Beruflich Dokumente
Kultur Dokumente
Local data/artifacts (history, cookies, cache, downloads folder, search history, photos, chat-IM
history, snapshots) from accused/victim's machine/device.
note: local data are often volatile/removable and/or not must to be present in every case.
In most case local data are being examine/extracted by forensics personnel after seizing and
sending machine/device to Forensic Lab ,so it is not possible that evidence can be available before
tracing back/identifying machine which was been used for criminal act.
For identifying that particular machine/device or accused from all WAN users investigator should first
obtain server log records/information from Social networking site/ISP.
Server log data (log in-out details from server side, account usage details, other related identical
details, alternate contact/account recovery details) which are being saved eventually on social
networking site's logging server.
This type of data is being obtained by authorised law enforcement/security agency personnel from
social networking site using pre-defined procedures for acquiring information.(See Page no.)
For obtaining data-records/information from any social networking site/Service provider investigator
should provide unique identifier/URL for that particular account/page/event to them (see page no).
Time/duration for required data-records/information should be decided by investigator which also
plays important role in identifying accused/machine used for criminal act.
There are various types of data-records/information which can be sought from social networking site/
service provider which are as following
NOTE: these information vary on site/provider and their timely system changes.
- > Time stamp when criminal act done or believed to be done, duration for particular event which is
being investigated.
• Criminal act short detail( crime type and its affect on applicant/infrastructure/public)
- > Details in short which explains crime type and its affect ,this is required for request review and
cross-check of criminal act from service provider/site.
• Comments-remarks
- > remarks should be clearly mentioned in notice/request letter in any more help/steps to be taken
like following
- Sensitivity of case/criminal act and reason for prioritize request resolution.
- Termination or blocking-access of service for fake/hacked/defamed account or profile.
- Intimate or not to user for any changes(violation removal, termination, warning).
- Mobile-number verification process enforcement before termination.
google+
Follow these simple steps to find your/suspect's Google Plus User ID:
1) Login to your Google+ account then search for required user.
2) click on the Profile icon
3) In the address bar you will see your complete Google+ URL. It will look something like this:
https://plus.google.com/100519699729647583880/posts
4) Your Google Plus User ID is the long series of numbers that i have highlighted in this instance my
Google+ ID is the following:
100519699729647583880
Others
To find out Myspace URL & User ID :
1. Visit profile
2. Your URL is in the browser window (it will be something like http://www.myspace.com/000000
or http://www.myspace.com/VanityURL)
3. Your User URL is 000000 or VanityURL
Linkedin :
www.linkedin.com/in/xyz
where xyz is vanity URL
You can use theIDin this URL and this will give you the link to User Profile http://www.linkedin.com/
profile/view?id=YourID
where YourID is userid
• Should take snapshot of each and every part of account which are relevant to the case.
• All snapshot should include URL so that account identification and evidence finding can be
made easy at later stage.
• Snapshots/prints of messages or wall/page posts with URL should be taken in hate speech/
threatening/abuse case.
• Original profile snapshot should be given in case of photo/information copy from original
profile and been used to create fake/imposter account.
• Should note date-time (Time Stamp) of particular criminal act in case of hacking of account or
any unauthorised access then after.
• If u can't access profile contents because of privacy settings then you must record its user-id
so it can be useful to request details from Social networking Site end.
After taking all the snapshots and victim/witness's detailed statement about crime/incident,
investigator should ask social networking site for available details from their side.
For that investigator must have knowledge about procedures to obtain details/logs from any Social
networking site/Web Site/blog. there are several methods for obtaining data records from their side
for legal investigation/enquiries which are also being changed time to time and also depends on
country from where Service provider/website is being maintained/operated.
Legal Procedures
(1) legal notice under applicable law /procedure (Section 91 of CRPC for India) for obtaining log-
records being saved on server side in electronic form.
(2) Additional legal required documents in case of preservation or any details which are not being
served in log-records (mostly not being used in all cases).
(3) letter rogatory/ MLAT process documents in case of involvement of other nation's jurisdiction and
also depends seriousness of case ( not all security/law enforcement agencies are doing this
procedure and in only very serious criminal act like terrorism, tax evasion, money laundering, human
trafficking etc.. )
(4) other legal documents which can be used for various purpose(interception, blocking access,
terminating services/account).
Google Voice:
By this you will receive secure access link on provided government email id.
(Note: secure access link will be active only for an hour)