Transcription
(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 12, No. 11, 2021A Systematic Review of Published Articles, Phasesand Activities in an Online Social Networks ForensicInvestigation DomainAliyu Musa Bade1Department of Computer Science, Yobe State UniversityDamaturu, NigeriaAbstract—The purpose of this paper is to retrieve, evaluateand analyse the available published articles in five (5) relevantonline databases from 2011 to 2021 and also critically identify thephases and activities involved in an Online Social NetworksForensic Investigation based on bibliometric analysis and Degreeof confidence respectively in order to know the evolution in theresearch domain. A systematic literature review (SLR) techniquewas adopted by the author to search using pre-defined keywords.Only scholarly articles published between 2011 and 2021 writtenin English were included in the search. The total of 316subscribed documents were collected from the five (5) onlinedatabases based on the search criteria although twenty-nine (29)are duplicates. ScienceDirect has the highest number with 189documents and the year 2020 with the highest published articles.Six (6) phases and forty-three (43) activities were identified.According to a review of the recovered publications, no previousresearch has been done to statistically retrieve, evaluate andanalyse the level of work that has been done in the domain ofOSNFI, as well as the phases and activities involved in theforensic investigation of an online social networks crime.Keywords—Forensic; investigation; model; online socialnetworks; bibliometric analysis; degree of confidenceI.INTRODUCTIONDigital forensics has been studied for a decade, but it stillappears to be a very young science, with many issuesremaining unclear and ambiguous [1]. It is the science ofcollecting, preserving, examining, analysing, and presentingrelevant digital evidence for use in legal proceedings [2]. Theentire field of digital forensics investigation is still lacking infundamental agreements which may be as a result that the fieldis relatively young [3]. It is a procedure, and not just oneprocess, but a set of tasks and procedures that occur during thecourse of an investigation [2]. There is a lack of consistentdefinitions and language when it comes to the core parts ofdigital evidence investigation [4].Millions of people use online social networks on a dailybasis [5], which has facilitated new ways of connecting andsharing knowledge [6]. It has also resulted in a rise in excessivecriminal activities [7], with criminals becoming more advancedin attempts to exploit technology to avoid detection andconduct crimes [6]; such as malware distribution, fraud,harassment, cyberbullying and cyberstalking. They also useonline information to commit traditional crimes such as theft,Siti Hajar Othman2School of Computing, Universiti Teknologi MalaysiaJohor Bahru, Malaysiakidnapping, and murder. Furthermore, they use the informationas tools to assess and gain access to their victims [8].Forensics is used on social media platforms like Facebook,MySpace, Twitter, and LinkedIn. It is well known as socialmedia forensics, and it's a subset of digital forensics andnetwork forensics [9]. Online social networks are Web-basedservices which enable individuals to create a public or semipublic profile within a confined system [6], articulate a list ofother users with whom they share a link, and display andtraverse their list of connections as well as those created byothers within the system [10]. Different SNSs, like Facebook,Twitter, and LinkedIn, are used to connect people and enablethem to communicate with one another [5]. People buildpersonal profiles from various social networking sites to sharetheir thoughts, photographs, images, emails, and instantmessaging [11], as well as to find old friends or people withcommon interests or problems through various socialnetworking sites [12].Rapid technological development can cause issues for usersof the technology. The more advanced people's lives become,the more advanced crime becomes [13]. Social mediaplatforms are becoming increasingly popular, with Facebookmanaging above thirty-one (31) million users in UnitedKingdom, Twitter managing fifteen (15) million, and LinkedInhaving 10 million. With the proliferation of mobile phones, theuse of social network services (SNS) has skyrocketed, this SNSstores a variety of data, including user conversations, userlocation information, personal networks, and user psychologywhich can be valuable evidence in a digital forensicsinvestigation of an incident [14]. Other uses of socialnetworking sites include, general chatting, broadcastingbreaking news, setting up a date, tracking election results,planning disaster response, humour, and serious analysis [11].There are five (5) sections in this thesis. The following is asynopsis of the contents of each section: Section 1 –Introduction: this section provides a summary of the researchstudy as well as explanations for the findings that led to thecontributions of this review. The review objective is brieflystated in Section 2, and the methodology of the systematicliterature review (SLR) used throughout the review process isdiscussed in Section 3. Section 4 includes a discussion basedon the data gleaned from the review process. Finally, Section 5brings this review to a conclusion.153 P a g ewww.ijacsa.thesai.org
