Background and basics - Introduction to Social Media Investigation: A Hands-on Approach, 1st Edition (2015)

Introduction to Social Media Investigation: A Hands-on Approach, 1st Edition (2015)

Chapter 2. Background and basics


This chapter introduces the major types of social media Web sites and services, to have a vocabulary of common features, and to understand the origins and landscape of the area.


Social media

Social networks



Before jumping in to all the details of social media, it's useful to know the types of websites and services, to have a vocabulary of common features, and to understand the origins and landscape of the area. This chapter introduces those basics that will be used throughout the rest of the book.

Investigating on Social Media

This book is intended to show investigators how to find information on social media. It covers the basics of social media, but not the very basics of investigative techniques. With that said, there are some tips on running social media investigations that are worth discussing up front. Many people will recognize these as standard investigation techniques but may not have thought about how to translate that into an online environment.

Investigator Dusty Lefdal describes a technique that was commonly used among many people I spoke with. “Often times, we locate a target, not by trying to find the target themselves, but by finding their associates. This will then lead us to the target.”

Attorney Lisa Helfend Meyer agrees. In her family law practice, they often look at the social media accounts of clients' (and opposing parties') children to see what they are posting. While parents may try to keep a low social media profile, the kids often don't worry about this and may not even be aware that their posts can be used. The same is true of friends of the targets of investigation.

People also tend to be reliably uncreative in their profiles. They use the same email addresses, same usernames, and same profile photos over and over. In future chapters, we will look at techniques that you can use to take information you learn on one site and find information about a person on many other sites, including ones you have never heard of.

A Brief History of Social Media

The history of social media is a topic that deserves its own book, but understanding the major motivations and points of development in the timeline will help in understanding the current landscape and uses of these technologies.

Genesis of the Internet

The internet has been a social place since its invention. Work began on the internet in the 1960s, and the modern internet was in place by the early 1980s. In 1980, Usenet was created. This was an online discussion system where people could find discussion boards on a topic they were interested in and then read messages from others and post replies.

New methods of finding community and social connection arose as the internet evolved to include services like CompuServe and America Online. But the biggest shift came with the invention of the World Wide Web, which went online in 1991.

The Early World Wide Web

The web was originally a place where a person needed a number of technical skills to post content. Creating a web page required knowledge of the language for writing web pages (HTML), space on a server to store the web pages, and the ability to upload the coded version. As such, the web's first decade was a time when people mostly browsed content created by others. The (relatively) small number of content creators consisted mostly of technically skilled individuals or organizations with teams that could put pages online.

Growing Popularity

The late 1990s saw the development and release of several tools designed to make creating web content easier. One of the most important of these in terms of the rise of social media was the blog. Blogs (short for web logs) are a type of online diary. While it was technically possible for anyone to have created a frequently updated journal on the web since its invention, blog software made this much easier. Instead of writing code, people could author “posts” (like diary entries) using a graphical interface similar to a word processor's. The blog software would convert the post into code for the web, handle the organization of the site, sort posts by date, and format them.

Blogs helped millions of people to create online presences. As blogging software improved, it became possible for people to comment on the blog entries of others. In time, this created de facto communities around people's posts.

Social Networks Appear

In the early 2000s, as blog numbers continued growing dramatically, a new kind of site started to appear. These sites were focused less on creating online diaries and more on creating online profiles. At the time, the ability to create a page about yourself, your skills, and your interests was difficult. Blogs had empowered the masses to create sites in a specific category, but creating web content belonging to another category still required all the technical skills mentioned above. This new breed of site allowed people to create personal pages by simply completing a form. But it went one step further: people could also find any friends who were also members of the same system and connect to them.

There were a handful these new social networking sites in the earliest generation, but the most popular was Friendster. Figure 2.1 shows an image of Friendster, as it appeared in the early 2000s. Basic profile information appears on the right, and toward the bottom left is a list of friends.


FIGURE 2.1 An example of how the social networking website Friendster appeared in 2003.

This general structure—a static profile with a list of friends—was the standard among social networking sites for many years. Figure 2.2 shows a 2005 Myspace profile page, with very similar organization.


