Viewing social media data

After you have imported your social media files you can use the ESPA analysis center to determine a person's social media activity, such as what groups and people they are following, which posts they are liking, who the person is contacting, and the information they are sharing. Social media files are viewed on the ESPA analysis center's Communication data view.

  1. If you have not already done so you must first upload the social media files to your case.

    How to upload your social media files

    1. On the Manage case screen, click Upload more files.

      The Manage files screen opens.

    2. In Data type, select Automatic detection.

      Alternatively, you can select Social media files then select the Person name.

    3. Click Select. Windows Explorer opens. Navigate to the folder and select the required files. The file uploads and a green circle alongside the file name indicates when the upload is complete.

    4. Click Save.

  2. Click to open the ESPA analysis center.

  3. On the Input and settings view click Refresh.

  4. Click the Communication data view.

  5. You can then configure the view in a way that suits you. If you want to view specific types of content then use the Type column. For example:

    • If you want to view the messages and pictures shared in communications:

      1. Use the Type column to filter the communications to only display Unified messages.

      2. Group the view using the Comm # column. This groups all the individual parts of the communication into one drop-down making it easier for you to find and review communications.

      3. You can then review the communications using the Content, Content media and Content message columns as shown in the following graphic.

      4. You can view media the Instagram user posted to their profile story that have since been archived. To view the archived stories you can filter the Communication data view's Type column to only display Archived stories and filter the Content media column to True to only display those which contain media messages.

      5. For more complex communications, for example group communications, click on the communication identifier in the Comm # column to open a Summary of communication view.

        The Summary tab provides an overview of the communication such as the start and end date/time and the number of events. It also lists all the associates involved in the communication.

        The Events tab displays all the individual events that are part of the communication, such as the text, images and videos that were sent.

    • If you want to examine IP addresses then you can set the Type column to filter on IP addresses, then click View to display the IP address.

    • If Facebook includes the Prospective Login IPs in their legal response then you may also want to view the sender's IP address and port. To do this you can set the Type column to filter on Prospective Login, then click View to display the sender's IP address and port.

    For further information, refer to the Communication data view.

  6. Click the IPs view to view all the resolved IP locations from an IP2 location lookup service.