Category: Uncategorized

Where Was this Social Media Photo Taken?

We get this question a lot. Can you tell me where this social media photo was taken? The short answer is probably not. Here’s why~

An easy way to explain this is to think of the chain of custody of a photo. How was the photo taken originally? Chances are, it was taken using a person’s smartphone. It could, in some cases, have been taken using a digital camera.

Digital cameras can store a lot of relevant information about a photo. It can reveal where it was taken, how it was taken & when it was taken. Digital Forensic Investigators and Examiners know exactly how to extract this data from a photo & use it to fight child exploitation and sexual abuse.

However, what many people don’t know, is that the data behind the photo can be manipulated and changed.

Geotagging a Post or Photo

It was once very popular to post a photo in social media and tag the photo by letting everyone know where you are. Remember Four Square? Many people still do this. You may see a friend who posts a photo on a beach and they tag who they are with and where they are. Those are the easy ones!

However, many people have learned the hard way not to do this. Not only does a geotag let criminals know where you are, they also let them know you aren’t home. Most people are very well aware of their privacy settings on their mobile phone and in social media.

Therefore, it is near impossible to determine where a social media photo was taken, if the geotag is set to private or is off altogether.

So what is the data behind the image? It is called EXIF data.

EXIF Data

What is EXIF data? EXIF stands for Exchangeable Image File Format. It is basically the metadata attached to every digital photo you take. It will include information such as the camera model and settings you used, the date and time you took the picture, and even details about exactly where you took the picture. Photographers can use this data to help organize their photos, perform searches, or re-create the exact manner in which a picture was taken.

** But – please note: Facebook and other social media platforms do not publicly share EXIF Data. They strip it when it is uploaded.

The FBI warns against sending photos through the internet or sharing on some social sites.

How to Get Around EXIF Data

According to the FBI’s site, here are some of their suggestions. So, keep in mind that many people do know how to do this and are doing it.

  • Turn off your phone or camera’s geo-location feature before ever taking the picture. Note: devices in airplane mode can still capture geo-location information.
  • Remove EXIF data before sharing images with people or posting them online, especially when images are captured in private homes or businesses. There are free apps that you can use to do this.
  • Use an EXIF viewer to verify that you were successful in stripping the personal data from the photos before sharing.
  • Before uploading images, use available privacy settings to limit the audience to only your close friends and family.
  • Minimize the use of apps that automatically upload and share captured images.
  • Even without EXIF data, the image may contain identifying information, such as associated persons or location histories. Screen content with the assumption that anyone can see, copy, or forward photos that you post online.

Image Tip

To find an image’s exif data, right-click the photo and select either “properties” or “information”. If the GPS coordinates appear, simply type them into Google Maps to find the location.

While this is a long shot, it is worth the effort should you find a photo online that was not shared in social media and appears to be recent.

In a recent blog post, we suggested trying Photo Investigator: The Photo Investigator is an iOS app to view all image metadata (all the possible data stored ABOUT and within each photo). You can also remove photo metadata with an in-app purchase.  The Investigator can also open the image’s GPS location in the maps app for directions; view images at full size and zoom them larger than in the Photos App.

Three Facebook Group Search Tips

Back in 2018, Mark Zuckerberg was focused on getting more people to engage on their platform. Facebook Groups became a very important tool to use to do just that. Facebook rolled out an algorithm known as “Facebook Zero,” and simply put, this is the reason why you most likely see Group content dominating your newsfeeds. (Hootsuite)

Many people who are involved in Facebook Groups are highly engaged. Once a person joins a group, there seems to be a false sense of anonymity in a way. Meaning, that no one outside of this group can see my posts. If the group is public, that is simply not the case.

It is important to remember this when you are conducting research on your person of interest.

We covered this in a previous blog. The “Must Have” to the “Nice to Have” in Social Research for OSINT featured a case study. From all appearances the POI seemed to be pretty clean cut. Someone who you would never suspect would use drugs. However, once we located a group she was active in, it revealed a different side to her.

When conducting scans, we have found some seemingly “hidden” posts in groups that were very helpful to our client’s case.

Hidden VS. Private Groups

According to Hootsuite:

Private and visible Facebook groups can be found through search, and it requires approved membership in order to see anything beyond a group description, members, and group history.

Private groups that are hidden can only be found by current members and those who have been invited to the group already (even if they aren’t members yet). Only members are able to view the group content beyond that waiting-room-styled display above.

Most business groups are most effective when set to private and visible. People can find you and you have full control of who gets to see and view group content, giving you the best of both worlds for a balance of quantity and quality while still being findable.

Hidden groups are most effective for internal team use or if you want to set up a highly-exclusive group that’s invite-only and don’t want the backlash of angry people who aren’t accepted.

