Skip to main content
SpringerLink
Log in

Forensic Analysis of Microblogging Sites Using Pinterest and Tumblr as Case Study

  • Chapter
  • First Online:
Digital Forensic Education

Part of the book series: Studies in Big Data ((SBD,volume 61))

Abstract

The growth in the popularity of microblogging and online social network (OSN) websites such as Facebook, Twitter, Tumblr, Pinterest, etc. in this modern age progresses relentlessly. Accompanying this growth in popularity is the increase in the use of these websites by individuals, companies, and even industries at large. Aside from social networking, microblogging and OSN websites have been exploited by many profitable companies as a medium for advertisement of their products, information dissemination and building connections. This increasing usage for various purposes has also opened doors to a wide range of criminal and malicious acts. This chapter studies two particular microblogging sites, Pinterest and Tumblr, both of which have gained great popularity today. Specifically, we seek to contribute to the forensics field by finding the artifacts associated with these websites that would be of interest should the need arise, as in criminal and civil cases, by replicating the actions of a standard user while using these sites in the Internet Explorer, Firefox and Chrome Browsers, and then, analyzing this self-created evidence to find such artifacts. Also, the paper exposes and exploits most of the top forensic tools employed today in the investigation of cyber-criminal cases, while making use of forensically sound methodologies in our analysis.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 84.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 109.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info
Hardcover Book
USD 109.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Dardick, G.S., La Roche, C.R., Flanigan, M.A.: Blogs: anti-forensics and counter anti-forensics (2007)

    Google Scholar 

  2. Zainudin, N.M., Merabti, M., Llewellyn-Jones, D.: Online social networks as supporting evidence: A digital forensic investigation model and its application design. In: 2011 International Conference on Research and Innovation in Information Systems, pp. 1–6 (2011)

    Google Scholar 

  3. Taylor, M., et al.: Forensic investigation of social networking applications. Netw. Secur. 11(2014), 9–16 (2014)

    Google Scholar 

  4. Zainudin, N.M., Merabti, M., Llewellyn-Jones D.: A digital forensic investigation model for online social networking. In: Proceedings of the 11th Annual Conference on the Convergence of Telecommunications, Networking and Broadcasting, Liverpool (2010)

    Google Scholar 

  5. Mulazzani, M., Huber, M., Weippl, E.: Social network forensics: tapping the data pool of social networks. https://www.semanticscholar.org/paper/Social-Network-Forensics-Tapping-the-Data-Pool-of-Mulazzani-Huber/3bc38655af392e1489eeeeab9a7a2fa8a45c5edb. Accessed 13 Sep 2017

  6. Oh, J., Lee, S., Lee, S.: Advanced evidence collection and analysis of web browser activity. Digit. Investig. 8(Supplement), S62–S70 (2011). ISSN 1742-2876, https://doi.org/10.1016/j.diin.2011.05.008, http://www.sciencedirect.com/science/article/pii/S1742287611000326

    Google Scholar 

  7. Pereira, M.T.: Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records. Digit. Investig. 5(3–4), 93–103 (2009). ISSN 1742-2876, https://doi.org/10.1016/j.diin.2009.01.003, http://www.sciencedirect.com/science/article/pii/S1742287609000048

    Google Scholar 

  8. Rahman, S., Khan, M.N.A.: Digital forensics through application behavior analysis. Int. J. Mod. Educ. Comput. Sci. 8(6), 50 (2016)

    Google Scholar 

  9. https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data#w_what-information-is-stored-in-my-profile

  10. Seigfried-Sellar, K., Leshney, S.: The intersection between social media, crime, and digital forensics: #WhoDunIt?. ResearchGate. https://www.researchgate.net/publication/301266641_The_intersection_between_social_media_crime_and_digital_forensics_WhoDunIt. Accessed 13 Sep 2017

  11. Rathod, D.M.: Web browser forensics: Google Chrome. Int. J. Adv. Res. Comput. Sci. 8(7). https://login.libweb.lib.utsa.edu/login?url=https://search-proquest-com.libweb.lib.utsa.edu/docview/1931129713?accountid=7122 (2017)

  12. Jones, K.J.: Forensic analysis of internet explorer activity files. Forensic Analysis of Microsoft Windows Recycle Bin Records (2003)

