Pro Digital Forensic Consulting: social media

Tuesday, October 13, 2015

What Social Media Activity Tells a Trained Forensic Examiner

October 13, 2015

What Social Media Activity Tells a Trained Forensic Examiner

For better or for worse, social media has become a driving force in many aspects of our lives. It helps individuals stay in touch with friends, relatives, former classmates and other acquaintances. It also helps business drive users to websites, advertise and (hopefully) generate revenue. Heck, even this little ole blog gets posted across multiple social media platforms to help generate "buzz" for a startup digital forensic consulting business. But what value does that social media activity have when conducting investigations? What can the social media data tell a trained digital forensic examiner?

This subject is yet another where I'll emphasize the value of possessing honed investigative skills in addition to being a practicing, competent, trained forensic examiner. The basis of how to conduct investigations involving social media, web activity or other electronically stored information (ESI) or even simply basic online investigations, comes through training and experience. Through the Internet Crimes Against Children (ICAC) Task Force, I was trained how to effectively track down people and gather intelligence online, mostly without their knowledge. This served me quite well in law enforcement and now serves me well in private investigations. But taking that training a step further into the findings of a digital forensic examination, we can incorporate that training and experience to dig even deeper to find out what the user(s) may be doing online.

As an example, we'll use the current “flagship” of social media, Facebook. Facebook has revolutionized how people stay in touch and they are constantly evolving the offerings they put forth. What was once an online yearbook for college students has now become a multi-billion dollar mega online conglomerate of services. Over time, users have gained the ability to search for other users, chat with other users, send links, videos, pictures and now even voice messages. And the best part is, most or all of this data is available to us when we get ahold of your computer and/or mobile device. Because Facebook is so ubiquitous across the user spectrum, almost everyone has an account, which means there's social media evidence almost everywhere.

And the great thing about social media is, it's tailor-made for us by us. We choose who we want to be "friends" with. We decide who to communicate with and for what purpose(s). We seek out and "follow" or "like" different social causes, businesses, political candidates, entertainers... the number and scope of what we can tell the social media world about ourselves is virtually boundless. Most social media users don't give much thought to the fact that they are sacrificing personal information security when they follow these things, too.

So when we conduct a digital forensic investigation, we’re looking for clues about all of these things. If the case involves a subject suspected of infidelity, perhaps they were using Facebook messenger to send messages to their paramour instead of regular text or email. And even if they were somewhat clever and never became "friends" with the other party on Facebook, the account information for the other user is recoverable and will lead right back to that person almost instantly. In the case of a law enforcement agent investigating someone suspected of having terrorist ties, perhaps they "liked" or followed anarchist, hate or radical religious groups. With tools that specialize in extracting and reporting this information like Magnet Forensics Internet Evidence Finder, the forensic evidence in these cases becomes vital to painting the picture of the truth. The best thing for us in the digital age is, if there's any digital evidence of it, we'll probably find it.

And while Facebook is a good example, the potential for valuable evidence doesn't end there. Twitter, Tindr, Snap Chat, Linked In... they all provide valuable pieces of information by way of personal and/or professional interests, potential romantic relationships, life events and random online rants (which happen more often than you might think). One final point that should not be overlooked is the responsibility of the investigator and/or examiner to stay abreast of the changes in social media. Like with most things in the digital age, social media is ever-changing. It’s a competitive market and their challenge is to gain new users while still maintaining a certain level of service and user expectation, lest they become MySpace. But the investigators and forensic examiners have to stay up with these changes to be able to consistently deliver quality service. Is it time-consuming? You bet! But it’s also extremely important to successful, accurate investigations.

Regardless of the platform, social media really does intertwine into all of our lives. Because of that, it becomes a virtual mountain of valuable personal information that a digital forensic examiner and investigator can use to help find the truth. Now go search for it!

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Based in Richmond, Virginia

Available Globally

About the Author:

Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia. In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation cases in Virginia court history. A graduate of both SCERS and BCERT (among others), Siewert continues to hone his digital forensic expertise in the private sector while growing his consulting business marketed toward litigators, professional investigators and corporations.

Email: ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com

Twitter: @ProDigital4n6

Thursday, July 16, 2015

Auditing Social Media Contacts

July 16, 2015

Auditing Your Social Media

Quick note: I’ve done some light research and seen where there are a few articles onlie about how companies should audit their social media for market effectiveness. This article is not about that. This article is about why YOU should audit your personal & professional social media contacts & connections on a regular basis.

