{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,10]],"date-time":"2026-06-10T16:31:23Z","timestamp":1781109083564,"version":"3.54.1"},"reference-count":28,"publisher":"IGI Global Scientific Publishing","issue":"4","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2012,10,1]]},"abstract":"<p>The increasing use of social media, applications or platforms that allow users to interact online, ensures that this environment will provide a useful source of evidence for the forensics examiner. Current tools for the examination of digital evidence find this data problematic as they are not designed for the collection and analysis of online data. Therefore, this paper presents a framework for the forensic analysis of user interaction with social media. In particular, it presents an inter-disciplinary approach for the quantitative analysis of user engagement to identify relational and temporal dimensions of evidence relevant to an investigation. This framework enables the analysis of large data sets from which a (much smaller) group of individuals of interest can be identified. In this way, it may be used to support the identification of individuals who might be \u2018instigators\u2019 of a criminal event orchestrated via social media, or a means of potentially identifying those who might be involved in the \u2018peaks\u2019 of activity. In order to demonstrate the applicability of the framework, this paper applies it to a case study of actors posting to a social media Web site.<\/p>","DOI":"10.4018\/jdcf.2012100102","type":"journal-article","created":{"date-parts":[[2013,2,6]],"date-time":"2013-02-06T11:28:22Z","timestamp":1360150102000},"page":"15-30","source":"Crossref","is-referenced-by-count":3,"title":["A Framework for the Forensic Analysis of User Interaction with Social Media"],"prefix":"10.4018","volume":"4","author":[{"given":"John","family":"Haggerty","sequence":"first","affiliation":[{"name":"School of Computing, Science and Engineering, University of Salford, Manchester, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mark C.","family":"Casson","sequence":"additional","affiliation":[{"name":"Henley Business School, University of Reading, Reading, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sheryllynne","family":"Haggerty","sequence":"additional","affiliation":[{"name":"School of Humanities, University of Nottingham, Nottingham, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mark J.","family":"Taylor","sequence":"additional","affiliation":[{"name":"School of Computing and Mathematical Sciences, Liverpool John Moores University, Liverpool, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"2432","reference":[{"key":"jdcf.2012100102-0","unstructured":"Access Data. (2012). FTK: Forensic tool kit. Retrieved from http:\/\/www.accessdata.com"},{"key":"jdcf.2012100102-1","doi-asserted-by":"crossref","unstructured":"Beck, K. (2011). Analyzing tweets to identify malicious messages. In Proceedings of the International Conference on Electro\/Information Technology (pp. 1-5).","DOI":"10.1109\/EIT.2011.5978594"},{"key":"jdcf.2012100102-2","doi-asserted-by":"crossref","unstructured":"Berlingerio, M., Coscia, M., Giannotti, F., Monreale, A., & Pedreschi, D. (2010). Towards discovery of eras in social networks. In Proceedings of the International Workshop on Modeling, Managing and Mining of Evolving Social Networks, in conjunction with the International Conference on Data Engineering (pp. 278-281).","DOI":"10.1109\/ICDEW.2010.5452713"},{"key":"jdcf.2012100102-3","doi-asserted-by":"crossref","unstructured":"Boston, D. J., & Borcea, C. (2011). TIE: Temporal interaction explorer for co-presence communities. In Proceedings of the 9th International Conference on Dependable, Autonomic and Secure Computing (pp. 854-863).","DOI":"10.1109\/DASC.2011.145"},{"key":"jdcf.2012100102-4","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2010.260"},{"key":"jdcf.2012100102-5","unstructured":"Dugan, L. (2012, February 21). Twitter to surpass 500 million registered users on Wednesday. Retrieved from http:\/\/www.mediabistro.com\/alltwitter\/500-million-registered-users_b18842"},{"key":"jdcf.2012100102-6","unstructured":"Facebook. (2012). Newsroom key facts. Retrieved from http:\/\/newsroom.fb.com\/content\/default.aspx?NewsAreaId=22"},{"key":"jdcf.2012100102-7","doi-asserted-by":"crossref","unstructured":"Falkowski, T., Bartelheimer, J., & Spiliopoulou, M. (2006). Mining and visualizing the evolution of subgroups in social networks. In Proceedings of the International Conference on Web Intelligence (pp. 52-58).","DOI":"10.1109\/WI.2006.118"},{"key":"jdcf.2012100102-8","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2011.247"},{"key":"jdcf.2012100102-9","unstructured":"Guidance Software. (2012). Encase. Retrieved from http:\/\/www.guidancesoftware.com"},{"key":"jdcf.2012100102-10","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2009.01.004"},{"key":"jdcf.2012100102-11","unstructured":"Haggerty, J., & Haggerty, S. (2011). Temporal social network analysis for historians: A case study. In Proceedings of the International Conference on Visualization Theory and Applications (pp. 207-217)."