Wylie, Texas
lee@forensic4cast.com

Facebook Video

I know we’ve only done two episodes so a phrase such as “a break for the norm” doesn’t seem to apply.

Simon has been quite busy this week so we’ve not had time to do a full podcast yet, but we’ll do one before the week is out and have it up here by the start of next week. This is why I need more volunteers for being on the show, the more the merrier.

I’m on training next week so please bare with us, things will return to ‘normal’ soon.

Also, thanks to Ovie and Bret at Cyberspeak for ‘not’ plugging us.

This video is best viewed as part of the podcast in iTunes – remember to set the ‘View’ to ‘Actual Size’.

Tags: , , , , ,

7 Responses

  1. Elliott says:

    Facebook Chat seems to work perfectly fine in Safari 3.1.1.

  2. lee says:

    Thanks, I thought it did but I didn’t want to say without confirmation.

  3. Ken Pryor says:

    Very interesting video, Lee. I haven’t had any exposure to Facebook so far, so you provided a fine learning experience for me.
    Keep up the great work!
    KP

  4. Nick Bria says:

    Hi Lee,
    Good video and some real interesting info. I have a small amendment to add the time stamp 1212518824279 is a 13 digit time stamp and goes to nano seconds and translate to Tuesday 3rd June 2008 19:47:04.279 meaning the time is very precise.

  5. Tom Clough says:

    Hi Lee,

    Greate video, I am doing a final year project at university on this subject. I have been running a few tests on the chat application and I am finding that it is not caching the pages every time, such as “profile [1]” and so on. Did you encounter this aswell?

    Tom

  6. Art says:

    Hi Lee,

    Just saw your video on Facebook forensics good stuff. There’s a very useful tool from Hot Pepper Technology that will allow you to parse these logs and gives you a report that viewable by the examiner. Takes care of all the dirty work for you.

    see:

    http://www.hotpepperinc.com/chatlog.html

    Art

  7. Brian Jones says:

    The date time stamp(s) are UNIX millisecond time stamp. It is accurate to milliseconds. It can be decoded using DCodes “Unix:Millisecond Value” = Tue, 03 June 2008 18:47:04.279 UTC, with 279 being milliseconds.

Leave a Reply to Brian Jones Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.