While Pro Digital is primarily a digital forensic consulting company, a great deal of my early professional experience in criminal investigations involved online undercover investigations. Yes, I’d create the persona of a young girl online and conduct sting operations a-la “To Catch a Predator”, only with many more measures put in place to ensure proper evidence handling and successful prosecution of these cases. Because of my repeated creation of online undercover social media accounts and daily contact with others online conducting these types of investigations, I thought it might be useful to spread a little wisdom with regard to overall social media usage.

Social media has become an intimate part of most of our lives. While it’s true my octogenarian father has not embraced Facebook, my slightly younger mother-in-law has. But Facebook is just the beginning! There’s a pretty decent likelihood that you found this article on one of several social media outlets attributed to Pro Digital Consulting – Twitter, Linked In, Google+, Facebook Pages, etc. all create a universe for us to connect with other people, either personally or professionally, and network in a way our parents never even imagined. But with this ability comes added responsibility. While some other social media experts may disagree with me, I’ll offer a few tips from what I’ve seen over the years catching bad guys and conducting investigations online.

Separate or Post with Discretion

Years ago, I created a personal Facebook page under a pseudonym. I did this because I was involved in gang and narcotic investigations and to insulate my family from potential threats from those I was investigating. This pseudonym became (and still is) my account and one of the ways I connect with friends and relatives I may not see regularly, but still wish to remain in contact with. Because of this, however I’m forced to abide by the same advice I give teenagers about social media: only contact those whom you know personally and those who you could call with relative ease. Regardless, I still make a conscious effort to separate my personal and professional social networking. Pro Digital has a Twitter page and I have a separate Twitter page. This helps not only separate valued professional contacts from personal ones, but also serves to avoid alienating potential business associates. It’s important and prudent to make the decision to separate your personal and professional social media OR post with extreme discretion if they are to be combined as part of your overall online persona. This becomes a little more difficult when we connect with co-workers (or even bosses) on our personal social media pages.

Linked In is a somewhat different animal. Because Linked In is a professional social networking site and digital forensics is a fairly small community, I will choose to connect with other digital forensic and investigative professionals that I have not (yet) met in person. However, taking into account the normal traffic across list serves and browsing of blog articles published in the profession, it’s fairly easy to vet contacts as real or legitimate versus not. Even still, I audit all of my social media accounts regularly and I suggest you do too.

Why Audit?

It seems to be an unfortunate side-effect to the world of social media that it’s the 21^st Century version of the popularity contest. How many contacts can you amass in your social media world? The winner has the most. Facebook doesn’t expressly reward this, but interestingly enough, Linked In does! I routinely see potential contacts on Linked In that boast 500+ or 1000+ contacts. While that may be a measure of some sort of accomplishment, the sheer number of connection requests I get from people who fall into these categories suggests they’ll just connect with whomever for no apparent reason other than to connect with them. That’s a bad idea.

Another side-effect to ubiquitous social media usage is that potential employers, clients, opposing parties in legal disputes, etc. can look at your profile(s) and see your activity, your accomplishments and with whom you associate. Let’s face it, every profession has clowns. I define a clown as a talker, not a doer. Someone who makes a career out of doing as little as possible and talking about the little bit they do as much as possible. Another sub-set of clown are the incompetents. Think about your profession – You know people who fit these categories and your peers also know the same people who fit these categories, so why would you want to be associated with them, even if it’s just online?

Yet another reason to audit your contacts is things change. People change. That co-worker you went to multiple happy hours and worked on two major projects with at your previous company just got convicted of defrauding the same company… Do you still want to be connected or associated with him professionally? Probably not. The reality is that sometimes good people turn bad and sometimes good people let bad things carry them away through any number of motivations, so it really benefits YOU to stay abreast of who you’re connected with and what they’re up to. Like it or not, we’re all judged by our friends & acquaintances. Birds of a feather… well, you know.

When to Audit?

There’s no “best practice” for how often to audit your social media contacts. I would suggest at the very least to do it once a year, but it also depends on the volume of your social media usage. If you’re a 500+ or 1000+ connector on Linked In, you may need to audit more frequently. If, like me, you’re more cautious and discriminating about who you connect with, you may need to do it less frequently. Just don’t let it get away from you. Speaking as one who has seen respected friends, co-workers, clergy and professional contacts get caught up in situations that reflect horribly on themselves and badly on those with whom they associate, it really is an important piece to maintaining professional integrity.

What Now?

Auditing your social media is like cleaning out your filing cabinet. It sits over there in the corner, you use it when you need to and don’t pay attention to it when you’re not looking at it, but it’s still very important to maintaining your professional reputation. So use these suggestions and log-on to your Linked In, Facebook, Twitter, etc. and take a look at who you’re connected with. If you find yourself saying “yikes” or simply “who the hell is that?”, maybe it’s time to make the decision to disconnect.

Trust me, they won’t be the wiser and you’ll be better off for it!