Investigating Twitter
29/12/2020 Tuesday
Social networking applications are essential in today’s world. They bypass physical and social boundaries shaping the way people communicate with each other. Twitter is one of the most popular online social networking apps. It is available for installation on the desktop, on the mobile and via web browsers. The application enables the users to post tweets and interact with other users’ tweets in various topics and areas of interest. At the same time, the platform is known mostly for sharing current news and events happening around the world.
Digital Forensics Value of Twitter Artifacts
Twitter has hundreds of millions of users worldwide performing all kinds of activities online. The application stores some of the user’s activities locally on the device such as account IDs, usernames, profile pictures, the date and time when the user joined the app, the content of the tweets, the date and time when the tweet was posted and other details. This type of information is vital during the forensic analysis process.
Analyzing Twitter Artifacts with ArtiFast Windows
This section discusses how to use ArtiFast Windows to analyze Twitter artifacts from Windows machines and what kind of digital forensic insights we can gain from the artifacts.
After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select Twitter Artifact:
Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View”, with indexing, filtering, and searching capabilities. Below is a detailed description of the Twitter artifacts in ArtiFast software.
Twitter Loaded Tweets Artifact
This artifact contains information related to the loaded tweets in the user’s home feed or timeline. The details you can view include:
- Tweet Text - Content of the tweet.
- Twitter ID - Unique identifier of the user to which the tweet belongs.
- Twitter Name - Name of the user.
- Date Time - Date/time when the tweet was posted.
- Retweeted - Indicates whether the user has retweeted the tweet.
- Favorited - Indicates whether the user has favorited the tweet.
- Has User Seen - Indicates whether the user has viewed the tweet.
- Retweet Count - Indicates the number of times the tweet was retweeted.
- Favorite Count - Indicates the number of times the tweet was favorited.
- Language - The language in which the tweet was posted.
- Photo One URL, Photo Two URL, Photo Three URL, and Photo Four URL - The URL of the photos that might be included in the posted tweet.
Twitter Loaded Users Artifact
This artifact contains information related to the loaded users. The details you can view include:
- Screen Nam - Unique Twitter handle of a user (@username).
- Date Time - Date/time when the user joined the app.
- URL - URL listed in the user’s profile header.
- Description - Text listed on the user’s profile.
- ID - Unique identifier of the user.
- Friends Count - Indicates the number of friends.
- Favorites Count - Indicates the number of tweets liked by the user.
- Verified - Indicates whether the user is verified or not.
- Media Count - Number of media posts within the “Media” tab.
- Followers Count - Indicates the number of accounts following the user.
- Following - Indicates whether the user is following this account or not.
- Blocking - Indicates whether the account is blocked by the user.
- Follow requested - Indicates whether the user requested to follow the account (applies to private accounts only).
- Name - Full name of the user.
- Location - User’s location included in the profile.
- Profile Img URL - URL to the user’s profile picture.
- Profile Banner URL - URL to the user’s profile banner/header.
- Statuses Count - Statuses count.