(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 12, No. 11, 2021II. OBJECTIVE OF THE REVIEWThe review looks into information from significantpublished sources on the available publications in the domainof an online social network forensic investigation, as well asthe phases and other activities involved in the investigationprocess. According to the literature review, there are no SLRtype publications on the topic of online social network forensicinvestigation. As a result, the goal of this review is to find outthe amount of work that has been carried out and published inthe domain of an Online Social Network ForensicInvestigation. In addition, to identify the numerous phases andactivities that can be employed in the investigation of an onlinesocial network forensic crime. These objectives are importantbecause variety of DFIMs exist, but majority of which takerelated methods [15]; [16]. They fail to address thefundamental differences and unique needs of online socialnetworks [17]. However, because there is no universal way[10]; [18] in many cases, investigators conduct automatedforensic investigations mostly using different methods [19].III. METHODOLOGYThe SLR is a step-by-step process that enables researchersto create their own search procedure. This review was carriedout in accordance with the technique for conducting SLRs asproposed by [20]. It is used in identifying the requiredinformation from the selected articles. This method was chosenbecause it makes it easier to capture, summarise, synthesise,and critically comment on any of the topics reviewed. The SLRprocess consists of the following steps:Step 1: Define the research questions.Step 2: Determine the data sources and search process.Step 3: Inclusion and exclusion criteria.Step 4: Results of searching and data extraction.Step 5: Discussion.The total of three hundred and sixteen (316) articles linkedto online social network forensic investigation were retrievedusing the SLR approach from five (5) credible online journals.These online databases are: Scopus, Web of Science,IEEEXplore, ScienceDirect and Association for ComputingMachinery (ACM) Digital Library.A. Research QuestionsRQ1. What are the available published articles in Scopus,Web of Science, IEEEXplore, ScienceDirect and Associationfor Computing Machinery (ACM) Digital Library in thedomain of an Online Social Networks Forensic Investigationmodel from 2011 to 2021?RQ2. What are the phases and activities involved in anOnline Social Networks Forensic Investigation model Domainbased on the Degree of Confidence?B. Data Sources and Search ProcessFive (5) online databases were accessed (Scopus, Web ofScience, IEEEXplore, ScienceDirect, Association forComputing Machinery (ACM) Digital Library) and allavailable documents were retrieved based on the search key“[All:online] AND [All:social] AND [All:network] AND [All:forensic] AND [All:investigation] AND [All:model] AND [PublicationDate:(01/01/2011 TO 31/12/2021)”. All articles whichinclude any of the search term (online, social, network,forensic, investigation, model, publication date from01/01/2011 to 31/12/2021) were retrieved. All articles from2011 to 2021 were included in the search. This time frame waschosen because it would allow for the retrieval of a sufficientnumber of articles on the subject and the detection of aresearch trend. Despite that, the articles retrieved are relativelyconsidered less considering the importance of the domain eventhough it’s young.C. Inclusion and Exclusion Search CriteriaOnly empirical research based on published literature in thefield of online social network forensic investigation wereevaluated. The search parameters were configured to retrieveonly items authored in English and published between January1, 2011 and December 31, 2021. Interviews, news, periodicals,correspondence, conversations, comments, letters to the editor,summaries of tutorials, meetings, workshops, panels, andposter presentations were all eliminated from the search.We excluded the aforementioned categories of publicationssince we only sought to identify papers in the field of onlinesocial network forensic investigation, the majority