Welcome to our blog, where we’ll be sharing the latest and greatest in Osint Social Media Tools.
Osint Social Media Tools is a software development company that specializes in developing social media tools for businesses. We’re excited to share what we’ve learned with you as we continue to grow!
Osint Social Media Tools
People interact with social media sites for different purposes. The following are the general interactions used across different social media sites:
- Post/comment: People access social sites to post or write paragraphs of text that can be seen by other users. Such posts can also include user’s geographical info (In Facebook, they call this feature, a “Check in”).
- Reply: This is a text message (can also be an image, video, or URL) that replies to another user’s post, update status, or comment.
- Multimedia content (images and videos): Multimedia is popular; a user can upload a video or image as a part of their post. Many social platforms allow their users to upload multiple images/videos to form an album. Live streams also are available on many social platforms such as Facebook, Twitter and YouTube. This feature allows a user to broadcast live videos and display the recording on their profiles for later viewing.
- Social interactions: This is the essence of social media sites, where people get connected online by sending/responding to other user’s request.
- Metadata: The results from the sum of user interactions with the social platform. Examples include the date and time when a video/image was uploaded, the date and time when a friend request was accepted, geolocation data—if enabled—of the uploaded multimedia file or post, and the type of device used to upload the contents (mobile or a standard computer).
SOCMINT is interested in gathering all these content types, however the ability to do this depends on the privacy control level set by each user when publishing posts/updates online. For example, it is not possible to see other people’s updates on Facebook if they restrict a post’s visibility to some friend circles or set it to “Only me.”
Classifications of Social Media Platforms
Many people use the terms social media and social networking interchangeably to refer to Facebook, Twitter, LinkedIn, and related social platforms. This is not absolutely wrong, but it is not accurate because social media is the main umbrella that contains other categories like “social networking” that holds sites like Facebook.
The following are the main social media types classified according to function:
- Social networking: This allows people to connect with other people and businesses (brands) online to share information and ideas. Example include Facebook and LinkedIn.
- Photo sharing: Such websites are dedicated to sharing photos between users online. Example include: Instagram & Flicker.
- Video sharing: Such websites are dedicated to sharing videos, including live video broadcasts. The most popular one is YouTube. Please note that Facebook and Twitter also offer live video broadcast service.
- Blogs: This is a type of the informational website containing a set of posts—belonging to one topic or subject—organized in descending order according to the publish date. The most popular blogging platforms are WordPress and Blogger, which is powered by Google.
- Microblog: This allows users to publish a short text paragraph (which can be associated with an image or video) or a link (URL) to be shared with other audience online. Twitter is the most popular example.
- Forums (message board): This is one of the oldest types of social media. Users exchange ideas and discussions in a form of posted messages and replies. Reddit is an example.
- Social gaming: This refers to playing games online with other players in different locations. It has gained more popularity recently. KAMAGAMES and zynga are examples of this type.
- Social bookmarking: These websites offer a similar function to your web browser’s typical bookmark. However, they allow you to do this online and share your Internet bookmarks among your friends in addition to adding annotations and tags to your saved bookmarks. Example include: Atavi and Pinterest
- Product/service review: These websites allow their users to review—give feedback—about any product or service they have used. Yelp and Angie’s List (www.angieslistbusinesscenter.com) are examples of this type.
Now we have a good understanding of the different types of social media sites, it’s time to begin talking about how to use different tools and techniques to acquire intelligence from these platforms, we will limit our discussion to the most two popular social media sites which are: Facebook and Twitter.
Facebook is the most popular social media platform,it falls under the social networking type and has the largest users base on earth. Facebook was offering an advanced semantic search engine to search within its database by using natural English language phrases and keywords. This semantic search engine called Graph Search and was first introduced in early 2013; it allows Facebook users to type in their queries in the Facebook search box to return accurate results based on their questions/phrases or combined keywords. For example, you can type: Pages liked by ********* replacing the asterisks with the target’s Facebook username, to return a list of pages liked by the specified user.
In 2019, Facebook has removed the Graph search functionality, although, users are still able to utilize Graph search, however, they need to build their graph search queries manually.
After removing its direct support to Graph search, Facebook has improved its search functionitly makng it more accurate, it also adds many filters (see Figure 1) to refine your search as neccessary. Keep in mind you should login to your Facebook account first to use the search options.
