18.1 Social Media, Social Engineering, Insider Threat & Identity Theft Forensics
Key Takeaways
- Social media evidence is preserved by capturing the page with hash verification and metadata (URL, capture time, examiner) rather than by screenshot, because a screenshot carries no verifiable provenance and platforms mutate content continuously.
- Content held by a U.S. social platform requires a search warrant under the Stored Communications Act; a subpoena reaches only basic subscriber records, and a § 2703(f) letter preserves for 90 days while process is obtained.
- Insider data theft is proven by the convergence of USB device enumeration (USBSTOR and setupapi.dev.log), file-access artifacts (ShellBags, LNK, Jump Lists, recent docs), cloud-sync client logs, and print and email egress records.
- Business email compromise investigations turn on mailbox rule creation, OAuth application consent grants, and impossible-travel sign-in records rather than on malware, because BEC typically involves no payload at all.
- Aggravated identity theft under 18 U.S.C. § 1028A carries a mandatory two-year sentence that runs consecutively to the underlying offense, which is why establishing use of a real person's means of identification matters to the charging decision.
18.1 Social Media, Social Engineering, Insider Threat & Identity Theft Forensics
Quick Answer: Blueprint Domain 4 lists social media forensics, social engineering forensics, and insider threat and identity theft forensics; Domain 6 adds social media forensic tools and insider threat tools. These share a defining property: the adversary is a person exercising legitimate access or legitimate platform features, so there is often no malware and no exploit. The evidence is therefore behavioral convergence — many individually innocuous artifacts that only become a finding when correlated on one timeline.
Social Media Forensics
Capture That Survives Challenge
A screenshot is the weakest possible form of social media evidence: it has no provenance, no hash, no source URL binding, and no defense against the accusation that it was edited. Defensible capture records the content, its source, and its integrity together.
| Method | What it produces |
|---|---|
| Forensic web capture (X1 Social Discovery, Hunchly, Page Vault) | Page content plus underlying HTML/DOM, HTTP headers, source URL, capture timestamp, examiner identity, and a hash of the captured artifact |
| Platform self-service export | "Download Your Information" archives — complete, structured, and authenticated to the account, but obtainable only with the account holder's cooperation |
| Legal process to the provider | Server-side records including deleted content, login IP history, and device identifiers |
| Device-side extraction | App databases and caches on the suspect's phone or workstation — often the only copy of deleted messages |
Always record the capture time and time zone, the examiner, the tool and version, the URL, and the hash. Platforms render content dynamically and personalize it per viewer, so two examiners capturing the same URL may legitimately see different results — documenting the capture conditions is what makes the difference explainable.
Device-Side Social Artifacts
Social evidence frequently survives on the endpoint after server-side deletion:
- Mobile: SQLite databases in the app sandbox (
/data/data/<package>/databases/on Android; the app container on iOS), cached media, notification history, and theWALand-shmjournals that hold recently deleted rows. - Desktop: browser cache, IndexedDB, and Local Storage for web clients; Electron app LevelDB stores for desktop clients (covered in 18.2).
- Both: thumbnails, downloaded media in shared storage, and clipboard history.
Legal Process for Platform Data
Provider-held data follows the SCA tiering from Section 3.4 exactly: basic subscriber records by subpoena, other non-content records by § 2703(d) order, and content by search warrant, with a § 2703(f) preservation letter freezing everything for 90 days while process is prepared. Because platforms purge aggressively and users delete, the preservation letter is almost always the first action.
Open-Source Investigation Tools
| Tool | Use |
|---|---|
| X1 Social Discovery | Collection with hashing and chain-of-custody metadata; eDiscovery-grade export |
| Hunchly | Passive capture of every page visited during an investigation, with an automatic audit trail |
| Maltego | Link analysis across accounts, domains, emails, and infrastructure |
| Sherlock / WhatsMyName | Username enumeration across many platforms |
| ExifTool | Metadata from posted images; note that most major platforms strip EXIF on upload, so the presence of intact GPS EXIF often indicates the file came from the device rather than from the platform |
Social Engineering Forensics
Social engineering leaves evidence in communications and in the victim's own actions, not in exploit artifacts.
Phishing Reconstruction
- Obtain the original message with full headers (a forwarded copy loses the original
Received:chain — always request the.emlor.msg). - Parse
Received:bottom-up for the true originating IP; evaluate SPF, DKIM, and DMARC results as recorded by the receiving gateway. - Examine display-name spoofing, lookalike domains (homoglyphs, added hyphens), and
Reply-Todivergence fromFrom. - Extract and detonate URLs in isolation; capture the credential-harvesting page and its hosting infrastructure.
- Correlate the click to proxy logs and the subsequent authentication event to determine whether credentials were actually used.
Business Email Compromise — Where There Is No Malware
BEC is the blueprint-relevant case precisely because endpoint forensics finds nothing. The evidence is in the cloud tenant:
| Artifact | What it proves |
|---|---|
| Inbox rule creation | The classic BEC tell: a rule auto-deleting or moving messages containing "invoice", "wire", or the finance team's domain to a rarely viewed folder |
| Mailbox audit log / Unified Audit Log | New-InboxRule, Set-Mailbox, MailItemsAccessed, Add-MailboxPermission |
| Sign-in logs | Impossible travel, unfamiliar ASN, legacy authentication protocols bypassing MFA |
| OAuth consent grants | An attacker-registered application granted persistent mailbox access — survives a password reset, which is why password reset alone does not remediate |
| Message trace | Outbound fraudulent mail sent from the compromised mailbox |
Pretexting, Vishing, and Physical Social Engineering
Evidence sources shift to the service desk ticket that recorded the reset request, the call detail records and voicemail, the badge/access-control log showing tailgating, and the CCTV covering that door. The forensic examiner's role is often to align these with the digital timeline rather than to produce them.
