Social Snapshots:
Digital Forensics for Online Social Networks

Abstract--Recently, academia and law enforcement alike have shown a strong demand for data that is collected from online social networks. In this work, we present a novel method for harvesting such data from social networking websites. Our approach uses a hybrid system that is based on a custom add-on for social networks in combination with a web crawling component. The datasets that our tool collects contain profile information (user data, private messages, photos, etc.) and associated meta-data (internal timestamps and unique identifiers). These social snapshots are significant for security research and in the field of digital forensics. We implemented a prototype for Facebook and evaluated our system on a number of human volunteers. We show the feasibility and efficiency of our approach and its advantages in contrast to traditional techniques that rely on application-specific web crawling and parsing. Furthermore, we investigate different use-cases of our tool that include consensual application and the use of sniffed authentication cookies. Finally, we contribute to the research community by publishing our implementation as an open-source project.

Social snapshots: digital forensics for online social networks
Markus Huber, Martin Mulazzani, Manuel Leithner, Sebastian Schrittwieser, Gilbert Wondracek, Edgar Weippl
ACSAC '11 Proceedings of the 27th Annual Computer Security Applications Conference, 2011

Article on NewScientist (November 2011)

Software to investigate cybercrime's social side

ERCIM News (July 2012)

Social Snapshot Framework: Crime Investigation on Online Social Networks

SSNOB: Java based Social Snapshot Tool for Facebook (archived)

https://github.com/markushuber/ssnoob