Figure 1: Using Standard Facebook Keyword search, notice the number of filters to refine your returned results
There are several online services for searching Facebook without creating customized search queries, the following list the most popular one:
- Facebook Graph Searcher from Intelligence X (https://intelx.io/tools?tab=facebook): You can search for posts from a specific date or month, post from a specific user posting about something, you can also search for posts posted by unknown users which is beneficial for online investigations (see Figure 2).
Figure 2: Searching Facebook using Intelligence X
2. Sowdust (https://sowdust.github.io/fb-search): This is another online tool to show how the current Facebook search function works, you can search for posts from a specific user/page, restrict to posts published in group or restricting it to specific location. You can filter by Start/End date and Keyword. Other search options include searching for photos, pages, places among others (see Figure 3).
Figure 3: Sowdust interface to search Facebook
- SearchBook (https://github.com/sowdust/searchbook): This is a Firefox add-on (a version is also available for Chrome browser) for executing some Graph-like searches against Facebook. The Add-on functionality is based on the research article Facebook graph search workaround published by Social Links (https://mtg-bi.com/blog/tpost/aiaxk4xl4d-facebook-graph-search-workaround). I tested this extension under Firefox, however, it broke many times during usage.
Legal notice! Using customized code to manipulate Facebook search queries might be against Facebook Terms of Service and even against the law in many countries, so be careful with this regard.
Online Facebook Search Tools/Services
There are many online services that simplify the process of acquiring/analyzing information from Facebook accounts. The following are the most useful ones:
- Lookup ID (https://lookup-id.com): This site helps you to find Facebook personal IDs. This ID is necessary when using any of the previous online services –mentioned previously- used to compliment Facebook standard keyword search.
- Facebook Page Barometer (http://barometer.agorapulse.com): This site gives statistics and insight about specific Facebook profiles or pages.
- Information for Law Enforcement Authorities (https://www.facebook.com/safety/groups/law/guidelines): Offers information and legal guidelines for law enforcement/authorities when seeking information from Facebook and Instagram.
- A directory of free tools and online services for searching within Facebook can be found at: https://osint.link/osint-part2/#facebook
Twitter has a built-incorner search functionality located in the upper-right side of the screen—when using the Twitter web interface—after logging into your Twitter account. A simple Twitter search allows you to perform a basic search within the Twitter database.
However, do not underestimate this little box, as you can add advanced search operators—similar to Google advanced search operators known as Google Dorks—to your search query to force it to dive deep and return accurate results, as you are going to see next.
To begin your search against Twitter database, it is advisable to go to the Twitter Advanced search at https://twitter.com/search-advanced , from this page, you can customize search filters to specific date ranges, people and more.
Twitter Advanced Search Operators
Similar to Google, Twitter allows you to use specialized operators to find related tweets more precisely. Twitter search operators are already available in the Twitter developer site, go to https://developer.twitter.com/en/docs/tweets/rules-and-filtering/overview/standard-operators to view them (see Figure 4).
Twitter search operators can be incorporated with other criteria to create more advanced search queries to find related tweets more precisely, the following are some advanced Twitter search query to start your search with.
- The negation operator (–) is used to exclude specific keywords or phrases from search results. Example: virus –computer
2. To search for hashtags use the (#)operator followed by the search keyword. For example: #OSINT
3. To search for tweets sent up to a specific date, use the (until) operator. Here’s an example: OSINT until:2019-11-30(this will return all tweets containing OSINT and sent until date November 30, 2019).
4. To search for tweets sent since a specific date, use the (since) operator followed by the date. Here’s an example: OSINT since:2019-11-30 (this will return all tweets containing OSINT and sent since November 11, 2019).
5. Use the (images) keyword to return tweets that contain an image within it. Here’s an example: OSINT Filter:images(this will return all tweets that contain the keyword OSINT and have an image embedded within them).
6. To return tweets with video embedded with them, use the (videos) keyword (similar to the images filter). Here’s an example: OSINT Filter:videos
7. To search for video uploaded using the Twitter Periscope service, use the (Periscope) filter. Here’s an example: OSINT filter:periscope (this will search for all tweets containing the OSINT keyword with a Periscope video URL).