Insider Threat Forensics
The insider already has access, so no authentication anomaly appears. Detection is about deviation from that person's own baseline and about the mechanics of getting data out.
The Exfiltration Channels and Their Artifacts
| Channel | Artifacts |
|---|---|
| USB mass storage | SYSTEM\CurrentControlSet\Enum\USBSTOR (vendor, product, serial), MountedDevices (drive letter binding), setupapi.dev.log (first-ever connection time), Windows Portable Devices, and Event IDs 6416/4663 where object auditing is enabled |
| Cloud sync | OneDrive/Dropbox/Google Drive client logs and local sync databases; provider-side audit logs showing upload volume |
| Personal webmail | Proxy logs showing large POSTs to webmail domains; browser history and cache |
| Printing | Print spooler .SPL/.SHD files (when retained), Microsoft-Windows-PrintService/Operational Event ID 307 with document name, user, and page count |
| Screenshots/photography | Screenshot files, clipboard artifacts, and — where policy permits — mobile device examination |
| Email attachment | Message trace and DLP events showing volume to external recipients |
| Source code / repository | Git clone events, unusual bulk repository access, personal remote added to a corporate repo |
The Convergence Pattern That Makes the Case
No single artifact proves theft. The finding is built from a timeline like this:
- Resignation or grievance event establishes motive and dates the window.
- ShellBags, LNK files, Jump Lists, and RecentDocs show the user browsing directories they had never opened before — typically the client list, pricing, or design repository.
$MFTand$UsnJrnlrecord mass file copying with a characteristic burst of identical creation timestamps on a removable volume.USBSTORplussetupapi.dev.logidentify the exact device by serial number and date its first connection.- Prefetch for an archiving utility (
7Z.EXE,WINRAR.EXE) or a wiping tool corroborates staging or anti-forensics. - Cloud sync or webmail proxy records capture any parallel electronic path.
- After-hours access patterns distinguish the activity from the user's normal working rhythm.
| Tool class | Examples | Role |
|---|---|---|
| UEBA | Exabeam, Securonix, Microsoft Defender for Identity | Behavioral baselining and deviation scoring |
| DLP | Forcepoint, Symantec, Microsoft Purview | Content-aware egress blocking and alerting |
| Endpoint DFIR | Velociraptor, KAPE, Magnet AXIOM | Artifact collection and timeline building |
| Device control | Endpoint agents restricting removable media | Both a control and a log source |
[!WARNING] Insider investigations have a legal and HR dimension that precedes the technical work. Monitoring must be grounded in a published acceptable-use policy and a documented, lawful basis; employment law, works-council obligations, and privacy regimes such as GDPR constrain what may be collected and reviewed. Coordinate with legal counsel and HR before collection, and preserve rather than confront — alerting the subject invites destruction of evidence.
Identity Theft Forensics
| Statute | Provision |
|---|---|
| 18 U.S.C. § 1028 | Fraud and related activity in connection with identification documents and means of identification |
| 18 U.S.C. § 1028A | Aggravated identity theft — a mandatory two-year term that runs consecutively to the underlying felony |
| FTC / IdentityTheft.gov | Victim recovery process and the FTC Identity Theft Report used to dispute fraudulent accounts |
Evidence typically assembled:
- Possession artifacts: documents, spreadsheets, or database dumps of names, dates of birth, and government identifiers — including in unallocated space, browser cache, and messaging attachments.
- Acquisition: phishing kits and their captured-credential files, skimmer device data, purchase records from criminal markets, and credential-stuffing tooling with its combolists.
- Use: account-opening applications tied to the suspect's IP or device fingerprint, delivery addresses, and beneficiary accounts.
- Monetization: cryptocurrency wallets and exchange records, money-mule transfers, and gift-card purchase chains.
[!IMPORTANT] Handling a victim data set is itself a regulated act. A recovered file containing thousands of real identities is protected personal data. It must be stored encrypted, access-logged, minimized in the report (redacted or referenced by record count and sample), and disposed of under the case retention policy. An examiner who attaches the raw list to a report has created a second breach.
A departing engineer is suspected of taking design files. Registry analysis shows a USBSTOR entry for a SanDisk device with serial 4C530001120607116542, and setupapi.dev.log records its first connection three days before the resignation. What does the serial number in USBSTOR uniquely establish, and what is its limitation?
A finance director's mailbox was used to send fraudulent wire instructions. Endpoint forensics finds no malware. The tenant audit log shows a New-InboxRule event moving any message containing 'invoice' to RSS Subscriptions, and an OAuth consent grant to an unrecognized application. After the password reset, fraudulent activity continues. What explains the persistence?
An investigator must preserve a public social media post that is central to a harassment case and that the account holder may delete at any moment. Which approach produces the most defensible evidence?