    Google Scholar 

  13. Ohana, D.J., Shashidhar, N.: Do private and portable web browsers leave incriminating evidence?: A forensic analysis of residual artifacts from private and portable web browsing sessions. EURASIP J. Inf. Secur. 2013, 1–13 (2013). http://dx.doi.org.libweb.lib.utsa.edu/10.1186/1687-417X-2013-6

  14. Akbal, E., Günes, F., Akbal, A.: Digital forensic analyses of web browser records. JSW 11(7), 631–637 (2016)

    Google Scholar 

  15. Said, H., et al.: Forensic analysis of private browsing artifacts. In: International conference on Innovations in information technology (IIT). IEEE (2011)

    Google Scholar 

  16. Jang, Y.-J., Kwak, J.: Digital forensics investigation methodology applicable for social network services. Multimed. Tools Appl. 74(14), 5029–5040 (2015)

    Google Scholar 

  17. Yang, T.Y., et al.: Windows instant messaging app forensics: Facebook and Skype as case studies. PloS One 11(3), e0150300 (2016)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Department of Information System and Cyber Security, University of Texas at San Antonio, San Antonio, TX, USA

    Briana McFadden, Elamathi Balasubramani & Wakama E. Miebaka

Authors
  1. Briana McFadden
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Elamathi Balasubramani
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Wakama E. Miebaka
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Elamathi Balasubramani .

Editor information

Editors and Affiliations

  1. Department of Information Systems and Cyber Security, University of Texas at San Antonio, San Antonio, TX, USA

    Xiaolu Zhang

  2. Department of Information Systems and Cyber Security, University of Texas at San Antonio, San Antonio, TX, USA

    Kim-Kwang Raymond Choo

Appendix

Appendix

  1. A.

    Firefox

See Fig. 2.

Fig. 2
figure 2

Decrypted user id and password using PRTK

Full size image

Pinterest

  1. 1.

    Thumbnail image:

    Firefox_Image.001/Partition 1/NONAME [NTFS]/[root]/Users/FTKuser/AppData/Local/Mozilla/Firefox/Profiles/7dl333s7.default/thumbnails/ (Fig. 3)

    Fig. 3
    figure 3

    c700fa12be0b1c01e6a3204dd2813351

    Full size image
  2. 2.

    Internet Explorer browsing history

    Firefox_Image.001/Partition 1/NONAME [NTFS]/[root]/Users/FTKuser/AppData/Local/Microsoft/Windows/WebCache/WebCacheV01.dat (Fig. 4)

    Fig. 4
    figure 4

    Internet explorer browsing history

    Full size image
  3. 3.

    Message

    Firefox_Image.001/Partition 1/NONAME [NTFS]/[root]/Users/FTKuser/AppData/Local/Mozilla/Firefox/Profiles/7dl333s7.default/cache2/entries/029694E1538C52F75B77EC6421D9BA499EA96EC1 (Fig. 5)

    Fig. 5
    figure 5

    Message viewed in Pinterest window

    Full size image
  4. 4.

    Post

    Firefox_Image.001/Partition 1/NONAME [NTFS]/[root]/Users/FTKuser/AppData/Local/Mozilla/Firefox/Profiles/7dl333s7.default/cache2/entries/053A41D688D6C8B724ADD72985727A7AE1DB8F27 (Fig. 6)

    Fig. 6
    figure 6

    The dashboard and image viewed in Pinterest

    Full size image

Tumblr

  1. 1.

    Message in slack space

    Firefox_Image.001/Partition 1/NONAME [NTFS]/[root]/Users/FTKuser/AppData/Local/Mozilla/Firefox/Profiles/7dl333s7.default/cache2/entries/279D49DC5C992B42071D77837CDE35C996FDF7E7.FileSlack (Figs. 7 and 8)

    Fig. 7
    figure 7

    Recovered message

    Full size image
    Fig. 8
    figure 8

    The link represents the above message image

    Full size image
  2. 2.

    Message in slack space

    Firefox_Image.001/Partition 1/NONAME [NTFS]/[root]/Users/FTKuser/AppData/Local/Mozilla/Firefox/Profiles/7dl333s7.default/cache2/entries/949CEE42F38DBAFB3222459A98961DFA95C0DD64.FileSlack (Fig. 9)

    Fig. 9
    figure 9

    Recovered message showing recipient and type of message

    Full size image
  3. 3.

