Timothy R. Primrose, Mobile Forensic Analyst

Most of us have become willing participants in the world of social media. Social media platforms provide a space on the internet for users to leave digital footprints containing their personal data, interests, and social interactions. Even though it doesn’t take a lot of thought or effort to like a photo, comment on a post, or follow someone, you need to be aware that every single thing a user does is documented.

When social media data is pertinent to an investigation, we can request this data directly from Facebook, Instagram, TikTok, etc. Each respective social media platform will provide a data file containing a breakdown of every action a particular user has executed.

We receive three different subdivisions of data from social media platforms:

• Personal Data: profile information, interests, login history, viewing history, saved posts, and more
• Social Communication: posts, likes/reactions, comments, messages, search history, friends/followers, and more
• Files: images, videos, stories, and more

Social media data can be used to validate an alibi or lead to new suspects. Linking people together can disclose additional evidence or reveal witnesses who may know something about the case.

Case Study: Threatening messages were sent from one user to another on Instagram. The defendant denied sending the messages and said that their account must have been hacked. So, were there “signs” to point us in the right track?

When a user logs in to a social media account, a login entry is added to the login activity database. Each entry includes a timestamp, the device used to log-in, and an IP address. As such, if someone says their account was hacked and that someone else created a post or messaged someone on their behalf, we can identify the device that was used to do so.

Timothy R. Primrose, Mobile Forensic Analyst with DJS Associates, Inc., can be reached via email at experts@forensicDJS.com or via phone at 215-659-2010.

Categories: Uncategorized