Social networking applications are essential in today’s world. They bypass physical and social boundaries shaping the way people communicate with each other. Twitter is one of the most popular online social networking apps. It is available for installation on the desktop, on the mobile and via web browsers. The application enables the users to post tweets and interact with other users’ tweets in various topics and areas of interest. At the same time, the platform is known mostly for sharing current news and events happening around the world.
Twitter has hundreds of millions of users worldwide performing all kinds of activities online. The application stores some of the user’s activities locally on the device such as account IDs, usernames, profile pictures, the date and time when the user joined the app, the content of the tweets, the date and time when the tweet was posted and other details. This type of information is vital during the forensic analysis process.
This section discusses how to use ArtiFast Windows to analyze Twitter artifacts from Windows machines and what kind of digital forensic insights we can gain from the artifacts.
After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select Twitter Artifact:
Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View”, with indexing, filtering, and searching capabilities. Below is a detailed description of the Twitter artifacts in ArtiFast software.
Twitter Loaded Tweets Artifact
This artifact contains information related to the loaded tweets in the user’s home feed or timeline. The details you can view include:
Twitter Loaded Users Artifact
This artifact contains information related to the loaded users. The details you can view include: