sent or received in Bebo® live chat. Information found within these fragments
can include the status of the message, the date/time, the sender username,
target username, and the message itself.
related web pages, including but not limited to the Inbox page, emails, photo
galleries, groups, and so on. Most recovered items will be fragments and not
the complete page, but attempts are made to recover the entire page and filter
out false positives. A header is added to the fragment to aid in viewing the
page in its original format.
Status Updates and Wall Posts
search will recover Facebook® Status Updates and Wall Posts. These can be from
the local user or from other users on Facebook. Recovered items can include the
User ID and Name of the person making the status update or wall post, and the
text of the update/post itself. This artifact does not contain the date/time
that the update or post was made.
sent and received using the Facebook® live chat feature. Information found with
the message can include the Facebook® profile ID used to send/receive the
message, the from/to names and ID’s, and the date/time (in UTC) that the
message was sent. However, there are a few different formats of Facebook chat
and not all formats include all this data.
search will recover emails sent or received on Facebook®. Recovered items can
include the Logged In User ID (the ID of the person logged in to Facebook when
the email was sent/received), the subject of the email, the recipients of the
email, the Last Updated Time (last time a message in the thread was added), the
Original Author, the Thread ID#, the Time Rendered (local time), the Author’s
User ID and Name, whether or not it was sent from a mobile device, any
attachments, and the message.
search will recover Facebook® email “snippets” (previews of a full email
message). This artifact is left behind when a user is viewing their Inbox or
Sent Messages folder in their Facebook® account. It can include the Subject
line, Original Author user ID, Recent Authors user IDs (the participants of the
email conversation), Time Last Updated (the last time a message was posted in
the thread), thread ID (ID# of the message in the user’s mailbox), and the
search looks for files that follow a Facebook photo file naming convention and
recovers them, indicating which Facebook user ID the photo belongs to. At this
time, only files found in the Internet Explorer cache folders are
search will carve and parse Google+ live chat. This is the chat that can occur
between users while logged into the Google+ social networking website.
Information recovered includes whether the message was sent or received, the
email address of the sender/recipient, the date/time, and the text of the
search will locate and carve emails that have been sent or received on
LinkedIn. These email fragments can include the from/to names, subject,
date/time, and full message. Please note that, depending on the browser, these
emails will be in a compressed gzipped form which the software decompresses
sent or received in MySpace® live chat. Information found within these
fragments can include the status of the message, the date/time, the sender ID,
target ID, and the message itself. Some user info is also recoverable, such as
the real name/username associated to a MySpace ID, image URL, and other
information. This information is saved to a ‘User Info’ report.
search will recover Twitter® status updates. This artifact is left behind in
several formats when a user is updating their status or viewing another
person’s status update. It can include the Name of the user, the screen name,
created time, status ID#, where the status was updated from, geo-tags, if the
update is a “retweet”, the profile image URL of the user, and the text of the