FIGURE 2.2 A Myspace profile page from 2005. Information about the user, Tom, appears near the top left, while friends are shown at the bottom right.

These types of sites began to gain popularity in the early to mid-2000s. By 2005, there were already hundreds of social networking websites, and many had over 1 million members—quite a large number for the time.

Web 2.0 and the Rise of Social Networks

Part of the reason social networks were so popular is because they made it easy for people to put information online. As social network sites continued to gain popularity, this technology started appearing elsewhere on the web. Photo-sharing websites (like Photobucket and Flickr) began in 2003-2004. Soon after followed video sharing, exemplified by YouTube's launch in 2005.

Sites that let people organize other types of content (like bookmarks to sites they liked) also appeared. Appearing in 2003, let people share links, add labels to make finding them easier, and browse the shared links of others. Digg, appearing in 2004, also let people share links but introduced the ability for others to “vote” links “up” or “down.” This feature helped people find new, popular content as a result of voting.

Countless websites started integrating tools to allow users to comment on shared content, vote them up or down, and post reviews. By 2005, there was a dramatic shift well under way in how people used the web. No longer were they simply browsing others' content. Instead, they were actively creating profiles, interacting, making connections, and generating their own content.

This behavioral shift—often described as a transition from consumer to producer—came to be recognized by the nickname “Web 2.0.” Despite criticism centered around the fact that the use of “2.0” implied that the web itself had supposedly undergone a software upgrade, the name stuck. Regardless, the fact remains that this was recognized as a paradigm shift in people's behavior on the web.

Noticing the change, social networks added what is now a fundamental part of many people's online experience: the status update.

At first inspection, it might seem that status updates were hardly something new; after all, blogs had allowed people to publish their lives' current events for years. But status updates were real time, (usually) brief, and almost always about what people were doing, thinking, reading, and watching.

In 2006, Facebook introduced the News Feed. This collected all the status updates of someone's friends and displayed them on one page in chronological order. Visiting several friends' blogs for news seemed incredibly tedious by comparison. Figure 2.3 shows the early version of the News Feed on Facebook.


FIGURE 2.3 The early version of Facebook's News Feed, showing all of a person's friends' updates.

Since then, posting updates has been a central feature of many new social media websites. The self-described “microblogging” site Twitter was introduced in 2007. It limited the length of status updates to a maximum of 140 characters.

The membership of these sites has continued to grow as well. Facebook now has over 1.2 billion active users—nearly half of the world's internet-using population. Twitter has 300 million active users but possibly as many as 850 million registered users. Social features are now the norm on websites and offer the ability to review items, to share links through social media sites, and to log in using social media accounts.

Types of Content

People can post basically anything on social media, but there are a few terms that are used across sites that are important to know:

Updates/posts—An update is a general term for something a user posts. It tends to be a stand-alone piece of content, as opposed to a message in a discussion or a review. Often, these are short bits of text that say something a person has done, links to interesting content (sometimes with a comment), or photos or videos. They may also be called “status updates” or “posts,” or they will have names specific to the platform. For example, updates on Twitter are called “tweets.” We will cover these terms as the relevant websites are discussed in greater detail.

Comment/reply—A common type of social interaction online is to comment on or reply to an update that someone else has posted. These are often grouped along with the original update so others can view the updates and comments together.

Photos and videos—Sharing this kind of media is common online. Photos and videos are often shared as part of updates, but they can be uploaded separately. For example, many social network sites have sections where users can create albums and upload many photos at once.

Social networks/friends/contacts—Social interaction is the heart of social media, and this often occurs because people have the ability to create connections with people they know. These may be friends, business associates, family members, or a mix. The connections between people form a social network.

Metadata—The updates, comments, photos, and social connections people have form the data of social media websites. The information about those posts, photos, and connections is metadata. This often includes the date and time of the update and may include the location from which the person was posting or the platform (e.g., standard web browser vs. a mobile phone app) used to post.

Categories of Social Media

There are many types of social media: social networks, forums, photo sharing, review sites, and more.

