Blog >> Android Twitter

Investigating Android Twitter

28/07/2023 Friday

Twitter is a captivating social networking platform that revolves around short messages known as tweets. Operating as a microblogging service, Twitter empowers its users, fondly referred to as tweeters, to express their thoughts, opinions, and interests. The platform serves as a global communication tool, connecting users with strangers and acquaintances alike, fostering conversations on a wide range of topics through hashtags. Recently twitter has replaced its iconic bird logo with an X, a move explained by Elon Musk as part of the platform's transformation into an app offering additional service.

Digital Forensics Value of Twitter

Analyzing artifacts from the Android Twitter app can offer valuable insights into a user's activity, including chat messages, personal information, and hashtags user that he contacted. The anonymous nature of Twitter's interactions often encourages users to express their thoughts, experiences, and emotions candidly, as they feel less inhibited by the fear of recognition, judgment, or consequences. This candid communication style provides a unique window into individuals' perspectives and discussions on sensitive topics. Due to this anonymous nature, twitter can provide unique evidence, and insights to investigations involved individuals.

Location of Twitter Artifacts

Android Twitter App artifacts can be found at the following locations:
data/org.Twitter.messenger/files/

Analyzing Twitter with ArtiFast

This section will discuss how to use ArtiFast to extract Twitter from Android and what kind of digital forensics insights we can gain from the artifacts.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Twitter artifacts.

Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Twitter artifacts in ArtiFast.

Android Twitter Conversations

• Time - The date and time conversation was created.
• Data - The text data from conversation message.
• User ID – The ID of the user involved in the conversation.
• Database Row ID - Indicates whether this chat was pinned or not.
• Conversations ID - The ID of the chat.

Android Twitter Most Recent Conversation Item

• Time - The date and time conversation was created.
• User Name - The username.
• Is Unread - Indicates whether the conversation was unread.
• Conversation Entries Data - Conversation entries data.
• User Image URL - Profile picture URL.

Android Twitter Followed Users

• Time - The user Status update Date.
• User ID - The user’s unique identifier.
• Name – The display name.
• User Name – The username.
• Followers – Number of followers.
• Profile Created Date – Profile creation date.
• Description – User profile description.
• Updated Date – Date and time user profile was last updated.
• Web URL – URL link of web added by the user.
• Location – User’s geolocation.
• Image URL – Profile picture URL.
• Header URL – Header picture URL.

Android Twitter Tweets

• Time – The date and time tweet was created.
• User Name - The username.
• Author ID – Tweet author user ID.
• Content – Tweet content.
• Retweeted – Indicate whether user retweeted the tweet or not.
• Favorited – Indicate whether user liked the tweet or not.
• Latitude – Geolocation latitude.
• Longitude – Geolocation longitude.
• Lang – Language.

For more information or suggestions please contact: ekrma.elnour@forensafe.com