Forensic Investigation of any FaceBook Profile

Facebook forensic toolkit is a Forensic tool where you can Investigate on a criminal or a prime suspect’s facebook account hence you can get all the information such as (User info, profile, Timeline, Messages, Events, Albums, Group, Likes, Friends, Contacts)

Download FaceBook forensic toolkit from here and install it in your pc

Now open FaceBook forensic tool kit and click on “Examine Profile and Clone Data”

Now in New Case – Information, Browse the location to save the report
for example: C:UsersRAJDesktopfacebookforensic

Now fill the following details like case number, evidence number, description, examiner, Notes.

Now click on next button

Now in next step you have to enter the desired FaceBook account URL
for example: www.facebook.com/yourprofile Proceed for the next step.

Now in new case – Evidence step you have to choose the content that you want to search in desired FaceBook account like in the image I have chose to show all content, now I can see all the content

In this step you have to authenticate with your FaceBook account to proceed the process

Note: Desired FaceBook account authentication is not required.  And no FaceBook account details will be disclosed

Now on the top right corner you can see start button to start the process click the button and start the process. And wait until the toolkit gathers all the information from the desired facebook account.

Now you can see the result, as I choose to show all the content from desired facebook account.

All the content like profile, Timeline, photo albums, and etc. will be shown for the desired facebook account, here in the image displaying the desired accounts profile

Here in timeline FFT displaying information as XML form but all the data required is shown in text.

Here in the image you can see the categories user has liked
eg: website, actor, cars, etc.

Here you can see the user groups and to which group he is administrator.

Now when you complete the process then a report will be created with a name Eg: report-2124

In location you given at second step as I have given location as  C:UsersRAJDesktopfacebookforensic Report will be saved there
Now open the report and you can see each and every content that user has done in his facebook account including facebook post with date.

Author “Suraj Kumar is a cyber security researcher