8. To return tweets with either image or video, use the (media) operator. Here’s an example: OSINT Filter:media
9. To return tweets that contain a link (URL) within them, use the (links) keyword. Here’s an example: OSINT Filter:links
10. To return tweets that contain a link (URL) and hold a specific word within that URL, use the URL keyword. Here is an example: OSINT url:amazon this will return all tweets that containing OSINT and a URL with the word “amazon” anywhere within it (see Figure 5).
11. To return tweets from verified users only (verified accounts have a blue check mark near their names) (see Figure 6), use the (Verified) operator. Here’s an example: OSINT Filter:verified
12. Use the (min_retweets) operator followed by a number. Here’s an example: OSINT min_retweets:50 (this will return all tweets containing the OSINT search keyword that have been retweeted at least 50 times)
13. Use (min_faves) followed by a number to return all tweets with NUMBER or more likes. Here’s an example: OSINT min_faves:11 (this will return all tweets that have at least 11 or more likes and that contain the OSINT search keyword)
14. To limit Twitter returned results to a specific language, use the (lang) operator. Here’s an example: OSINT lang:en (this will return all tweets containing OSINT in the English language only). To see a list of Twitter-supported language codes, go to https://developer.twitter.com/en/docs/twitter-for-websites/twitter-for-websites-supported-languages/overview.
15. To search for tweets with a negative attitude use the following symbol 🙁 For example: OSINT 🙁 will return all tweets containing the keyword OSINT written in a negative attitude.
We can combine more multiple Twitter search operator to perform a more precise search. For example, type “OSINT” from:darknessgate -Filter:replies lang:en to get only the tweets containing the exact phrase OSINT from the user darknessgate that are not replies to other users and in the English language only.
Online Twitter Analysis Services
The following are online services to help you find information on Twitter:
- All My Tweets (https://www.allmytweets.net): View all public tweets posted by any Twitter account on one page.
2. Trendsmap (https://www.trendsmap.com): This shows you the most popular trends, hashtags, and keywords on Twitter from anywhere around the world.
3. First Tweet (http://ctrlq.org/first): Find the first tweet of any search keyword or link.
4. Social Bearing (https://socialbearing.com/search/followers): Analyze Twitter followers of any particular account (a maximum of 10,000 followers can be loaded).
5. Spoonbill (https://spoonbill.io): Monitor profile changes from the people you follow on Twitter (see Figure 7).
Track social media users across multiple platforms
Most internet users have more than one social media account, according to statista, average number of social media accounts per internet user was 8.5 in 2018. This information is useful and should be present in our mind when searching social media sites, for instance, many people prefer to use the same username in multiple social media platforms. If we know the username of one social media account of the target, we can search to see where else this username is used on other social media platforms.
You can check specific usernames to see where they are being used (e.g., social media Sites) or to know whether a particular username really exists using any of the following free online services.
1. Check User Name (http://checkusernames.com): Check the use of a specific username on 160 social networks. This is useful to discover target social media accounts to see if they are using the same username on multiple platforms.
2. Namechk (https://namechk.com): Check to see whether a specified username is used for major domain names and social media sites (see Figure 8).
3. Namecheckr (https://www.namecheckr.com): Check a domain and social username availability across multiple networks.
4. User Search (https://www.usersearch.org): Scan 45 popular social media websites.
5. UserRecon (https://github.com/thelinuxchoice/userrecon): A Linux tool to find usernames across over 75 social networks.
6. Sherlock (https://sherlock-project.github.io): Sherlock Project, can be used to find usernames across many social networks. It requires Python 3.6 or higher and works on MacOS, Linux and Windows.
Social Media Psychological Analysis
The psychological status of the person posting the contents on their profile can also give important information, even more than the content itself (in some cases). For instance, the true identity of an anonymous Twitter account can be revealed by performing linguistic analysis of the target account.
In addition, people can be tracked online by examining the way they use language when they chat or when they broadcast their thoughts online (for example, the way a target uses capitalization, omits or includes words, and pronounces some words). The advances in artificial intelligence systems will make analyzing social media accounts more effective and will help examiners uncover the true identity of anonymous social media accounts.
This online service (https://tone-analyzer-demo.mybluemix.net) offers free linguistic analysis to detect human feelings found in text such as tweets, emails, and Facebook messages (see Figure 9).
osint tools for social media investigators
ocial media offers investigators incredible opportunities to collect evidence. There are plenty of examples on the Internet of supposedly injured individuals posting runs and rides on Strava and incriminating car crash footage making its way onto YouTube. In fact, social media intelligence (SOCMINT or SMI) has become a standard part of many investigations—including insurance fraud, IP theft, online defamation, and even criminal cases.
