BLOG

See the latest news and insights around Information Governance, eDiscovery, Enterprise Collaboration, and Social Media. 

All Posts

Facebook Forensics

Recent reports show over one billion people were on Facebook on one day. One billion people! Most were there to catch up with friends, see some trending content, or just to waste some time. With a crowd that large, you know there are a fair bit of nefarious activities going on.

facebook-photos

Whether it's trashing someone's reputation, perpetuating some fraud or posting photographic evidence of misdeeds, if it happens in real life, it happens on Facebook. If it's not about you, you can probably laugh it off.

But what about if it IS about you? A coworker posts nasty, even threatening messages? Someone is posting your content as their own, or worse, posing as your business? What if they are trying to collect money from your parents on some tear-jerking scheme that sounds legit?

Maybe it's not about you personally, but it's your job to protect the innocent. Perhaps you're a lawyer who has a client going through a contentious divorce being played out online. Or, a fraud investigator who sees evidence on Facebook. Or, a law enforcement official who needs to capture evidence of illegal activities that are occurring (or being corroborated).

 

Capture offending posts as evidence

In each of these examples what is needed is a Facebook forensics tool, some way to quickly capture the offending posts in a way that is authenticated as evidence.

As the number of cases with a social media component increase Courts, and judges become more familiar with social media. They are not some esoteric, isolated niche cases but rather becoming mainstream. Therefore, Facebook forensics and other social media Discovery methods are becoming necessary.

It's not as simple as taking a Screenshot. After all, a screenshot can be photoshopped. You need to have the digital evidence in a format which the Courts will approve. In the US, this means compliance with the FRE (Federal Rules of Evidence) and the E-Sign Act. Authenticated digital evidence involves capturing not only the screen but also the corresponding Metadata as well as verification of both (such as with a timestamp and Digital signature).

You also have to act quickly. In many cases, the offending post will be deleted. If you don't get a proper capture that evidence might disappear forever.

 

Capture what you (legally) can

Facebook forensics is about capturing all the various channels that Facebook provides (that you have access to). If a channel is public, that's straight forward; the person has, in effect, given permission. If you are there "friend", then the same rule applies; as you have been granted access you can capture and preserve those online activities.

If you, or one of your colleagues, own the channel (for example, a business page) you can also capture the evidence.

Gathering Facebook evidence doesn't mean you can go on a fishing expedition and start Trolling for information with fake accounts, fake friends, and other devious actions. If you stick to what you control, or public information, and you properly document the digital evidence, then your Facebook forensic investigation will hold up to the scrutiny of an open court.

 

How WebPreserver can be of use to your firm

WebPreserver is the world's only fully-automated social media and web forensic preservation tool that is unaffected by API restrictions. All content is authenticated for use as evidence in litigation and meets FRE 902.13,14 requirements for admissibility - simple screenshots or PDF exports are not self-authenticating.

This technology takes the onerous, costly responsibility out of preserving social media content as part of eDiscovery proceedings which often requires days of manual workflow. This mitigates the likelihood that evidence will be deleted prior to collection. A lot of content can be removed or edited while waiting for either your team to collect it using manual tools, or in waiting for a third party vendor to collect it on your behalf.

Related Posts

Data Archiving for Government: Battling Disinformation & Misinformation

The internet has become a breeding ground for misinformation and disinformation. According to the Pew Research Center, Americans' exposure to––and belief in––misinformation differs by the specific news outlets and the general pathways they rely on. More specifically, people who rely on social media are more prone to consuming misinformation and disinformation. 

What is a Document Retention Policy And Why do You Need it

Any business that deals with sensitive information needs a document retention policy. Does your business have staff you keep records on, for example? If so, your business deals with sensitive information.

What's the Difference Between a CMS Backup and an Archive?

Building websites used to require a lot of time, knowledge, and manual coding. But with today's sophisticated content management systems (CMSs), building and managing a website is much easier. While customizing features may require technical know-how, the general rule is that most websites are built and powered by an intuitive and user-friendly CMS.  However, CMSs were not expressly designed for archiving data. Storing CMS data requires more than hitting save when updating a page. A CMS is not an archive system; your website data isn't necessarily automatically saved in versions—nor is the backup data easy to access. That means you may struggle to identify and access the backed-up data you want to access. Hence, it's best to have a system dedicated to archiving and backups.