of whichcould be found in full-text and peer-reviewed journal articles.Journal articles are discovered to go through review processesthat ensure that only proven evidence is available.Journals published more matured research when comparedto other sources. Only full-text studies were chosen theavailability of thorough assessment methods as opposed toarticles that are only available in abstract form. Also, peerreviewed articles were chosen since they determine thecredibility and dependability of studies.D. Search ResultsA number of literature works dealing with the topic of anonline social network forensic investigation are listed in TableI. The article list is divided into four (3) vertical categories andserves as a broad overview with the; (i) Name of iii) Categorization by Year of publication. Tables III and IVpresents the selection of the OSNFIM development phasesbased on degree of confidence (DoC) and the OSNFI phasesand their activities respectively. Fig. 1 shows the retrievedarticles according to the year of publication, Fig. 2, Fig. 3 andFig. 4 shows the Network, Overlay and Density visualizationsof available OSNFIM documents on one of the online database(Scopus) based on bibliometric analysis. Fig. 5 shows theOSNFIM development phases based on DoC while Table IIIshows the list of Items, Links, Total link strength, Occurrenceand Average publication year of every cluster.IV. DATA EXTRACTIONBased on the search term used in the five (5) relevantonline databases, the total of three hundred and sixteen (316)documents were retrieved. ScienceDirect has the highestnumber of retrieved documents of one hundred and eighty-nine(189) and the year 2020 with the highest number of publishedarticles as presented in Table I.154 P a g ewww.ijacsa.thesai.org
(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 12, No. 11, 2021TABLE I.ANALYSIS ON THE AVAILABLE JOURNALS IN THE DOMAIN OF OSNFIMCategorization by Year of 7122131643565535343519121179There are some duplicates among the 316 papers that havebeen retrieved. Scopus has retrieved a total of 31 documents,12 of which are duplicates. ScienceDirect has three (3) articles,IEEEXplore has eight (8) articles, and Web of Science has one(1) article. The total number of documents retrieved fromIEEEXplore is 21, although ten (10) of them are duplicates. InScopus, there are eight (8) papers, while in Web of Science,there are two (2) papers. The total number of documentsobtained by Web of Science is 14, although three (3) of themare duplicates. Two (2) in IEEEXplore and one (1) in Scopus.ScienceDirect has retrieved a total of 189 documents, three(3) of which are duplicates and all of which are in Scopus.There are 71 documents in the Association for ComputingMachinery (ACM) Digital Library, but only one (1) isduplicated in Web of Science.V. 21412189201630Web of ScienceIEEEXploreScienceDirectAssociation forComputing Machinery5.(ACM) l documentretrieved2020Name of onlineDatabase(s)2021S.noPublished Journals / Year6040200Series12021 2020 2019 2018 2017 2016 2015 2014 2013 2012 201143 56 55 35 34 35 19 12 1179This section contains a detailed discussion in order toanswer the research questions that have been posed:Fig. 1. Published Articles According to Year.ScopusIEEEWeb of 27NotRelevantTotalDuplicateEXTRACTION OF RELEVANT/NOT RELEVANT AND DUPLICATEDOCUMENTSRelevantTABLE II.TotaldocumentretrievedThe total of 316 subscribed documents were collectedamong which ScienceDirect has the total highest number with189 documents and the year 2020 with the highest publishedjournals as shown in Table I and Fig. 1 which both canrelatively considered as less considering the importance of thedomain even though it’s young. Also, most of the documentsretrieved are not related to the domain of interest while someare duplicates. But they were accessed due to the search termused will involves all documents having any of the word(online, social, network, forensic, investigation, model)appeared in it. After sorting the relevant/not relevant articles, itcan be concluded that not up to 30% of the 316 documentsretrieved were relevant to the domain of interest and twentynine (29) articles are duplicates as presented in Table II.Therefore, more research has to be conducted andpublished in the domain of online social network forensicinvestigation (OSNFI) considering how technology is rapidlydeveloping and crimes are increasing and becoming advancedday by day due to how people are becoming addicted to the useof social networking sites. This will help in creating awarenessto the users and also help other researchers working in thedomain.Name ofDatabaseRQ1. What are the available published articles in Scopus,Web of Science, IEEEXplore, ScienceDirect and Associationfor Computing Machinery (ACM) Digital Library in thedomain of an Online Social Networks Forensic Investigationfrom 2011 to 2021?2311917967289121033129155 P a g ewww.ijacsa.thesai.org
