<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-social-media-evidence
description: >-
  Social media forensic preservation and analysis of posts, messages,
  metadata, and account activity across platforms. Covers evidence
  preservation with archival tools, EXIF metadata extraction from
  uploaded media, timeline reconstruction, account attribution, and
  legally defensible screenshot capture with hash verification.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - social-media-forensics
  - osint
  - evidence-preservation
  - exif
  - metadata
  - web-archiving
  - timeline-analysis
  - screenshot-capture
  - hash-verification
  - account-attribution
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1593", "T1589"]
  nist-csf: ["RS.AN-1", "RS.AN-3"]
  frameworks: ["NIST SP 800-86", "SWGDE Best Practices for Social Media"]
---

# Analyzing Social Media Evidence

## Overview

Social media forensics involves the preservation, collection, and analysis
of digital evidence from social platforms. Content is ephemeral — posts can
be edited or deleted — making timely preservation critical. This skill
covers archival capture, metadata analysis, account attribution, and
chain of custody for social media evidence.

## Prerequisites

| Requirement | Details |
|---|---|
| `gallery-dl`, `yt-dlp`, `wget`, `curl` for content download | Required |
| `exiftool` for metadata extraction | Required |
| `hunchly`, `webrecorder` for authenticated capture | Required |
| `sha256sum` for integrity verification | Required |
| Browser with developer tools for API inspection | Required |

## Workflow

### Step 1: Evidence Preservation with Hashing

```bash
# Capture webpage with wget (full site mirror)
wget --mirror --convert-links --adjust-extension \
  --page-requisites --no-parent \
  -P ./evidence/ "https://platform.example/user/post/12345"

# Hash the captured content immediately
find ./evidence/ -type f -exec sha256sum {} \; > evidence_hashes.txt
date -u +"%Y-%m-%dT%H:%M:%SZ" >> evidence_hashes.txt

# Capture with single-file archiver
monolith "https://platform.example/user/post/12345" \
  -o evidence_post.html
sha256sum evidence_post.html >> evidence_hashes.txt

# Wayback Machine submission for third-party preservation
curl -s "https://web.archive.org/save/https://platform.example/user/post/12345"
```

### Step 2: Media Download and Metadata Extraction

```bash
# Download media with gallery-dl (preserves metadata)
gallery-dl --dest ./media_evidence/ \
  "https://platform.example/user/post/12345"

# Download video evidence
yt-dlp --write-info-json --write-thumbnail --write-subs \
  -o "./video_evidence/%(title)s.%(ext)s" \
  "https://platform.example/video/12345"

# Extract EXIF metadata from downloaded images
exiftool -json ./media_evidence/*.jpg > exif_data.json
exiftool -GPS* ./media_evidence/*.jpg    # GPS coordinates
exiftool -DateTimeOriginal -Make -Model ./media_evidence/*.jpg

# Check for metadata stripping (platform processing)
exiftool -all ./media_evidence/photo.jpg | wc -l
# Most platforms strip EXIF — original uploads retain more
```

### Step 3: Account Activity Timeline

```bash
# Parse downloaded data archive (GDPR export)
# Most platforms provide account data export
python3 -c "
import json, glob
for f in glob.glob('account_export/**/*.json', recursive=True):
    with open(f) as fh:
        data = json.load(fh)
    print(f'File: {f}')
    if isinstance(data, list):
        print(f'  Records: {len(data)}')
    elif isinstance(data, dict):
        print(f'  Keys: {list(data.keys())[:10]}')
"

# Extract timestamps from API responses
python3 -c "
import json
with open('api_response.json') as f:
    posts = json.load(f)
for post in posts.get('data', []):
    print(f\"{post.get('created_at')}: {post.get('text', '')[:80]}\")
"
```

### Step 4: Screenshot Capture with Forensic Metadata

```bash
# Browser-based screenshot with timestamp
python3 -c "
from datetime import datetime, timezone
from hashlib import sha256
from pathlib import Path

# After taking screenshot via browser automation:
screenshot = Path('evidence_screenshot.png')
content = screenshot.read_bytes()
h = sha256(content).hexdigest()
ts = datetime.now(timezone.utc).isoformat()
print(f'File: {screenshot.name}')
print(f'SHA-256: {h}')
print(f'Captured: {ts}')
print(f'Size: {len(content)} bytes')

# Write verification record
with open('screenshot_verification.txt', 'w') as f:
    f.write(f'File: {screenshot.name}\n')
    f.write(f'SHA-256: {h}\n')
    f.write(f'Timestamp: {ts}\n')
"
```

## Detection

```yaml
title: Social Media Evidence Detection
id: 2d75c226-b789-4bc9-bafd-308ce3775e2a
status: experimental
description: Detects suspicious activity related to analyzing social media evidence techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*social*"
  condition: selection
level: medium
tags:
  - attack.t1593
  - attack.t1589
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Social Media Evidence Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1593, T1589 |

## Verification

- [ ] Content preserved before any deletion/modification
- [ ] All captured files hashed immediately after download
- [ ] EXIF metadata extracted from media files
- [ ] Third-party archival submitted (Wayback Machine)
- [ ] Account timeline reconstructed from available data
- [ ] Screenshots captured with hash verification
- [ ] Chain of custody documentation completed

## References

- [SWGDE Best Practices for Social Media Evidence](https://www.swgde.org/)
- [gallery-dl — Media Downloader](https://github.com/mikf/gallery-dl)
- [yt-dlp — Video Downloader](https://github.com/yt-dlp/yt-dlp)
- [ExifTool — Metadata Reader](https://exiftool.org/)
- [Hunchly — Web Capture Tool](https://www.hunch.ly/)
- [Wayback Machine — Internet Archive](https://web.archive.org/)
