Home > Belkasoft Evidence Center

Social Network Support

This page contains the most up-to-date information of Social Network support. There are many Social Networks and the way they store information changes frequently without notice. For example, the way Facebook stores its message history may change without any "version change". That's why this page exists. Here you will find a date when a social network analysis was last successfully tested by Belkasoft staff.

Social Network name History data last created
Regular history Carving Live RAM
Bebo     2011-12-09
Facebook 2011-06-27   2011-06-27
Google+
  2012-02-12
Orkut
  2012-02-12
Twitter
  2011-12-13
Vkontakte.ru  
2010-11-21

Extracted information

Bebo Live RAM analysis extracts messages from bChat and bebo friend chat can be extracted: message text, sender name, sender id, recipient id, time.
Facebook Live RAM analysis for both chat messages and ordinary Facebook mail works with Internet Explorer, Google Chrome and Firefox. Sender, recipient (their names and Facebook account numbers), time, subject and body of messages, the sender photo link, profile url, last updated time can be extracted.

Internet Explorer only: profile files can be found in IE cache. It is possible to extract contacts and chat messages from such profiles. (Facebook fixed this around Sep, 2011).

Newsfeed Live RAM analysis analysis supported. It works with Internet Explorer and Google Chrome. News messages as well as name, and sometimes id and link of the person who posted can be extracted, sometimes with additional information like ids or links of people or places mentioned in news message. In some cases time of the news message is also extracted.

Photoalbums Live RAM analysis supported. It works with Google Chrome. Album name, album link, the place it is connected to, time and last updated time, the name of the person who posted and photos links can be extracted Messages and chat messages analysis enhanced. It is working with Internet Explorer and Google Chrome.
Google+ Message text, date, sender and receiver (the latter only in case it was sent from the computer under investigation) are extracted.
Orkut Message text, date, sender and receiver (the latter only in case it was sent from the computer under investigation) are extracted.
Twitter Twitter status text is extracted, along with its id, time, location and coordinates (when available), information about users or urls mentioned in the status, the source of the status (it can be web or some mobile application), how many times it was retweeted and whether it was favorited. In case the status was a reply, the screen name, user id and status id of the status replied to can be extracted as well. Information about the owner is also extracted - name, screen name, id, his description of himself, the url he provides, the number of his friends, followers and his listed count, sometimes the acount creation time, location of the person, statuses count, profile image link, whether the account is the default account and whether the account is followed by the default (logged in) account.
Vkontakte.ru Live RAM  analysis for Vkontakte.ru chat messages works with Internet Explorer, Google Chrome and Firefox. Sender name, recipient user id and time can be extracted.

See also:

Browser Support
Email Client Support
Instant Messenger Support
Multi-player Game Support
Office Document Support 
Picture and Video Support
P2P Support