(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 12, No. 11, 2021Fig. 3 and Fig. 4. A total of thirty (30) documents wereretrieved from the scopus online database after using the searchterm “[All: online] AND [All:social] AND [All:network] AND[All:forensic] AND [All:investigation] AND [All:model] AND[PublicationDate:(01/01/2011 TO 31/12/2021)”. Afterconducting the analysis, thirty-four (34) item were generatedbased on five (5) clusters as in Table III.The circles in Fig. 2 and Fig. 3 indicate the level of workwhich has been carried out and published in a specific area ofresearch. It can clearly be seen that social networking (online)and digital forensic has the biggest circles based on theanalysis. The domain of interest which is the online socialnetwork forensic investigation has one of the smallest circleseven among its cluster. Therefore, this obviously indicates thatnot much work has been carried out in the domain even thoughit is considered young but very important.Fig. 2. Network Visualization of Available OSNFIM Documents on ScopusDatabase based on Bibliometric Analysis.RQ2. What are the phases and activities involved in anOnline Social Networks Forensic Investigation Model Domainbased on the Degree of Confidence?Several models and frameworks have been proposed by [6];[10]; [15]; [2]; [5]; [16]; [14]; [23]; [24]; [11]; [13]; [7]; [25];and [17], but very few were designed with OSNFI in mind.However [6]; and [10] proposed a digital forensicinvestigation model for online social networking and a digitalforensic investigation model and its application design. Eventhough they tried in the automation of the entire process, thereare some activities which requires manual handling which candecrease the dependability and credibility of evidence incriminal proceedings [10], added Iteration in all theinvestigation process and that can sometimes be very difficulttracing back at the source of the information collected [23];[24]; [13]; [5] and [25], focused more on a particular platformor content rather than the entire OSN. Such platforms includes:WhatsApp, Cloud, Messenger, Imaging and Game.Fig. 3. Overlay Visualization of Available OSNFIM Documents on ScopusDatabase based on Bibliometric Analysis.In 1926, Alfred Lotka introduced bibliometrics when heexamined patterns of author output and presented the firstcriteria for bibliometrics [21]. Bibliometrics is a field ofscientific inquiry that is gaining increasing interest from thescientific world and has swiftly grown and has been used tovarious academic domains. It is an excellent technique toretrieve, evaluate and statistically analyse quantifiable data inscholarly literature and also the merits of a certain topic area ora particular publication which can be used through itsindicators to better reflect the evolution of a given researchdirection [22].VOSviewer was used to conduct a co-occurrence analysisbased on all keywords as the unit of analysis and Full countingmethod. The full counting technique indicates that each coauthorship, co-occurance, bibliographical coupling, or cocitation link gets the same weight. The parameters were used inorder to analyse the retrieved documents so as to have a clearperspective in the domain of OSNFIM as presented in Fig. 2,Fig. 4. Density Visualization of Available OSNFIM Documents on ScopusDatabase based on Bibliometric Analysis.156 P a g ewww.ijacsa.thesai.org
(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 12, No. 11, 2021TABLE III.ITEMS, LINKS, TOTAL LINK STRENGTH, OCCURRENCE ANDAVERAGE PUBLICATION YEARmodel for the domain of OSN. The author in [18] proposed acomprehensive digital forensic investigation process modelthat includes: acquisition and analysis of digital evidence.Iteration process is considered in their proposed model but theprocess is too common and non-specific. A digital forensicinvestigation process model for online social networks(FIMOSN) was presented by [17]. The model comprises ofseven (7) phases and focused on automating the whole processactivities. The model considered Iteration at a reasonable stagewhich is after analysis phase and before presentation but theevaluation process is entirely manual and this can slow theinvestigation process.LinksTotal linkstrengthOccurrenceAvg. 