image by Solen Feyissa on Wikimedia Commons {CC BY-SA 2.0}

­Why TikTok Is Crucial in Online Investigations (and How to Use It)

Investigators can’t afford to ignore the vast quantities of easily-accessible content (and potentially, evidence) on this fast-growing video-sharing app.

Social media platforms have proved to be a gold mine for online investigations. OSINT specialists can mine sites with large user bases like Instagram, Facebook, and Twitter for photos, videos, comments, and geolocation data — all of which is mostly available publicly and can be leveraged by online investigators without breaching copyright or data privacy laws.

Now you can add another platform to that list of major players: TikTok. An added bonus for investigators is that it’s an incredibly open platform that allows people to view user-created videos without logging in and creating their own TikTok account.

This article will discuss how we can use TikTok, one of the most popular video-sharing platforms in the world, to gather intelligence for different types of cases.

What Is TikTok?

TikTok is a social media app, designed primarily for mobile devices, in which users create and share short videos. Because of its mobile focus, the default video orientation is vertical, but users can upload horizontal videos if they prefer. The allowed video file types are mp4, .mov files, .avi, and .gif files (for ads). Although TikTok was conceived for video sharing, there are other content types on the platform as well, such as photos and audio clips.

Video file sizes on TikTok vary according to the mobile device used to upload a file. Android users can upload files of up to 72 MB, while iOS users can upload files of up to 287.6 MB. For video ads, the maximum size allowed is 500 MB.

At first, TikTok video clips could only be 15 seconds long, but this was later increased to 30 seconds, and then to three minutes (in July of 2021). The most recent change came in March 2022, when users were allowed to upload videos of up to 10 minutes in duration.

Before TikTok was “Tiktok,” it was a popular Chinese video app called Musical.ly. It was released in 2016 and had added more than 100 million users by April 2018, when it was acquired by a Chinese company (called ByteDance) and all its users were moved to a new application — called TikTok. China has its own slightly different version of the app called Douyin, which was developed exclusively for the Chinese market.

TikTok is considered the fastest-growing social media service in the world. It has been downloaded more than 3 billion times, operates in 154 countries, and has more than one billion active users. Its users are mainly in the 15 – 35 age group, but the latest stats show that TikTok is gaining traction among an older demographic as well. In the first quarter of 2021, 36% of TikTok users were between 35 and 54.   

Why Is TikTok important for online investigations?

From an investigator’s perspective, the most critical data available on TikTok are the videos and their associated metadata. We can also find other content such as sound clips, photos, comments, and interactions between TikTok users (likes, replies). TikTok Live is also gaining popularity, which allows users to interact with the video creator in real time.

Information collected from the TikTok platform can be used in different investigation scenarios:

  • Understanding the political, economic, and social interests of a group of people located in one country or geographic region. (Looking at trending content in a given region is a good place to start such investigations.)
  • Collecting information about a specific user, such as personal information, social interactions, habits, work and study information, or their physical location
  • Predicting future events on a global scale. For example, by inspecting trending videos and users’ interactions in a country or region, we could predict potential armed conflict, unrest, and revolutions in a given country
  • Investigating crime and gathering incriminating evidence for law enforcement agencies
  • Collecting evidence relevant to both civil and criminal cases

The amount of important information available on TikTok is significant. But how exactly do you conduct an investigation on TikTok?

That’s what we’ll explore in the next sections.

Investigating TikTok Information

Find a user.

For this example, I’m using the standard desktop version, or web interface, of TikTok. However, if you want to search TikTok using its more native mobile app interface, while still using a desktop computer, you can use an emulator like BlueStacks or Appetize.

To begin your search, start with the “Search” function at the top of the TikTok homepage:

When using the TikTok search engine, it will return all relevant results. Similar to Twitter, the returned search results will be divided into three tabs: “Top”, “Accounts”, and “Videos”. If you’re looking for a specific user, you’ll find it under the “Accounts” tab.

If you used a broad search term, TikTok might return a massive number of results, making it challenging to identify a specific person. The good news is that Google indexes TikTok pages, so you can use advanced search operators, such as the “site” search operator, to find a particular person on TikTok.

On the Google search page, type:

site:tiktok.com “{first + last name}”  

Suppose you know the target’s username on TikTok, or you have their username on another social media platforms, like Facebook or Instagram. In that case, you can search for this username on Google as follows:

site:tiktok.com “{first +  last name}” OR “{username}”

Many people use the same username across different social media websites. To find all social media accounts related to a particular username, you can use one of these free online services:

Now that we have the subject’s TikTok username, we can access their TikTok profile directly by typing the username directly after the TikTok address into the top of your web browser:

tiktok.com/@USERNAME

The subject’s TikTok profile picture is typically the first bit of useful content you’ll notice. That said, it’s important to note that TikTok keeps only one profile picture per account, so if the subject changes their profile picture, the previous one will be lost. However, there is a trick to seeing previous profile images—more on that in a second.

