Forensic artifacts modeling for social media client applications to enhance investigatory learning mechanisms

Social media have emerged as an inexpensive and efficient way of communication during the past few years. Facebook is leading the global social networking that provides multiple channels for sharing information with the community. There are various ways to access a Facebook account such as through a web browser, mobile applications and third-party desktop applications for Facebook. Platforms like desktop applications for social media are of benefit to users as they provide ease of access and availability, but in the case of a user's data privacy breach including illegitimate social behavior, it becomes a challenge for the forensic examiners to track such activities for learning purposes. The aim of digital forensics is to get hold of the existing legal evidence present within the digital media. The major focus of this research is to investigate and analyze the two Facebook desktop applications: Fosimo and Sobees, with respect to the tracking of the user activities. The Facebook desktop applications are examined by analyzing the Windows registry, browser, cookie, cache, connection analysis and the local installation directory. As a result of this research, we ensure that the footprint gathering of the user activity from Windows registry and browser files is performed in such a way that it could be used for forensic artifacts modeling keeping the integrity of the whole process.