Social Media needs no introduction. It has taken over the world and our lives like an insidious wave. It is a wave that has brought the world closer, yet not without detrimental effects. At present, over 3.397 billion users are active on social media who spend 116 minutes per day on an average. With abundant personal information available on social media platforms, it is now the hotbed of crimes and malicious activities. But, where there’s a crime, there’s also inspection to bring justice to victims and combat such occurrences in the future. Presenting some common social media crimes and the science of Social Media Forensics. Know how investigators extract social media forensics evidence and engage in forensic analysis of social networking applications on mobile devices.

The Black Hole called Social Media

Social media is any application or website that facilitates users to interact and socialize, share ideas and information, upload photos and files, participate in various activities/events, and engage in real-time conversations.

Online communications in the form of social networking have witnessed a colossal evolution in the last couple of years. From September 2017 to October 2018, the number of social media users grew by 320 million. This spells out a one new social media user every 10 seconds! In fact, WhatsApp and Facebook Messenger handle 60 billion messages every day!

Social Media Statistics

The social media world is of mammoth size, and it is only increasing by the day! Here are some social media statistics for you.

Did you know that Facebook adds 500,000 new users to its fraternity every day? This amounts to the creation of 6 new profiles every second!

There are 1.3 billion accounts on Twitter, with 326 million active users each month!

As we write this blog, LinkedIn contains a user base of 500 million members whereas Snapchat has 187 million active users daily! In fact, 60% of Snapchat users are under the age of 25.

Furthermore, Pinterest boasts of 200 million active users every month.

Speaking of social media, how can we not talk about our favorite video content platform – YouTube? Did you know that YouTube sees around 1,148 billion mobile video views each day?

When it comes to publishing content, users publish 74.7 million blog posts per month on WordPress alone!

Whoah! That is quite some activity online! Isn’t it?

Type of Social Networking Platforms

We all know what social media is. But, what most don’t know is that Facebook, Instagram, Twitter, Snapchat and WhatsApp are not the only social media platforms. The classification of social media platforms is on the basis of its primary objective of use Following are the different types of social networking platforms.

1. Social Networks

Also sometimes called “relationship networks, social networks enable people and organizations to connect online for exchanging information and ideas.

Use: To associate with people and brands virtually.

Examples: Facebook, Twitter, WhatsApp, LinkedIn

2. Media Sharing Networks

Media sharing networks enable users and brands to search and share media online. This includes photos, videos, and live videos.

Use: To search for and share photos, videos, live videos, and other forms of media online.

Examples: Instagram, Snapchat, YouTube

3. Discussion Forums

One of the oldest types of social media platforms, discussion forums are an excellent repertoire for market research. They provide a wide range of information and discussion on various subjects.

Use: Serves as a platform to search, discuss, and exchange information, news, and opinions.

Examples: Reddit, Quora, Digg

4. Bookmarking and Content Curation Networks

Such social networking platforms enable people to explore and discuss trending media and content. These platforms are the epicenter of creativity for those seeking new ideas and information.

Use: To explore, save, exchange, and discuss new and trending content and media.

Examples: Pinterest, Flipboard

5. Consumer Review Networks

Consumer review networks enable people to express their opinions/experiences about products, services, brands, places and everything else under the sun!

Use: To search, review, and share opinions/information about brands, restaurants, products, services, travel destinations, etc.

Examples: Yelp, Zomato, TripAdvisor

6. Blogging and Publishing Networks

Blogging/publishing networks serve as a platform for publishing online content in a way that facilitates discovery, commenting and sharing. Publishing platforms consist of traditional blogging platforms such as Blogger and WordPress, microblogging platforms such as Tumblr, and even interactive platforms such as Medium.

Use: To publish, explore, and comment on content online.

Examples: WordPress, Tumblr, Medium

7. Sharing Economy Networks

It is also known as ‘collaborative economy network’. These networks enable people to connect online for advertising, finding, sharing, trading, buying and selling of products and services online.

Use: To find, advertise, share, and trade products and services online.

Examples: Airbnb, Uber, Task rabbit

8. Anonymous Social Networks

As the name itself states, such social networks enable users to share content anonymously. Thus, miscreants are increasingly misusing such platforms for cyberbullying.