521022019.501517022017.502181112018.91Image enhancement1416022020.00Image forensicImage processing0912181503022017.672018.00Quality 7Sensor pattern noise1518022020.00Social networksCluster 3Cloud computing1732052018.200506022017.00Computer tphonesSocial networking(online)Social networkingsitesCluster .003392142018.140608022017.50 Very Strong(100 - 70%)CrimeElectronic crimecountermeasuresIterative methodsOnline socialnetworksOnline socialnetwork (OSN)Cluster 5111622015.50 Strong(69 - 50%)254662016.50 Moderate (49 - 30%)151922019.50 Mild111622015.50 Very Mild (10 - 0%)161922020.50Automation142432019.67ItemCluster 1Blind sourceseparationCamerasDeep learningFacebookInformation systemsOnline socialnetworksSource cameraidentificationSource cameraidentificationsSourceidentificationCluster 2Digital forensicOnline social91422019.50network forensicOntology91422019.50Social media datum7822018.00Social media91422019.50networksSummary: Items 34, Cluster 5, Links 247 and Total Link Strength 406There are quite a number of models which recommenddifferent phases and activities for the forensic investigation ofonline social networks. But for the purpose of coming up witha unified number and terms for this research, a total of five (5)models are randomly selected. According to [17], forensicinvestigation for online social networks consist of seven (7)phases; Pre-investigation, Incident specification, Extraction,Preservation, Analysis, Iteration and Presentation. [24]suggested six (6) phases; Identification, Preservation,Collection, Examination, Analysis and Presentation, [13]presented four (4) phases; Preparation, Incidence response,Laboratorium process and Presentation, [6] recommended four(4) also; Preliminary, Investigation, Analysis and Evaluation.Therefore, the Degree of Confidence (DoC) is used to calculatethe number of frequency of each term as demonstrated inTable IV and Fig. 5.Degree of confidence is calculated by dividing thefrequency of the number of times a phase appears in themodels chosen by the total number of R1models. Thefollowing is how DoC is calculated: n%(1)Based on the Degree of Confidence (DoC), there are five(5) categories of phases well-defined and they are as follows:(29 - 11%)After applying the DoC formula, it can be seen from Fig. 5that, analysis and presentation phases has the Very Strong DoCof 100%.(())Preservation phase has a Strong DoC of 60%()One of the best OSN models were those presented by [18];and [17]. They both proposed a semi-automated and automated157 P a g ewww.ijacsa.thesai.org
(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 12, No. 11, 2021SELECTION OF OSNFIM DEVELOPMENT PHASES BASED ON DOCS/No.FrequencyR1 ModelsPhases[17][24][13][15][6]DoC (%)TABLE IV.1.Preliminary 2402.Preparation 1203.Identification 1204.Investigation 2205.Incident Specification 1206.Incidence Response 1207.Acquisition 2408.Triage 1209.Preservation 36010.Collection 12011.Examination 12012.Analysis 510013.Evaluation 12014.Iteration 11015.Presentation 5100Degree of Confidence ence ResponseInvestigationIncident 0%60%40%20%0%PhasesFig. 5. OSNFIM Development Phases based on DoC.Acquisition and Preliminary phases has moderate DoC of40% each, Preparation, Identification, Investigation,Examination, Identification, Incident specification, Incidentresponse and Collection phases has a Mild DoC of 20% whileIteration and Triage phases has a Very Mild DoC of 10%.Any phase that is having the DoC as; Very Strong (100 70%), Strong (69 - 50%) or Moderate (49 - 30%) is selectedwhile those with Mild (29 - 11%) or Very Mild (10 - 0%) wererejected. However, iteration phase was among the selectedphases despite having the DoC of Very Mild (10%). It wasselected because most of the previous models presented areadopting conventional practices; they are intended to offerguidance and a list of activities for human investigators. Themethod of automated investigation of OSNs is fundamentallyiterative, investigators must continue to broaden the datacollection process if the need arises [17]. Therefore, a totalnumber of six (6) phases were selected and they are as follows:1) Preliminary: This stage stresses two things: first,proper incident reporting, and second, formal authorization forinvestigation.2) Acquisition: This is the procedure of obtaininginformation from any online social network.3) Preservation: This is the secure keeping of propertywithout altering or changing the content of data.4) Analysis: This is the process of conducting anautomated data sorting and filtering in order to obtain the mostimportant data, which contains potential evidence.5) Iteration: is a new round of data extraction with awider scope.6) Presentation: The investigators will choose relevantand appropriate evidence to present in court.158 P a g ewww.ijacsa.thesai.org
