PDF《Facebook : Do You Leave a Trace?》

Facebook?: Do You Leave a Trace? A Forensic Analysis of Facebook? Artifacts Katherine Helenek, BS, Josh Brunty, MS, Christopher Vance, BS, Terry Fenger, PhD Marshall University, Huntington, WV

25701 Forensic Science Program >

Abstract ? Much of the population now uses digital devices ? Threats shifting from corporeal world into the realm of cyberspace ? Internet crime increasing each year3 (see Figure 1) ? Law enforcement agencies claim at least half of their cases now contain a digital component3 ? Reflecting the increase in Internet use, popularity of social networking sites has risen as well ? At least

750 million active users on Facebook?, more than half of whom log on daily8 ? A forensic analysis was performed to recover the location of Facebook? chat and message artifacts ? Potential evidence can be accessed quickly by forensic investigators >

References 1.

CacheBack

3 Now Recovers and Rebuilds Facebook Chat [Internet]. 2010. SiQuest Corporation;

[cited

2011 June 30]. Available from: http://www.cacheback.ca/news/news_release-20101110-1.asp 2. Dwyer C, Hiltz S, Passerini K. Trust and Privacy Concern Within Social Networking Sites: A Comparison of Facebook and MySpace. Proceedings of the Thirteenth Americas Conference on Information Systems;

2007 Aug 9-12;

Keystone, CO. 3. Gogolin, G. The Digital Crime Tsunami. Digital Investigation 2010;

7:3-8. 4. Kenneally EE. The Internet Is the Computer: The Role of Forensics in Bridging the Digital and Physical Divide. Digital Investigation 2005;

2:41-44. 5. Livingstone S, Brake DR. On the Rapid Rise of Social Networking Sites: New Findings and Policy Implications. Children &

Society 2010;

24:75-83. 6. NEW! IEF Version

4 Released! [Internet]. 2011. JADsoftware;

[cited

2011 June 30]. Available from: http://www.jadsoftware.com/go/?page_id=141 7. Nosko A, Wood E, Molema S. All About Me: Disclosure in Online Social Networking Profiles: The Case of FACEBOOK. Computers in Human Behavior 2010;

26:406-418. 8. Statistics [Internet]. 2011. Facebook;

[cited

2011 June 20]. Available from: http://www.facebook.com/press/info.php?statistics This project was supported by Award No. 2010-IJ-CX-K025 awarded by the National Institute of Justice (NIJ), Office of Justice Programs, U.S. Department of Justice. The opinions, findings, and conclusions or recommendations expressed in this publication and/or exhibition are those of the author(s) and do not necessarily reflect the views of the Department of Justice. Figure 1: Internet Crime Complaint Center (IC3) complaints per year of crimes consisting of an Internet component >

Materials ? Dell Precision

690 computer containing hot swap bay and externally attached NexStar Hard Drive Dock from Vantec? ? Seagate?

500 Gigabyte hard drive and Seagate?

250 Gigabyte hard drive ? Category

5 Ethernet (CAT 5e) cable connected to a 16-port gigabit switch ? AccessData'

s Forensic Toolkit? version 3.2.0.32216 ? VMware? Workstation version 7.2.1 build

301548 ? Forensic Toolkit? Imager version 3.0.1.1467 ? DCode version 4.02a build

9306 Browser File Name File Path File Category Internet Explorer?

8 p_FacebookID =#[1].txt ImageName/Partition 2/NONAME [NTFS]/[root]/Users/UserName/AppData/Local/Microsoft/Windows/Temporary Internet Files/Low/Content.IE5/XXXXXXXX/p_FacebookID=#[1].txt JSON file Internet Explorer?

9 p_FacebookID =#[1].txt ImageName/Partition 2/NONAME [NTFS]/[root]/Users/UserName/AppData/Local/Microsoft/Windows/Temporary Internet Files/Low/Content.IE5/XXXXXXXX/p_FacebookID=#[1].txt JSON file Mozilla Firefox?