Use: To anonymously spy, vent, gossip, and sometimes bully.

Examples: Whisper, Ask.fm, After School

Social Networking Platforms Offers a Lucrative Platform for Executing Social Media Crimes

On the righteous side, one may use social media platforms to socialize and communicate with near and dear ones. However, it is the anonymous and diverse nature of social networking platforms that miscreants use for unethical activities. Innocent-looking profiles can often be the masquerade for fraudsters, phishers, child predators, lechers, and other cyber criminals.

In spite of the stringent policies imposed by social media platforms, there are approximately 270 million fake profiles on Facebook!!!

Additionally, the abundance of personal information available on social networking platforms renders them a favorite of cyber criminals. After the compromise of a profile, a hacker can access, manipulate and misuse its information for various malicious activities. Other unscrupulous activities on such platforms include stalking, bullying, defamation, circulation of illegal or pornographic material etc.

Following are some types of social media crimes.

1. Hacking

This happens when you are not able to log into your account because someone who has broken into your account and taken complete control over it. Facebook is the most hacked social networking site.

Social media hacking usually occurs when:

• One does not log out from the account, especially when using a public computer.
• Sharing of passwords with strangers either unintentionally, or as a result of social engineering.
• Using easy to predict, or same passwords across multiple platforms.
• Hacking of one’s login email ID.

2. Photo Morphing

Photo morphing is the use of editing to change an image/shape into another without much difficulty. Available data shows that people share nearly 3.2 billion images daily on social media platforms. The widespread availability of media on social networking platforms makes it a cakewalk for miscreants to download and misuse them.

Miscreants morph the images of popular figures and upload them on adult websites or use them for blackmailing them for sexual or financial favors.

3. Offer & Shopping Scams

Women are usually known to fall for such offer and shopping scams on social networking platforms.

For example, a miscreant uses a shopping offer to make a user click on a link. Once clicked, it prompts the user to forward it to 20 people to avail the coupon. However, the user does not get any coupon, but the cybercriminal gets his/her personal information!

4. Dating Scams

In such scams, the fraudster connects with the victim using a fake name and picture. Once they befriend the victim, they move to a different platform for further communication.

Once they realize that the victim has fallen for them, they first send small gifts like flowers and cards, and later start demanding for emergency monetary help like recharging their phone to talk, booking flight tickets to meet, medical reasons etc. At times, fraudsters may also record video calls or screen, and later use them to blackmail the victim.

5. Cyberbullying

Cyberbullying is an act that involves sending or publishing obscene messages or humiliating content online, or issuing threats to commit violent acts. It includes sending or sharing nasty or false information about another individual for character assassination and causing humiliation.

Example: Imposters used social media platforms such as Facebook and WhatsApp for circulating the deadly Blue Whale and Momo Challenges. These resulted in the death of many teenagers across the globe as they committed suicide as a part of the challenge.

6. Link Baiting

In such scams, the fraudster sends the victim a link that entices the victim to open it. On opening, it leads to a fake landing page which prompts the victim to enter his/her account credentials. This provides the credentials to the cybercriminal who later uses it for illicit activities.

Example: The victim gets a message: “Somebody just put up these pictures of you drunk at this wild party! Check ’em out here!”
Immediately, the victim clicks on the enclosed link, which leads to his/her Twitter or Facebook login page. Once the victim enters his/her account details, the cybercriminal has the password and can take total control of the account.

Social Media Forensics or Social Network Forensics

Now that you know how perpetrators can use social networking platforms to wreak havoc, are you considering an exit? Well, let us enlighten you about digital forensics then! The increase in social media crimes has also resulted in the increasing importance of digital forensics for their investigation.

Precisely known as social media forensics or social network forensics, it focuses on retrieval of electronic evidence from social networking activities. Such evidence often plays a crucial role in the conviction or acquittal of a suspect.

Social media forensics involves the application of cyber investigation and digital analysis techniques for:

• Collecting information from social networking platforms such as Facebook, Twitter, LinkedIn etc.
• Storing,
• Analyzing, and
• Preserving the information for fighting a case in the court of law

Social Media Forensics is basically about locating the source of electronic evidence. This is accompanied by collecting it in an unhampered way while complying with all laws.

