Social Network Forensics: Recovering Digital Evidence Online
This paper examines the use of digital forensics tools for recovering evidence from social networking sites and other Web 2.0 venues including blogs and wikis. It reviews the landscape of social networking platforms, the types of digital artifacts they generate, and the legal and investigative need for reliable forensic methods. The study proposes a comparative analytical methodology to evaluate two leading software applications — Guidance Software's EnCase and JADSoftware's Internet Evidence Finder v4 — using test hard drives populated with Facebook chat data. Both qualitative and quantitative measures are applied to assess each tool's effectiveness, scope, and reliability in identifying and preserving digital evidence for law enforcement use.
- Introduction: Social networking growth and forensic need
- Purpose of the Research: Comparing forensic tools across Web 2.0 venues
- Literature Review: Social Networking Sites: Definitions, features, and scale of social networks
- Research Design and Methodology: Analytical comparison design using test hard drives
- Forensic Tools: EnCase and Internet Evidence Finder v4: Features and capabilities of each forensic tool
- Conclusion and Recommendations: Protocol guidelines and study trustworthiness measures
✍️ How to write this paper — guide, tools & examples ▾
What makes this paper effective
- The paper grounds its proposal in real vendor documentation and published literature, giving the methodology section a credible, practice-oriented foundation.
- It clearly articulates the societal need for forensic tools by connecting the growth of social networking platforms to rising risks of exploitation, fraud, and predation.
- The enumerated feature lists for IEF v4 and the step-by-step case management protocol from EnCase demonstrate attention to procedural rigor, which is appropriate for a forensics research context.
Key academic technique demonstrated
The paper demonstrates how to structure a comparative analytical methodology by combining quantitative outcome measures (number of successful keyword retrievals) with qualitative weighting for scope and reliability — a mixed-methods approach explicitly grounded in Neuman's (2003) framework for analytic comparisons. This technique shows readers how to design a defensible software evaluation study.
Structure breakdown
The paper opens with a broad social context for social networking growth, then narrows to a focused research purpose. A literature review establishes definitions and background on social networking sites. The methodology section introduces the two forensic tools, explains the comparison design, and details the data-collection protocol. The paper closes with case management guidelines adapted from EnCase. This funnel structure — from broad context to specific technical procedure — is typical of applied research proposals at the undergraduate or graduate level.
Introduction
The introduction of social networking sites in recent years caused an explosion of interest, and these sites now attract hundreds of millions of users from around the world. Blogs and wikis are increasingly popular Web 2.0 venues that can evolve into formal communities of interest, providing significant knowledge-sharing and learning opportunities. Used appropriately, these venues represent a valuable resource. Unfortunately, because a majority of users on these sites are young people, they also tend to attract online predators and others who would exploit them, making the development of effective forensic tools an important and timely enterprise.
It would seem that the introduction of social networking sites tapped into a long-repressed desire to communicate with other like-minded individuals in a convenient and reasonably safe fashion — a desire that has manifested particularly strongly among young people. According to Van Tassel (2006), "The popularity of social network sites demonstrates the power of user-created content. Social networking sites are mainly populated by young people in their teens and twenties" (p. 181). There is also a higher level of content oversight provided by most social networking sites compared to other Web 2.0 venues such as blogs and wikis. Van Tassel adds that, "User-generated content destinations require some administration. The procedures and rules for posting material must be clear, prominently displayed, and strongly enforced, usually by paid moderators. Sites for the general public must often guard against pornography and offensive graphics and language" (p. 181).
Notwithstanding their potential for misuse, social networking sites are going to continue to increase in popularity for the foreseeable future. These venues are being used by people of all ages and walks of life to keep in contact with others and share their thoughts on virtually every issue that confronts humankind today. It is reasonable to suggest that a forum, club, or social networking site already exists for virtually any interest, and in the unlikely event one does not, starting one is a simple matter. When social networking sites and other Web 2.0 venues are exploited for identity theft, fraud, or sexual predation, there is a compelling need for effective forensic tools that can identify perpetrators and collect evidence needed for prosecution — a need that directly motivates the proposed study discussed below.
Purpose of the Research
The purpose of the proposed study is to conduct research on social media forensic tools that can be used to develop crucial evidence from social networking sites such as Twitter, LinkedIn, MySpace, Facebook, YouTube, FourSquare, and other Web 2.0 venues. In addition to social networking sites, such venues include blogs (a contraction of "weblogs") and wikis. The study will demonstrate how to approach the evidence-collection process in these venues by using forensic software applications such as EnCase and Internet Evidence Finder v4.0. These forensic tools will be evaluated and compared through an analysis of sample testing data resulting from their use across different Web 2.0 venues. Additional purposes of the study include developing relevant recommendations for the use of these forensic tools and addressing the professional ethical responsibilities involved in their use.