First, let’s look at how you can save a TikTok profile image. Right-click over the subject’s TikTok profile image and select “Open image in new tab”. The image will appear in a new browser window (see Figure 3), allowing you to save it to your computer, just as we do with any other file type.

Search for more images.

Now that we have the subject’s TikTok profile image, we can search where else this image appears online (see Figure 4). To do so, we can use reverse image search engines like the ones mentioned below:

Additionally, there are dedicated online services for face recognition. These search engines have an incredible ability to detect faces in pictures and scan the web to see matching images. Here’s a list of search engines you can use for identifying faces:

Look for older iterations.

Now, let’s turn our attention to the Wayback Machine. As alluded to earlier, we can use the Wayback Machine service to find previous versions of a particular TikTok profile image. This method is not guaranteed, as the Internet Archive service may not have captured an image before it was changed—but it’s certainly worth a try.

Go to Wayback Machine, search for the subject’s TikTok profile, and the internet archive will return lists of all previously captured profile information.

Investigate the profile(s).

After we finish inspecting the subject profile image, we can move to inspect their TikTok profile contents, such as:

  • Videos they have posted
  • Number of “Likes”, “Following” and “Followers”
  • Profile description (biography)
  • Display name and username
  • Other social media profiles (Facebook, Twitter, Instagram, YouTube) connected to this profile
  • User interactions, such as “Likes”, “Shares”, “Comments” on other videos and “Replies” to other posts/comments.

It is worth noting that the “Following” and “Followers” lists are unavailable on the TikTok desktop version; to see these lists, you need to use the TikTok mobile version or open the app using an emulator.

Each user on TikTok has three identifiers:

  1. User ID: The user ID is created automatically by the TikTok platform when the user registers a new account. To find this ID for any TikTok account, go to the target TikTok profile page, right-click over the page, and select “View Page Source”. Now, search for “userid“.

  • Username: The username is created by the TikTok user and can be changed every 30 days. The username appears in the TikTok web address. For example, https://www.tiktok.com/@undertaker (undertaker is the TikTok username).
  • Alias Name: The Alias name is created by the TikTok user and can be changed anytime, without restriction (see Figure 7). Some users may use the same name for both their “Alias” and “Username”. When users create their TikTok account for the first time, TikTok will suggest an Alias and Username.

Keep in mind that the TikTok display name, or Alias, can be the same for many TikTok users. However, the TikTok Username is unique and can not be used by two TikTok accounts.

Download TikTok videos.

To manually download any TikTok video, you can use the following method (this works on all web browsers):

  1. Right-click over the video you want to download and select “Inspect element”.

2. The developer tool of your web browser will open. Now, search for the “Video SRC” attribute and copy it.

3. Paste the URL into a new browser tab to view and download the video as any file.

4. Right click over the video and select “Save video as…”

Using a Forensic Capture Tool to Collect TikTok Evidence

In this article, I have introduced TikTok and mentioned a few manual methods to search for TikTok profiles and collect information about them. However, for official investigations, it is preferable to use an automated forensic capture solution to harvest TikTok data and discover target profile connections with other users across the internet.

This kind of solution allows investigators to do the following on TikTok:

  • Reliably capture TikTok videos and video descriptions
  • Capture entire TikTok timelines with a few clicks
  • Automatically open and capture TikTok comments and replies
  • Perform bulk captures of TikTok videos
  • Capture TikTok videos by date range
  • Generate a collection report with relevant metadata

TikTok and the Explosion of Social Video

As TikTok continues to grow in popularity, it becomes increasingly relevant to social media investigations. Investigators can’t afford to ignore the content on the site—especially considering its open and easily-accessible nature.

Video is now a major component of social media, not only on TikTok, but also on Facebook, Instagram, YouTube, etc. Because of this, every investigator needs to put tools and strategy in place for collecting this valuable evidence.  


About the author:

Nihad A. Hassan is an independent Cybersecurity consultant, digital forensics and Cyber OSINT expert, online blogger, and book author. He has been actively conducting research on different areas of information security for more than a decade and has developed numerous cybersecurity education courses and technical guides. He has completed several technical security consulting engagements involving security architectures, penetration testing, computer crime investigation, and cyber open source intelligence (OSINT). Nihad has authored six books and hundreds of information security articles for various global publications. His current work focuses on digital forensics, anti-forensics techniques, digital privacy, and cyber OSINT.