As the video below illustrates, insurance is a great example of an industry where investigators typically turn to social media as soon as a situation seems suspicious—and their social searches are often rewarded.
But as useful as social media can be when it comes to collecting evidence, it also introduces challenges. In particular, gathering evidence can be time-consuming work. Some of the most laborious and frustrating tasks include:
Scouring dozens (or hundreds) of social media platforms to find relevant accounts
Finding the origins of an online image
Manually expanding comments and replies to check for relevant content
Taking countless screenshots of posts—sometimes capturing an entire Twitter or Instagram account manually
These tasks can be so time-consuming that an investigation simply isn’t cost-effective. For example, as a private investigator, you could spend hours and hours on social media—but would a client be willing to pay for that time? Isn’t everyone facing pressure to reduce the cost of review?
5 Social Media Investigation Tools That’ll Save You Time & Reduce Frustration
Luckily there are social media investigation tools out there that can greatly reduce repetitive work—and even automate the collection of evidence. With these tools you can greatly expand your online investigations and capture valuable evidence before it’s deleted.
Here are five tools designed to make your online investigations more successful and efficient:
WebPreserver: Collect and preserve social media evidence in defensible format
Makeawebsitehub: Identify the latest social media apps and platforms
Pipl Search: Find public records, online data, and other information related to an individual
TinEye: Use reverse image search to find the source of an online picture
TweetBeaver: Use Twitter analytics to understand an account and identify connections
5 Must-Have Social Media Investigation Tools
What is it for? Collection and preservation of social media and other online content.
WebPreserver is an automated forensic preservation tool for social media and web content that can literally complete weeks of evidence collection in under an hour. Its auto-expand feature automatically expands long collapsed posts, comment threads, and replies, ensuring hidden content is captured without you having to manually expand these sections. WebPreserver can even capture entire websites, Instagram accounts, and videos with two simple clicks. WebPreserver is a Chrome plug-in that can be downloaded from the Chrome Web Store, but you need to purchase a license through the WebPreserver website. See how the tool works by visiting this page—or simply check out the video below.
What is it for? Identifying the latest social media platforms and apps.
Have you ever heard of Peanut, Caffeine, or Steemit? What about Ello, Triller, or WT Social? While it can feel as if platforms like Facebook, Instagram, Twitter, and YouTube dominate the social media landscape, new apps and platforms are being released all the time. Makeawebsitehub.com regularly updates a list of the latest social media apps, which can be very useful for expanding your online investigations and finding those lesser-known platforms that might be hiding useful evidence.
- Pipl Search
What is it for? To identify personal, professional, and social information online.
Pipl Search is arguably the most sophisticated people search engine available to investigators. Pipl collects information from Internet sources like public records, listings, directories, and online archives—but it also boasts its own exclusive sources. Pipl has global coverage, with over three billion online identities and 25 billion individual identity records at its disposal. All you need is a single data point (like a name, phone number, or email address) and Pipl will quickly provide you with all available data for that person. This information can include associated social media accounts, all known telephone numbers, physical addresses, places of employment, educational history, etc.
What is it for? Reverse image search to find the origin of an online image.
TinEye is an incredibly simple but useful online tool that allows you to conduct a reverse image search. All you need to do is upload an image to TinEye, and the tool will tell you where it appears on the Internet. So if, for example, you have an image associated with a Facebook profile, you can use TinEye to see where else that picture is used online—perhaps on another social media platform like Strava, YouTube, or TikTok. Have a look at the tutorial below to see how TinEye can help you find the origin of an image posted to social media.
What is it for? Twitter analytics aimed at understanding an account and identifying connections.
TweetBeaver is a simple but surprisingly powerful tool that allows you to quickly gather a lot of information from any public Twitter account. With TweetBeaver you perform tasks such as bulk-lookup of account data, download a user’s favorites, check if two accounts follow each other, find common followers of two accounts, and download a user’s friends list.
Looking for more tips and advice related to online evidence collection? Have a look at our Essential Online Investigation Guide for Websites, Social Media, and Team Collaboration Tools.
Let us know your thoughts in the comment section below.