A first distinction to make is between social media websites or sites and social media services. Essentially all social media can be accessed over the web with a traditional browser. For some, this is the only way to access them. However, some companies offer other services. For example, Facebook and Google allow people who have accounts with them to use those accounts to log in to other websites. Figure 2.1 shows the log-in screen on a website called that allows people to log in with Facebook, Twitter, or VK (a European social network). When a company provides other services, like allowing people to use their accounts across the web, they are sometimes referred to as a social media service.

Generally, people use these terms interchangeably. In this book, we will generally use the term “social media site” since we are concerned primarily with the information that can be gathered by looking at the websites in a normal web browser. If we look at other services that these companies offer, we will use the broader term “social media service.”

There are also many types of social media services based on the features they offer. The distinctions we draw here are a bit artificial in the sense that there is really a continuum of features across sites. Deciding what category a site fits into is not always easy. Given that, knowing the different general categories and which sites are good examples of each can be useful when you are trying to understand what information you may be able to collect about a person on a specific site:

Social networks—In general, the term social network refers to people and their connections. This applies off-line and online. Online social networks allow users to create accounts and form connections with one another. Most social media sites have this feature, but for some, the ability to make connections and share with friends is the core feature.
A social networking website will have a strong emphasis on connecting with other people (friending them or forming a social connection). Most modern social network sites also allow people to post status updates, photos, and other contents. The goal behind this is usually to help people engage with their friends by sharing updates about their lives and links to things online they find interesting.
Popular sites in this category include Facebook and LinkedIn.

Photo and video sharing—Sharing photos and videos is a common part of social media. The ability to share these types of media is built into most social media sites, but some sites are dedicated to this task. When you visit a photo or video-sharing website, the images and videos are featured, and there tends to be a limited amount of text.
YouTube is an extremely popular video-sharing website. Newer sites like Instagram, Vine, and others are also drawing populations of users.

Microblogging—Blogs were created in the late 1990s as a way for people to easily post text online without a lot of technical knowledge. These resembled online diaries, and blogging is still extremely popular. Microblogging came about in the late 2000s. The key feature of microblogs is that people are limited in how much text they can share. On Twitter, the most popular microblogging website, people's updates are limited to 140 characters. Other sites have different limits, but the core idea is that people are posting very short updates.
In addition to Twitter, Tumblr is a popular microblogging site.

Social bookmarking—These sites are set up so people can collect links to pages they like online and share them with their friends. They can usually add annotations or captions to the links and organize them into categories.
Currently, Pinterest is one of the most popular social bookmarking sites.

Social gaming—Video games used to be played alone or by people who were in the same place. With the internet, games can be played by friends in different locations. Social gaming has become very popular, and the games range from very simple competitions to intensive military-style team game playing. Major game consoles, like PlayStation and Xbox, have social features that let players create friend lists and play games online with those friends. There are also many websites and apps for mobile devices that let people play together.

Apps—The term “app” is short for “application.” These are (often) small programs that run alone or within other social media sites. They can have their own social experiences. For example, apps that run in Facebook allow users to connect with some of their Facebook friends within the game, but it may support its own types of posts and interactions.

Current Social Media Landscape

Because the landscape of social media changes so quickly, in one sense, parts of this book are outdated before they are written. However, the core lessons about what information is available and how to find it are accurate for much longer. We also focus on major sites, which are likely to be around for years because they have large, active user bases. The structure and features of these sites may go through changes, and the companion website for this book will offer updates to highlight these tweaks as well as new content.

At the time of writing in spring 2014, the ten most popular social media sites (by number of users) are as follows:

1. Facebook—they report having 1.2 billion active users. It is primarily a social networking website but has many features, from gaming to chat to email, which make it the main destination for many people online.

2. Twitter—a microblogging website with around 300 million users. People create social connections by following people whose content they are interested in. Posts are called “tweets.”

3. YouTube—the most popular video-sharing website. YouTube is owned by Google, which in turn has a single sign-in for all of their services. Also, people can use YouTube to watch videos even if they don't have an account; thus, an estimate of users does not make as much sense here.

4. LinkedIn—A business-oriented network frequently used in the job market with 250 million users.

5. Pinterest—a social bookmarking site centered around sharing images from the web, with 150 million users.

6. Google +—Google's social networking site designed to be a competitor of Facebook. As with YouTube, Google users have a single sign-in for all Google products (including Gmail, YouTube, and Google +). However, Google + user totals around 120 million.

