Get Social Media Evidence with a Click

A recent episode of the podcast Digital Detectives, featured Nathan Russell, a Canadian lawyer with a focus on legal technology. Part of the podcast concerned the collection of social media evidence. Russell recommended a tool called Web Preserver, available at http://www.webpreserver.com/ . Web Preserver can be installed for free, but you will need to set-up an account which is only free for the first 15 days. It will show up as a small blue square icon on your Chrome browser's toolbar.

The app includes the options to save web pages as PDFs or JPEGs with associated EDRM XML files or Concordance .opt / .dat files. There is a bulk capture feature allowing users to enter long lists of URLs.

You can use Web Preserver to track when data from web pages is collected. The online account records the time at which data is collected, and also generates a SHA256 digital signature to uniquely identify the exact social media posting.

Compare and Visualize Files

This night's tip comes from the site of Jesse Kornblum, as it did back on December 28, 2015. He has custom programs which allow you to compare the size of different files and also generate bitmaps. Download the filecompare and colorize programs on this web page, http://jessekornblum.livejournal.com/290358.html .

The programs work by comparing files with differences that were made 'in place', not for a different version of a file in which changes have been made with insertions or deletions.

Once you have downloaded the two executables to a folder, you just need to press SHIFT + CTRL in that folder, right click and select 'Open command window here'.

Just enter a commands such as

filecompare lorem.txt lorem-edit.txt > edit2.dat

colorize edit2.dat

. . . as shown in Fig. 1.

. . . a bitmap file will be generated like the one shown here in Fig. 2.

. . . .showing differences in the two examined files.

Soundex

Soundex is a phonetic algorithm widely used to associate different names that are pronounced similarly. The Soundex encoding method was developed almost a century ago and is a standard feature of many current database and electronic discovery related programs, such as the one profiled in last night's tip, Windows Grep.

The Soundex encoding method reduces any name to a three digit code preceded by a letter.

1. The first letter of the name is retained.

2. All references to h, w, a, e, i, o, u and y are dropped unless they are the first letter.

3.

b, f, p, v become 1.

c, g, j, k, q, s, x, z become 2.

d, t become 3.

l becomes 4.

m, n become 5.

r becomes 6.

4. If there are two or more letters with the same number in a name (or if two such letters are separated by an h or w), only the first is retained, even if one of the letters is the first one in the name.

5. All Soundex codes must contain a letter and three digits. If there are not enough letters in a name for there to be three digits, add zeroes. Only review letters from the start of any name until you get a letter and three digits.

So using this method the name, William becomes:

W450

Smith becomes:

S530

Brown or Braun become:

B650

Soundex is frequently employed by sites devoted to researching familiy genealogies. This site, https://www.ics.uci.edu/~dan/genealogy/Miller/javascrp/soundex.htm will generate Soundex codes for any name you enter.

Soundex is particulary useful when searching for a name in a database that may have different spellings that are hard to predict. So while you know you're looking for someone named Ismail, you may not have any idea how others will spell his name. Choose the Soundex option in Windows Grep . . .

. . . and it will automatically pull up all words with the same Soundex encoding as Ismail - I254