Every picture tells a story. A careful investigation of social media posts, images, and their embedded metadata can help you piece together that fuller narrative.
With the world in various stages of shutdown and emotions running high, folks are turning to social media to vent, break the isolation, and connect with the world. And anytime they post, they’re unwittingly passing on more clues about themselves than they can possibly fathom.
For investigators, social media posts have always been a trove of information, and those posts and images can offer more data than initially meets the eye. For example, if you use Facebook, you may have seen the “# of years ago” (“your memories” feature) pop up in your feed from time to time. It shows you a photo memory you posted several years before, then gives you the option of reposting to your current feed. This is potentially valuable information, especially if the accident you’re investigating happened several years ago — say, the year that “memory” was posted.
That’s just one way a photo posted on social media can illuminate the past — and other valuable information about your subject that’s not immediately visible to the naked eye.
What can you uncover?
Of course, scrolling through photos can teach you a lot about a person’s interests, social life, beliefs, political views, and more. Taking a deeper dive into a photo can uncover additional clues you may not have considered important. For example, let’s take a look at the photo below. What does this picture reveal about your suspect?
You can see who your subject is dining with, their location, and the time of day. You can download the image and do a Google or Bing reverse image search to see if this image is floating around anywhere else online. Is it part of another person’s social media profile? If so, you may learn more about the subject’s activities or relationships.
Now let’s take a look at a few of my favorite tricks for searching photos, their history, and their metadata.
1. Instagram Stories
Around one billion people use Instagram every month, according to HootSuite, and more than 95 million photos are uploaded to Instagram every day, (as of November 2019). Most Instagram photos are uploaded in the moment of experience, right from a mobile phone. This can be very telling when conducting an investigation around a missing person, a crime, or someone to whom you are trying to serve papers.
Paying attention to the details of the photo is especially helpful.
The platform launched Instagram Stories in 2016, a feature that lets users upload photos and short videos that disappear after 24 hours. Timing is everything. What is here today may be gone tomorrow.
As part of a recent search, we found our subject via an Instagram Story, where they’d shared an image of a trip to Disney World. Searching through a third-party app, we were able to identify the individual’s location, export the story, and notify our client. (No, it wasn’t this photo, but you get the idea.)
2. Google Maps
Try this neat trick in Google Maps: Type in your subject’s address — or any address for that matter. Drag the peg human onto the map to switch to street view. Not only will you see a snapshot of the location, you’ll also find out when the photo was taken. (See the screenshot below.)
You can see the image capture date at the bottom of the photo. The snapshot is taken no matter what, even if there are cars in the driveway, people in the front yard, etc. It’s a long shot of course, but you never know when you might find something relevant to your investigation in an image taken months or years ago.
3. Reverse Image Searches
Most Investigators have heard of Tin Eye Reverse Image Search. Tin Eye finds duplicate photos on the web quickly and easily, and they do offer a free option. Images will turn up in the strangest places: dating sites, online marketplaces, travel and booking sites, insurance companies, and more. In the paid version, you can even set up alerts.
Social Catfish, another reverse image search service, has gained a reputation for specializing in online dating investigations. The company was founded in 2013 and has helped many people identify scammers in the dating world. In addition to the reverse image option, they offer a name look up, email look up, phone look up, and more.
4. Metadata Preservation Services
For litigation purposes, you may want to add an image’s metadata to your evidence collection. Metadata is information embedded in an image (or any piece of digital data), a digital signature of sorts that includes a timestamp, rights information, and other descriptive information. This data provides you with sound, reliable evidence that complies with the E-Sign Act, Federal Rules of Evidence, and other necessary regulations.
You’ll need software to extract metadata from an image. We use Web Preserver, a forensic preservation service that lets investigators gather and safeguard admissible evidence from online sources for use in legal proceedings.
Here’s a sample tweet, followed by a collection report:
Behind every tweet is about 144 fields of metadata, including information about the post author, when the account was created, a timestamp, urls, and sometimes, geotagging. In the report above, you’ll notice a url, time stamps, and an IP address, for example. You’ll also see a hash value — is a string of numbers that identifies a file and, in some cases, can tip you off that a file has been altered.
What does all this add up to? Basically, by looking into the data behind the data, a good computer forensics investigator can often find out who is tweeting what from where, whether accounts are legitimate or fraudulent, and in some cases, whether a file has been changed. This information becomes vital if a subject deletes or alters social media posts in an attempt to foil an investigation.
Knowing how to capture this data will make investigators look VERY smart to their attorneys and clients.
You don’t need to understand all those lines of data to grasp that there’s lots there that could be relevant to your case. This report essentially takes a social media post (in this case) and “freezes” it in time — in other words, it proves that the post actually did exist on the profile page of the suspect. Attorneys are very familiar with how to use this kind of evidence, and judges sometimes require it — some have been known not to allow a social media post into evidence unless it has the metadata attached. I always advise my clients that this data is necessary if their case goes to court. And knowing how to capture this data will make investigators look VERY smart to their attorneys and clients.
All this is also a strong reminder that it’s tougher to tweet anonymously than you might think. Researchers from the Alan Turing Institute and University College in London analyzed metadata from five million Twitter users and were able to correctly ID users more than 95% of the time.
If someone is looking, and they know what to look for, metadata can identify you as surely as a name tag. Online privacy is fiction.
The Takeaway
It’s no secret that social media investigations can break cases and save lots of shoe leather for digitally savvy sleuths. Knowing how to find and safeguard the data behind the data can help you nail down admissible evidence and create a fuller storyboard on your person of interest. And you don’t have to be a computer forensics guru to dig deep into metadata; there are tools for that.
A version of this article first appeared on the eChatter blog.
About the Author:
Kathy Doering is a Certified Social Media Intelligence Analyst (SMIA) and founder of the Social Media Research Association. Kathy frequently speaks at private investigation conferences on the importance of using social media and deep web analytics. She is president of eChatter, a division of Ann Michaels and Associates.