7. Tumblr—a microblogging website that allows sharing text, photos, and other media with no strict limit on the length of content (unlike Twitter). Tumblr has around 110 million users.

8. Instagram—A photo-sharing website especially popular among teens and young adult audiences. It is not owned by Facebook and is not integrated into the Facebook platform. Instagram has around 85 million users.

9. VK—This is the only website that isn't extremely popular in the United States. It is a social networking site similar to Facebook but oriented toward European users. It has roughly 80 million members.

10. Flickr—The oldest site on this list, Flickr was one of the early, popular social media tools. It is a photo-sharing site with 65 million users.

Some Vocabulary

To make the descriptions of these investigations easier, we will use some specific vocabulary throughout this book.

Since our focus is on finding information about individuals, we will refer to the individual under investigation as a target.

There are also a number of technical terms that we will use throughout the discussion. These are all addressed in the glossary, but some will benefit from further explanation here. First, we will look at the basics of the internet and the web. The internet is a system of computers networked together, which allows communication around the world. Every computer on the internet has to be uniquely identified so information can be sent directly to it. This unique identifier is called an internet protocol (IP) address, and it comprises four numbers between 0 and 255 separated by dot, for example, IP addresses can almost always be tracked to a general location and, with assistance from internet service providers, can even be tracked to a specific address. While not all social media sites display IP addresses, some do. Others have access to the IP address of users, which can sometimes be obtained by request or subpoena.

A user's computer connects to the internet through an internet service provider, like a cable company. When a person requests a web page, their computer sends a request through the internet to a server. A server is a computer that has web pages and code stored on it, and it sends these to a user's computer in response to a request. For example, if a user goes to, their computer sends a request to Twitter's server, which processes the request, generates the appropriate page, and then sends it back to the user's computer (identified by its IP address).

When a user signs up for a social media site, they usually create a name to log in with. This is called a username or screen name. Usernames are usually one word, similar to the part of an email address that comes before the “@” sign. They then create a profile, which is a collection of personal information, often generated by filling out questionnaires and forms or writing short biographical paragraphs.

Our Own Target

It will be useful to practice the techniques we cover in this book on your own. To do that, it helps to have a target with lots of information online that you can investigate without worrying about privacy. To that end, we have created a fake personality who is very active on social media.

Our example user is Malcom Conroy-Smith. He uses the same profile picture on all of his accounts (see Figure 2.4). His common username is “malcomcsmith” though, like many people, he has a few variations on this name depending on the site.


FIGURE 2.4 The profile picture of our example target, Malcom Conroy-Smith.

Malcom is obviously not a real person, and all the information you will find on his social media profiles has been made up and posted by this book's author. However, it is also designed to let you find patterns in his behavior, much like you could find on a real target.

You are encouraged to investigate Malcom deeply. Look at his information on all his accounts. Search for him on Google. Read things he has posted online. It will be good practice for finding actual targets without worrying about invading anyone's privacy.

Privacy: Yours and Others'

Privacy is important on social media, both for people who have profiles there and for people who are searching.

Most sites provide users with privacy options that allow them to make all their information public or to restrict access. Most sites allow information to be restricted so that only friends can view it. Some allow much more complex and fine-grained privacy settings. Posts can be limited to specific groups of friends or even individual people.

You also have privacy protections when you visit people's profiles. Some sites let anyone browse users' profiles, photos, or other posts, even if the browser does not have an account. Other sites will require you to register before you can see users' information. Either way, most sites do not show any information to a user about who views their profile. Some sites are exceptions, though. Dating websites and some professionally oriented websites reveal the identity of each person who has viewed a user's profile. These exceptions are noted throughout the book, since, as an investigator, it is important to know when your searches are private.


Social media is a rapidly evolving space that now touches most of the web as we know it. As interaction moves from something we do primarily on desktops to mobile devices, these sites and services have evolved to operate in a number of different ways and on various platforms.

Though the sites have different features that encourage users to share and allow them to interact in various ways, this chapter has introduced a basic taxonomy of purposes that can be used to categorize most sites. We have also covered basic social media vocabulary that will be useful in understanding all the sites we will discuss in the rest of the book.