Literature Review: Social Networking Sites
At the most basic level, social networking sites are online forums in which users gather at their convenience to share information — in the form of digital text, graphics, links, and so forth — empirical observations, or sometimes simply to chat. A useful definition is provided by Carter, Foulger, and Ewbank, who describe these sites as "interactive websites designed to build online communities for individuals who have something in common — an interest in a hobby, a topic, or an organization — and a simple desire to communicate across physical boundaries with other interested people" (2008, p. 682).
While social networking sites typically allow users to post information permanently for others to view, some sites also feature chat rooms and other forums where posts may be quickly deleted. Nevertheless, this information still leaves a recoverable record. As Carter and colleagues note, "These sites are not unlike the old-fashioned 'party line' telephones, but they leave a more permanent record of the conversations" (2008, p. 682). The type of forensic data generated on a social networking site is substantial. Carter et al. add that, "Most social networking sites include the ability to conduct live chats, send e-mails, upload videos, maintain a blog or discussion group, and share files. Users can also post links to pictures, music, and video, all of which have the potential to create a virtual identity" (2008, p. 682).
One of the more compelling features of social networking sites is their ease of use. Registering is a simple and straightforward process involving little more than creating an account and a user profile. Once these steps are completed, the site is open for exploration, posting of user-generated content, and the creation of online relationships with others who share similar interests and views (Carter et al., 2008). Most larger social networking sites such as Facebook provide users with various privacy setting levels that allow only certain people access to their pages. Carter and her associates report that, "A mutual relationship between users called 'friending' links profiles together, creating the backbone of the website's social network. If the profile is set to private, then only 'friends' can view the entire page" (2008, p. 682). Other sites use similar features to restrict access to user-generated content and individual profiles (Carter et al., 2008).
Beyond these minimal requirements, social networking sites are wide open in terms of content, limited only by the agreed-upon protocols established for each venue. By July 2006, there were already more than 140 different social networking sites available on the World Wide Web with hundreds of millions of users (Anklam, 2007). Today, social networking sites continue to grow in popularity and breadth of content, making the need for sophisticated forensic tools that can document evidence of online criminal activity all the more urgent.
Conclusion and Recommendations
A mixed methodology consisting of both qualitative and quantitative elements will be used to conduct the analytical comparison of the EnCase and IEF v4 products. The numeric totals of successful evidence retrievals will be recorded for each tool, and qualitative weights will be applied to reflect the quality, scope, and reliability of each product's output. Results will be presented in tabular and graphic formats and interpreted narratively.
To improve the trustworthiness of the findings, the case management recommendations provided by EnCase will be followed throughout the analytical comparison of both vendors' products:
1. Separate folders for each case; use unique directory names.
2. Use large-capacity, high-RPM hard drives with a single partition for evidence files.
3. Wipe the drive to eliminate any claims or arguments of cross-contamination.
4. Give the hard drive a unique label prior to acquisitions to differentiate your drives from the suspect's.
5. Create default Evidence, Export, and Temp folders for each case (EnCase Methodology, 2011).
By adhering to these protocols and applying a rigorous mixed-methods comparison, the study aims to provide law enforcement agencies and forensic practitioners with actionable, evidence-based guidance for selecting and deploying the most effective forensic tools for social networking site investigations.
Anklam, P. (2007). Net work: A practical guide to creating and sustaining networks at work and in the world. Boston: Elsevier/Butterworth Heinemann.
Carter, H. L., Foulger, T. S., & Ewbank, A. D. (2008). Have you Googled your teacher lately? Phi Delta Kappan, 89(9), 681–683.
EnCase Forensic for Law Enforcement. (2011). Guidance Software. Retrieved from http://www.guidancesoftware.com/WorkArea/linkit.aspx?LinkIdentifier=ID&ItemID=674.
EnCase study guide. (2011). Guidance Software. Retrieved from
Internet Evidence Finder v4 — Standard Edition. (2011). JADSoftware. Retrieved from
Neuman, W. L. (2003). Social research methods: Qualitative and quantitative approaches (5th ed.). New York: Allyn & Bacon.
Van Tassel, J. (2006). Digital rights management. Boston: Focal.
Always verify citation format against your institution’s current style guide requirements.