Tips to Search Facebook Groups

  • Need a quick and easy way to search for groups? Start with Facebook’s Browse Groups page which is designed to help you locate a group that fits your interests.
  • Once in the Browse Group area, you can filter the search down a bit (see below).
  • If you have an idea that your POI is active in a particular group that is public, you can easily use the magnifying icon right on the page to search the group for names, keywords, dates, etc..

People who post in groups, seem to be more vocal, more honest and sometimes reveal much more than they are even aware of. It may be because they view it as being more “private” and not publicly available on their own profile page or timeline.

3 Ways to Find Someone’s Email Address

When conducting online research, a person’s email address can be vital. When you consider that most social media platforms and online forums require an email address to sign up, you could be missing important information by not knowing it.

When conducting a basic background search there are times you don’t even pull up one email address on a subject. There are ways to find someone’s email address online.

Tools to Try

Where does the subject work? Knowing the name of the company (as long as they have a website?, can be step one. Next, use an email look up tool.

  1. Hunter..io: They have a free search tool on their website. In the example below, I used it to find email addresses for our website, www.e-chatter.net. Two email addresses were found. The great part of this is that even though they don’t provide the entire email address, you can see the format in which the company uses for their employees. If you were searching for me, you would know that my name is Kathy Doering. Easy to figure out that we use first name initial and last name as our format.
Email addresses

2. Rocket Reach: Search by name + Company, or Linkedin URL. You can also search by locations, title, industry, revenue, SIC, and + 15 other attributes & filters. You will have to sign up for a free account with this site however.

When searching for Kathy Doering, Rocket Reach found 3 correct email addresses. They also found several low ranking results that were not connected to me. They did have false positives like any other search tool.

Email address look up

3. Search using Duck Duck Go: Using an alternative search engine like DuckDuckGo, is a little known trick. Use “@domainname.com” in the search bar. Also try “@domainname.com” contact. This is not something that will work in Google or Bing. You can include the name of your prospect in the search if you’re looking to contact someone in particular, or just keep it generic.

In case you already have an email address and want to check to see if it is legitimate, refer to our blog post from May 2020, “Who is Tied to This Email Address?”

The “Must Have” to the “Nice to Have” in Social Research for OSINT

In the world of online research, social research, OSINT, etc., information falls into two main social research categories. In one group you have the “Must Have” and the other is the “Nice to Have”. Let me explain.

Let’s take a look at this from the viewpoint of information collected on a person of interest.

Must Have: Facebook

Facebook intelligence is still in the “Must Have” category. In part this is due to the fact that there is still so much to discover there, if you know how and where to dig. That is the challenge!

  1. Groups: Sometimes people will showcase their groups and sometimes this information is kept private. If it is kept private, there are search techniques that can be used, but it is not easy. Sometimes this information is readily available on a person’s profile page. When it is, and the group is public, I would suggest taking some time to do a manual search.
Facebook Groups

What Can You Find?

When people post in Groups, I really think that most have a mindset that it is undiscoverable information. Meaning, it is safe within the constraints of the group. That may give a false sense of freedom to speak their mind or to post something that they wouldn’t want the majority of their friends to know. When viewing a person’s page, public posts may give an impression of being squeaky clean but posts in a group setting can reveal the opposite.

Recently, we conducted a scan on a person who from their two facebook profiles, looked to be pretty clean cut. After digging further, we came up with a series of posts that showed a very different side to the individual.

Facebook Post
Post of a person of interest in a Group

In case you are unfamiliar with the term, “wake and bake” it can be described as getting up in the morning and partaking of the drug of choice, without leaving the comforts of one’s bed. (urban dictionary).

Enough to toss that squeaky clean image right out the door!

Twitter:

If you are having trouble finding information online, one suggestion is to turn to Twitter. Is the person currently employed? By whom? What about past jobs? It may be worth it to scan the company’s Twitter pages because many mid to large size companies will post events, fundraisers, blogs, videos, etc. which have employees present.

We recently found several photos of an individual from their company’s Twitter page.

Nice to Have

There is quite a lot of information that can be filed under the “Nice to Have” social research category. When conducting a deep web scan for example, we may find out that the person had some past problems with the law. From simple traffic violations to bankruptcies and everything in the middle. This may date back 10 or more years.

While it may not be important to the case, it is something that is part of the person’s past. Voter registration, financial contributions to a particular political party, volunteer work, newspaper articles, digital records of all kinds, and so on. All of this additional information can help to give you a good picture of the character of the person.

UCC filing
Person had a possible DEA Controlled Substance License that expired in 2015

A piece of information like the one above can be useful in many ways. Perhaps you know the person to be a Veterinarian or he was one in the past. This piece of information can serve as another data point that confirms his profession. It may list an address or name of a business that you didn’t have before.

It can help you to eliminate false positives in your research as well. Without the help or assistance of multiple software platforms, you can easily get two people confused who share the same name.