Evidence Collection in Social Media Forensics

The simplest method of evidence collection in social media forensics is a manual collection. It uses basic techniques such as visiting a website and/or taking a screenshot and is quite time-consuming. On the contrary, open source tools and other commercial forensic tools offer a quicker gathering and extraction of evidence. Additionally, since investigators often deal with a lot of live content, they also use content archiving to preserve the nature of the evidence.

Above all, e-discovery or evidence collection needs to in compliance with the terms of service agreement. Every social networking platform has specified terms and conditions that define the nature of the information that an investigator can collect and manipulate. Such conditions often inhibit investigations since the defense may cite breach of terms of service to dishonor the evidence.

The Three Basic Stages of Social Media Forensics

Social media forensics has three basic stages for the extraction, preservation, and analysis of electronic evidence.

1. Evidence Identification

This step involves a thorough inspection of the crime scene to locate any hardware or software that is worthy of collection. It also includes conducting a basic search to identify all social networking accounts linked to the subject. Additionally, a search of all of the subject’s families, friends and associated on social media. A forensic examiner needs to precisely document all sources of evidence along with how and when they found it.

2. Collection

Forensic investigators use various methods to collect electronic evidence. Following are the methods for social media evidence collection.

• Manual documentation
• Screen scrape/Screenshot
• Open source tools (HTTrack)
• Commercial tool (X1)
• Web service (Page freezer)
• Forensic recovery
• Content subpoena

Furthermore, different social media forensic tools kits are available for the logical acquisition of evidence on smartphones. The logical acquisition involves capturing a logical image of all files on the smartphone’s internal memory. The files are then analyzed for evidence of various activities.

C. Examination (Organization)

The files obtained during the logical acquisition requires specific tools for decoding and viewing of their contents. Once decoded, they provide a vast amount of user data such as call history, sent and received SMS, calendar events, and address book entries. For social media forensics examiners, they provide a huge bank of social networking footprints. These artifacts are then examined and correlated to the actual case in hand.

Facebook Artifacts: Activity logs, Facebook archives, profile information, places visited, locations and geo-locations, friends and family, applications, pages, groups, interests, text and links, the timestamp of all activities, details of friends engaged in active chat sessions with the subject and much more.

Twitter Artifacts: User information, tweets posted, timestamps of the poster tweets, records of people followed by the subject and their tweets along with timestamps.

Social Networking Applications & Mobile Devices

Due to the increasing use of social applications on smartphones, they are the biggest repertoire of evidence for forensic investigators. Did you know that more than 90% of social media users use mobile devices to access social networking platforms? Thus, they store a lot of potential information that social media forensics professionals can extract with the right tools. Furthermore, with the right inspection methods and tools, such evidence can provide crucial leads in a case.

In fact, half of Facebook users access Facebook through its mobile applications on their smartphones or tablets. Moreover, such users are twice as active compared to those who use other devices (desktop, laptop) to access Facebook.

Since millions of users leverage social networking applications on their mobile devices, the probability of misuse is also quite high! Hence, a forensic analysis of the suspect’s mobile device offers a great potential to aid in his/her incarceration or exoneration.

Challenges of Forensic Analysis of Social Networking Applications on Mobile Devices

As much as the potential they have, smartphones also pose many challenges to social media forensics investigators. Since smartphones are always active and regularly update data, it causes faster loss of evidence. Secondly, the closed source OS of smartphones (except for Linux-based phones) make it difficult to extract evidence using custom tools.

To make things worse for forensic examiners, smartphone vendors release OS systems very often. This makes it challenging for social media forensics professionals to keep up with the latest tools and methods for examination.

Incognito Forensic Foundation (IFF Lab) – Social Media Forensics Laboratory in Bangalore

We are living in an era where each person has 5.54 social media accounts on an average. In such circumstances, the use of social networking platforms for executing a host of online crimes is inevitable. Incognito Forensic Foundation (IFF Lab) is a digital forensics lab in Bangalore that offers a range of digital forensics services such as social media forensics, mobile phone forensics, and cyber forensics. IFF Lab is a trusted name in the digital forensics industry and boasts of a reputed clientele.