Acquiring public activity

You can acquire publicly available activity from Twitter, Instagram, and Facebook. When you create a new case in AXIOM Process, you can acquire a single date range and user name for each platform. If you want to search for additional date ranges and user names, you can add them as a new evidence source after the original search completes.

Understanding what publicly available data you can acquire

In some situations, AXIOM Process might not be able to acquire all public activity.

Public Twitter activity, such as Retweets, content filtered by Twitter from public search results, protected Tweets, user accounts that are not completely configured, or Tweets that are not part of the supported history of the Twitter Standard Search API. The returned results might vary depending on which Tweets the Twitter algorithms make available on the Advanced Search page at a given time.

AXIOM Process might not be able to acquire some public Instagram activity, such as if the Instagram posts are later made private.

The data available to acquire from Facebook depends on the privacy settings set by the target account. For example, if the target user set the audience for their posts to be "Friends alone", the posts can only be acquired if the Facebook account you signed in to in AXIOM Process is a friend of the target user. Additionally, if friends of the target account have deactivated their Facebook accounts, these accounts might not be displayed by Facebook and will not be acquired by AXIOM Process.

Acquire public activity from Twitter

You can acquire publicly available activity from Twitter without requiring authentication information for specific users. When you search for publicly available Twitter activity from a specific user name, include the complete handle.

Make sure that you include the @ symbol (for example, @MagnetForensics) and format the user name correctly. For example, Twitter user names must be less than 15 characters and include only alphanumeric characters (letters A-Z and numbers 0-9) and underscores.

1. In AXIOM Process, click Evidence sources > Cloud > Acquire evidence.
2. Confirm that you have proper search authorization.
3. Click Twitter > Twitter public activity.
4. Select the Date range you want to acquire data from.
5. In the User name field, provide the user name of the account whose public activity you want to acquire.
6. Select the services and content you want to acquire.
7. To continue setting up your case, click Next.

Acquire public activity from Instagram

Instagram offers a limited subset of data publicly before requiring viewers to sign in to an account. To fully acquire the publicly available data, you must sign in to an Instagram account. You can use any active Instagram account to acquire public activity.

After signing in to an Instagram account, choose whether you want to acquire public activity for a specific user name or hashtag. Instagram user names must be less than 30 characters and can include letters, numbers, periods and underscores. You do not need to include the @ or # symbol prior to the user name or hashtag.

1. In AXIOM Process, click Evidence sources > Cloud > Acquire evidence.
2. Confirm that you have proper search authorization.
3. Click Instagram  > Instagram public activity.
4. To acknowledge the message indicating that you need to sign into an account, click Next.
5. Provide a user name and password for any active Instagram account, and then click Log in.
6. Select the Date range you want to acquire data from.
7. Select whether you want to acquire posts from a specific user name or hashtag.
8. Provide the user name of the account whose public activity you want to acquire or provide the hashtag you want to search for.

9. Click Check to confirm that the account exists and that it is set to public.

   Note: To acquire the data of a private account, you must log in to the target Instagram user account. To learn more about acquiring data from a private account, see Acquiring evidence from a cloud-based user account.
10. To continue setting up your case, click Next.

Acquire public activity from Facebook

Facebook offers a limited subset of data publicly before requiring viewers to sign in to an account. To fully acquire the publicly available data, you must sign in a Facebook account. You can use any active Facebook account to acquire public activity.

After signing in to a Facebook account, enter the URL of the target Facebook account whose activity you want to acquire. Make sure that you include the full URL, including "https://". Usually, the URL looks like "https://www.facebook.com/unique user ID/".

1. In AXIOM Process, click Evidence sources > Cloud > Acquire evidence.
2. Confirm that you have proper search authorization.
3. Click Facebook  > Public activity.
4. To acknowledge the message indicating that you need to sign into an account, click Next.
5. Provide a user name and password for an Instagram account, and then click Log in.
6. Select the Date range you want to acquire data from.
7. In the Target profile URL field, provide the URL of the target Facebook account whose activity you want to acquire.
8. To continue setting up your case, click Next.