CDR analysis. IP address tracing. Cell site examination. These are some examples of the digital evidence increasingly being used by prosecution teams. In response, defence lawyers are hiring experienced digital investigators to carry out the technical, time-consuming work needed to provide rigorous social media evidence.
In this article, we reveal the best practice evidence gathering approach established by IntaForensics’ highly experienced digital investigation unit. But first, let’s start by exploring the ever-changing social media environment.
The evolving social media landscape
Think social media and LinkedIn, Twitter and Facebook will likely come to mind. But there are many more social media platforms in use by people in the UK and around the world. These are just some of the most popular sites:
- VK – the Russian equivalent of Facebook is used by over 100 million Russian-speaking users who can make posts public or private.
- TikTok – this prevalent Chinese platform is used by 1.2billiion active u sers to share short videos.
- Snapchat – 332 million daily active users share pictures, videos and messages which are made available to others for a short time.
- Kik – a free, instant messaging mobile app from a Canadian software company. Kik does not require a phone number or email to sign up making it more difficult to trace users.
- WeChat – this Chinese platform is one of the most downloaded messaging apps with over 1.2 billion users and it’s popular with Chinese speakers around the world. It has a reputation for not protecting user data making it easy to access.
- Viber – is commonly used by Eastern Europeans and some businesses that use it for two-factor authentication.
Many of these platforms encrypt users’ data. Reducing the likelihood that defence lawyers can retrieve the evidence they need. It requires specialist knowledge and technical skills to unlock the information inside. Information that can deliver a wide range of advantages to whoever accesses it, prosecution or defence.
The benefits of social media forensic analysis
When people post on social media, they often think only friends and family can see their posts. Unaware their communications are public, people often naively share information freely. Creating a treasure trove of insight into an individual, like whether they:
- Have wealth or assets that cannot be accounted for.
- Have extremist beliefs or views.
- Show inappropriate interest in children.
- Display violent tendencies or other types of behaviour.
- Have particular interests and activities.
It’s even possible to gain insight into somebody’s state of mind and intentions. So much so that social media can often paint a compelling picture of an individual’s thoughts or actions at a particular time. This information can form a very useful and persuasive part of the defence’s case. And it’s widely available for those who know where and how to look.
How IntaForensics’ digital investigators interrogate social media platforms
Reliable digital evidence requires a thorough approach to investigation and analysis. At IntaForensics, our specialist social media investigators have over 100 years combined law enforcement industry experience. They take a multi-step, multi-discipline approach using different sources of data to piece together the facts of a case supported by evidence. Resulting in this, their best practice approach.
Step 1 – establish the scope for the investigation
Determine which social media accounts and other digital sources to search, based on information provided by the client and the specifics of the case.
Step 2 – sift social media for intelligence
Digital investigators are highly experienced in rapidly understanding the case parameters and analysing large data sets to identify relevant intelligence. They know how long different types of digital evidence can be held before it’s deleted – either by people involved in the case or the application itself. Making the ability to act swiftly and effectively key to capturing evidence. With their technical know-how, digital investigators can also uncover links with events and locations and connections between people or data. This can often point to new lines of enquiry and additional evidence to be recovered and preserved.
Step 3 – verify the defence’s evidence
At this stage of a digital investigation, social media accounts are analysed to establish if they belong to and are used by the person being investigated. This can involve digital investigators tracing an IP address back to a physical address. Or reviewing content to determine whether it has been posted by the person under investigation. All of which is key in ensuring the evidence can be used by the defence and is not bought into doubt.
Step 4 – check the prosecution’s evidence
Verification can also be used to cast doubt on social media evidence gathered by the prosecution. Sometimes prosecutors do not complete sufficient due diligence or expect their evidence to be tested by the defence. For example, we often see screenshots of compelling evidence. But without checking the screenshot’s provenance, defence teams could be accepting un proven evidence not backed up by data. It’s also common for accounts to be spoofed, cloned or created using someone else’s name and then used to post content. Alternatively, defendants can claim their social media account has been hacked, the account is not theirs or they share it with someone else who could have posted incriminating content. If accounts are not closely checked for veracity, they are sometimes presented as evidence by the prosecution. But, with the right expert on your defence team, a wide range of digital evidence can be investigated, challenged, questioned and even dismissed.
Step 5 – compile the relevant evidence and create a report
Digital investigators pull together large amounts of diverse digital information into one investigation. Culminating in a single report designed to be presented at court. Working with an experienced digital investigator gives you the expertise to unlock vital social media evidence. Helping you to challenge and compete in this highly complex area.
Who We IntaForensics?
As part of the Forensic Access Group, IntaForensics has grown to become one of the leading providers of cyber security and digital forensics services in the UK. Our team has been built carefully and consistently through recruitment of the most technically competent and experienced cyber security and industry specialists from law enforcement, government agencies and the commercial world. IntaForensics holds certification to ISO 9001:2015, ISO 14001:2015 and ISO /IEC 27001:2013 and maintains an ISO/IEC 17025:2017 scope of accreditation as defined on the UKAS website; accredited organisation 7733.
For more information, contact our Digital Investigation team at IntaForensics to discuss the social media evidence in your defence case review: sales@intaforensics.com or 0247 771 7780