    Post found in Thumbnail

    Firefox_Image.001/Partition 1/NONAME [NTFS]/[root]/Users/FTKuser/AppData/Local/Mozilla/Firefox/Profiles/7dl333s7.default/thumbnails/ (Fig. 10)

    Fig. 10
    figure 10

    Thumbnail image of a GIF post made by the user

    Full size image
  4. 4.

    Internet Explorer browsing history

    Firefox_Image.001/Partition 1/NONAME [NTFS]/[root]/Users/FTKuser/AppData/Local/Microsoft/Windows/WebCache/WebCacheV01.dat

  5. 5.

    Message

    Firefox_Image.001/Partition 1/NONAME [NTFS]/[root]/Users/FTKuser/AppData/Local/Mozilla/Firefox/Profiles/7dl333s7.default/cache2/entries/03473A9DF7E05409BC7F67FD1C6C8477435C06AB (Fig. 11)

    Fig. 11
    figure 11

    Gif received viewed in Tumblr

    Full size image
  6. 6.

    Message

    Firefox_Image.001/Partition 1/NONAME [NTFS]/[root]/Users/FTKuser/AppData/Local/Mozilla/Firefox/Profiles/7dl333s7.default/cache2/entries/0376B0645F3BF3A74095EBC44C659856500BB5FF (Fig. 12)

    Fig. 12
    figure 12

    Image sent viewed in Tumblr

    Full size image
  7. 7.

    Post

    Firefox_Image.001/Partition 1/NONAME [NTFS]/[root]/Users/FTKuser/AppData/Local/Mozilla/Firefox/Profiles/7dl333s7.default/cache2/entries/583FB6BDAAA44ACCF5775062FB6694BE19AFED60/Untitled0 (Fig. 13)

    Fig. 13
    figure 13

    Image link of the post recovered

    Full size image
  8. 8.

    Video posted

    Firefox_Image.001/Partition 1/NONAME [NTFS]/[root]/Users/FTKuser/AppData/Local/Mozilla/Firefox/Profiles/7dl333s7.default/cache2/entries/71B0F5E3B256692F1E83B83FABCEF3A1F16F08A6 (Fig. 14)

    Fig. 14
    figure 14

    Video posted viewed in Tumblr

    Full size image
  9. 9.

    Gif posted

    Firefox_Image.001/Partition 1/NONAME [NTFS]/[root]/Users/FTKuser/AppData/Local/Mozilla/Firefox/Profiles/7dl333s7.default/cache2/entries/06A5E2C2FC12CB1223EDE45154ABC0ED00B72A36 (Fig. 15)

    Fig. 15
    figure 15

    Gif posted viewed in Tumblr

    Full size image
  10. 10.

    Messages showing participants

    Firefox_Image.001/Partition 1/NONAME[NTFS]/[root]/Users/FTKuser/AppData/Local/Mozilla/Firefox/Profiles/7dl333s7.default/cache2/entries/

    Figures 16 and 17 shows the participants of a chat and the time they were created matched the time in the evidence creation process logs.

    Fig. 16
    figure 16

    Shows message participants

    Full size image
    Fig. 17
    figure 17

    Shows message participants

    Full size image
  1. B.

    Screenshots of IE v11 Artifacts found as shown in AccessData FTK

figure ac
figure ad
figure ae
figure af
figure ag
figure ah
  1. C.

    Google Chrome Analysis Screenshots

figure ai
  1. 1.

    Pinterest Log-in Credentials

figure aj
  1. 2.

    Tumblr Log-in Credentials

figure ak
  1. 3.

    Contents of Downloads Folder

figure al

4. Location of Google Chrome History Folder

Rights and permissions

Reprints and permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this chapter

Check for updates. Verify currency and authenticity via CrossMark

Cite this chapter

McFadden, B., Balasubramani, E., Miebaka, W.E. (2020). Forensic Analysis of Microblogging Sites Using Pinterest and Tumblr as Case Study. In: Zhang, X., Choo, KK. (eds) Digital Forensic Education. Studies in Big Data, vol 61. Springer, Cham. https://doi.org/10.1007/978-3-030-23547-5_13

Download citation

Publish with us

Policies and ethics

Search

Navigation