Moments in Time: A Forensic View of Twitter

Online social networks have become a ubiquitous and important part of the modern, developed society. Modifications in social conduct within these often forced closed spaces are noted, these side effects well documented. The potential for evidence gathering and research into changing human behaviour and social norms is undoubted, but the networks pose significant problems to digital forensic investigators that are not experienced offline. Data will reside on multiples of servers in multiple countries, across multiple jurisdictions. Capturing it before it is overwritten or deleted is a known problem, mirrored in other cloud based services. This paper will examine the background to social networking sites, potential behaviour sets experienced on-line and the application of current law and forensic methodologies. This paper will then take a view of the social networking site Twitter by adopting a formal approach to the examination, extraction and analysis of data. This paper will identify a known problem, status removal and offer a novel, yet simple method for determining what has been removed.