(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 12, No. 11, 2021TABLE V.OSNFI erationPresentationOSNFI PHASES AND THEIR ACTIVITIESActivities Parser Infrastructure readinessIncident nNotificationSurveyIdentify Incident ParametersIdentify Social Network sourcesFormulate PIEZInitialize ParserInitiate Automated Extraction by using(5) online databases (Scopus, Web of Science, IEEEXplore,ScienceDirect, and Association for Computing Machinery(ACM) Digital Library). After categorizing the articles intorelevant and non-related categories, it was discovered that onlyabout 30% of the 316 documents obtained were relevant to thetopic of interest, with twenty-nine (29) being duplicates. This isan indication that more work has to be conducted in the domainof OSNFI. In addition, five (5) R1 models were utilised toidentify the various phases and activities that can be used in theinvestigation of an online social network forensic crimes andbased on the level of confidence, a total of six (6) phases andforty-three (43) activities were extracted veyTransportStorage[1]Preserve a forensic copy of Data Set[4][2][3] Perform automated Analysis Sort and filter the data relevant to theinquiry Formulate hypotheses Examine the Data Test the Hypothesis Conclusion Reporting Formulate new hypotheses Identify the Involvement of new Entities Outline the Secondary InformationExtraction Zone Repeat Steps Select Relevant Evidence Attach Suitable Metadata Add Visualizations Record Sequence of Steps Present the Evidence Conclusion Review Decision Interpretation Documentation Investigator CourtOfLawTherefore, because there is no any uniform method forconducting the investigation of an online social networkcrimes, these six (6) phases can be adopted in order to create auniformity in the process of conducting the investigation.Table V clearly defined the actions in each phase. A total offorty-three (43) activities were identified across the six (6)phases. These actions are regarded as the steps that must becompleted in each phase in order to fulfill the ][14][15][16][17]VI. CONCLUSIONDue to the quick technology advancement, online socialnetwork forensic investigation is an essential young domainthat requires considerable attention. Based on the findings ofthis study, it appears that, despite its importance and highdemand, little work has been published in the field. Based onthe search keyword, only 316 papers were obtained from five[18][19][20]REFERENCESPilli ES, Joshi RC, Niyogi R. Network forensic frameworks: Survey andresearch challenges. Digit. Investig. [Internet] 2010;7:14–27. Availablefrom: http://dx.doi.org/10.1016/j.diin.2010.02.003.Baca M, Cosic J, Cosic Z. Forensic analysis of social networks (casestudy). Proc. Int. Conf. Inf. Technol. Interfaces, ITI 2013;219–23.Cohen F. Journal of Digital Forensics , Security and Law Column :Putting the Science in Digital Forensics. 2011;6.Kohn MD, Eloff MM, Eloff JHP. Integrated digital forensic processmodel. Comput. Secur. [Internet] 2013;38:103–15. Available Kale S, Sahu PA. Forensic Imaging for Online Social Networks.2014;3:166–70.Zainudin, M N, Merabti, Madjid, Llewellyn-jones, David. A DigitalForensic Investigation Model for Online Social Networking. 2010;1–6.Lu R, Li L. Research on forensic model of online social network. 2019IEEE 4th Int. Conf. Cloud Comput. Big Data Anal. ICCCBDA 20192019;116–9.Arshad H, Jantan A, Hoon GK, Butt AS. A multilayered semanticframework for integrated forensic acquisition on social media. hang C-P. Knowledge Production from Social Network Sites - UsingSocial Media Evidence in the Criminal Procedure ( Title of the Thesis )Knowledge Production from Social Network Sites - Using Social MediaEvidence in the Criminal Procedure. 2014.Mohd Zainudin N, Merabti M, Llewellyn-Jones D. Online socialnetworks as supporting evidence: A digital forensic investigation modeland its application design. 2011 Int. Conf. Res. Innov. Inf. Syst.ICRIIS’11 2011.Montasari R. Digital Forensic Investigation of Social Media ,Acquisition and Analysis of Digital Evidence. 2019;2:52–60.Kleinberg JM. Challenges in mining social network data. 2007;13:4–5.Rahman D, Rahadhian, Riadi I. Framework Analysis of IDFIF V2 inWhatsApp InvestigationProcess on Android Smartphones. Int. J. CyberSecurity Digit. Forensics 2019;8:213–22.Jang YJ, Kwak J. Digital forensics investigation methodology applicablefor social network services. Multimed. Tools Appl. 2015;74:5029–40.Haggerty J, Casson MC, Haggerty S, Taylor MJ. A framework for theforensic analysis of user interaction with social media. Int. J. Digit.Crime Forensics 2012;4:15–30.Abdalla A, Yayilgan SY. A Review of Using Online Social Networks.2014;8531:3–12.Arshad H, Omlara E, Oludare I, Aminu A. Computers & Security Asemi-automated forensic investigation model for online social networks.Comput. Secur. [Internet] 2020;97:101946. Available ntasari R. A comprehensive digital forensic investigation processmodel Reza Montasari. 2016;8:285–302.Valjar
Forensics is used on social media platforms like Facebook, MySpace, Twitter, and LinkedIn. It is well known as social media forensics, and it's a subset of digital forensics and network foren
