside IEF because every object (including unallocated space) is presented as a file to the OS. Notice the files shown in Windows Explorer when the encrypted drive is mounted and presented to the OS using the “Network Share” option:

Notice there are actually files called Unallocated Clusters and FAT, whereas these are normally part of the volume and not shown in Windows Explorer. When using this option (Network Share), you would want to use the “Files & Folders” option in IEF to process all the presented data from the encrypted drive.

The search results will show the ‘file’ named Unallocated for artifacts found within Unallocated Clusters:

Using either of these two options (Network Share or Emulated Disk) will allow you to use Internet Evidence Finder against your evidence like you do with unencrypted drives.

As always, if you have any comments, suggestions or questions,
you can contact me directly at: lance (at) magnetforensics.com

June 6th, 2013 – Magnet Forensics, the global leader in the development of forensic software for the recovery of Internet artifacts, recently collaborated with Guidance Software to develop an integration between Internet Evidence Finder™ (IEF) and EnCase® v7, the IEF to EnCase® Connector. This new connector enables investigators that use both EnCase® and IEF to initiate IEF searches from within EnCase® and easily import the resulting IEF artifacts into EnCase® for comparison with other relevant case data. The IEF to EnCase® Connector integration is now available for download free of charge on the Magnet Forensics website at www.magnetforensics.com.

The powerful search capabilities of Magnet Forensics’ IEF software simplifies the recovery of social networking, online chat, web browsing history, and other Internet activity from computer hard drives and live memory captures, including deleted data. With support for over 220 Internet artifact types, IEF enables investigators to recover, analyze and report more evidence in less time.

Guidance Software is the leading provider of forensic investigations software and hardware solutions, and its EnCase software is used extensively by government, corporate and law-enforcement authorities worldwide for forensic investigations. The company recently launched the EnCase® App Central Developer Network, a new development community focused on fostering technology partnerships that enable digital investigators to find more evidence, faster using the EnCase platform.

“With the IEF to EnCase Connector integration, investigators can obtain the highest quality evidence with the minimum level of effort. Whereas most investigations require the use of multiple digital forensic tools, the IEF to EnCase Connector integration streamlines workflow for cases where both EnCase and IEF are required. Through the EnCase App Central Developer Network, Guidance Software has done an excellent job of providing digital forensic investigators with access to enhanced capabilities and technologies. Throughout the process, Guidance Software provided its expertise and support, making it possible for us to develop an integrated solution for the tens of thousands of EnCase users worldwide. We encourage other software vendors to offer their products via the EnCase App Central Developer Network,” said Adam Belsher, CEO of Magnet Forensics.

“EnCase has been designed and delivered as an open platform from the very beginning, enabling users to enhance its functionality with their own custom add-on apps,” said Alex Andrianopoulos, vice president, Marketing for Guidance Software. “With the EnCase App Central Developer Network, we extend the power of EnCase by leveraging the capabilities and features of market leading apps like Internet Evidence Finder by Magnet Forensics.”

For more information on EnCase® App Central and the EnCase App Central Developer Network please visit: http://www.guidancesoftware.com/appcentral

For more information about Internet Evidence Finder and the IEF Integration for EnCase: http://www.magnetforensics.com/internet-evidence-finder-enscript-for-encase-v6-v7/

About Guidance Software, Inc.

Guidance Software is recognized worldwide as the industry leader in digital investigative solutions. Its EnCase® Enterprise platform is used by numerous government agencies, more than 65 percent of the Fortune 100, and more than 40 percent of the Fortune 500, to conduct digital investigations of servers, laptops, desktops, and mobile devices. Built on the EnCase Enterprise platform are market-leading electronic discovery and cyber security solutions, EnCase® eDiscovery and EnCase® Cybersecurity, which enable organizations to respond to litigation discovery requests, proactively perform data discovery for compliance purposes, and conduct speedy and thorough security incident response. For more information about Guidance Software, visit www.guidancesoftware.com.

EnCase®, EnScript®, FastBloc®, EnCE®, EnCEP®, Guidance Software™ and Tableau™ are registered trademarks or trademarks owned by Guidance Software in the United States and other jurisdictions and may not be used without prior written permission. All other trademarks and copyrights referenced in this press release are the property of their respective owners.

About Magnet Forensics

Magnet Forensics is a global leader in the development of forensic software that recovers data from a broad range of Internet-related communications. Our flagship product, INTERNET EVIDENCE FINDER™ (IEF) was created by a former police officer and forensic examiner who recognized the need for an easy to use, comprehensive tool to help perform digital investigations. Since its creation, IEF has quickly become a trusted solution for thousands of the world’s top law enforcement, government, military and corporate organizations – used to recover Internet evidence like social media communications, webmail, browser activity (and more) to support their most important investigations. For more information about Magnet Forensics visit www.magnetforensics.com.

Guidance Software, Inc.
Brigitte Engel, +1-626-229-9191
newsroom@guidancesoftware.com

Magnet Forensics
Scott Williams, +1-519-503-7967
scott.williams@magnetforensics.com