},{"key":"jdcf.2012100102-12","doi-asserted-by":"publisher","DOI":"10.4018\/jdcf.2011070101"},{"key":"jdcf.2012100102-13","doi-asserted-by":"publisher","DOI":"10.1007\/s10506-010-9099-3"},{"key":"jdcf.2012100102-14","doi-asserted-by":"crossref","unstructured":"Horng, S.-M. (2010). Analysis of users behavior on Web 2.0 social network sites: An empirical study. In Proceedings of the 7th International Conference on Information Technology: New Generations (pp. 454-459).","DOI":"10.1109\/ITNG.2010.248"},{"key":"jdcf.2012100102-15","doi-asserted-by":"crossref","unstructured":"Houghton, D. J., & Joinson, A. N. (2012). Linguistic markers of secrets and sensitive self-disclosure in Twitter. In Proceedings of the 45th Hawaii International Conference on Systems Science (pp. 3480-3489).","DOI":"10.1109\/HICSS.2012.415"},{"key":"jdcf.2012100102-16","doi-asserted-by":"crossref","unstructured":"Hu, B., & Gong, J. (2010). Modeling individual-based social network with spatial-temporal information. In Proceedings of the International Conference on Management and Service Science (pp. 1-4).","DOI":"10.1109\/ICMSS.2010.5577184"},{"issue":"4","key":"jdcf.2012100102-17","first-page":"185","article-title":"Analysis of personal email networks using spectral decomposition.","volume":"7","author":"U.Kim","year":"2007","journal-title":"International Journal of Computer Science and Network Security"},{"key":"jdcf.2012100102-18","doi-asserted-by":"crossref","unstructured":"Nirkhi, S. M., Dharaskar, R. V., & Thakre, V. M. (2012). Analysis of online messages for identity tracing in cybercrime investigation. In Proceedings of the International Conference on Cyber Security, Cyber Warfare and Digital Forensics (pp. 300-305).","DOI":"10.1109\/CyberSec.2012.6246131"},{"key":"jdcf.2012100102-19","doi-asserted-by":"publisher","DOI":"10.1109\/MCG.2009.44"},{"key":"jdcf.2012100102-20","unstructured":"Southampton Facebook riot messages man jailed. (2012, June 21). BBC News. Retrieved from http:\/\/www.bbc.co.uk\/news\/uk-england-hampshire-18536940"},{"key":"jdcf.2012100102-21","doi-asserted-by":"publisher","DOI":"10.1016\/j.clsr.2009.05.006"},{"key":"jdcf.2012100102-22","unstructured":"Twitter Engineering Blog. (2011, May 31). The engineering behind Twitter\u2019s new search experience. Retrieved from http:\/\/engineering.twitter.com\/2011\/05\/engineering-behind-twitters-new-search.html"},{"key":"jdcf.2012100102-23","unstructured":"Vlado, A. (2012). Networks \/ Pajek Program for large network analysis. Retrieved from http:\/\/vlado.fmf.uni-lj.si\/pub\/networks\/pajek\/"},{"key":"jdcf.2012100102-24","doi-asserted-by":"publisher","DOI":"10.1145\/1410234.1410238"},{"key":"jdcf.2012100102-25","doi-asserted-by":"crossref","unstructured":"Wei, C., Sprague, A., Warner, G., & Skjellum, A. (2008). Mining spam e-mail to identify common origins for forensic application. In Proceedings of the ACM Symposium on Applied Computing (pp. 1433-1437).","DOI":"10.1145\/1363686.1364019"},{"key":"jdcf.2012100102-26","doi-asserted-by":"crossref","unstructured":"Wiil, U. K., Gniadek, J., & Memon, N. (2010). Measuring link importance in terrorist networks. In Proceedings of the International Conference on Social Networks Analysis and Mining (pp. 225-232).","DOI":"10.1109\/ASONAM.2010.29"},{"key":"jdcf.2012100102-27","doi-asserted-by":"crossref","unstructured":"Zhang, Z., & Li, X. (2010). Controversy is marketing: Mining sentiments in social media. In Proceedings of the 43rd Hawaii International Conference on Systems Science (pp. 1-10).","DOI":"10.1109\/HICSS.2010.121"}],"container-title":["International Journal of Digital Crime and Forensics"],"original-title":[],"language":"ng","link":[{"URL":"https:\/\/www.igi-global.com\/viewtitle.aspx?TitleId=74803","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,6,1]],"date-time":"2022-06-01T15:47:39Z","timestamp":1654098459000},"score":1,"resource":{"primary":{"URL":"https:\/\/services.igi-global.com\/resolvedoi\/resolve.aspx?doi=10.4018\/jdcf.2012100102"}},"subtitle":[""],"short-title":[],"issued":{"date-parts":[[2012,10,1]]},"references-count":28,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2012,10]]}},"URL":"https:\/\/doi.org\/10.4018\/jdcf.2012100102","relation":{},"ISSN":["1941-6210","1941-6229"],"issn-type":[{"value":"1941-6210","type":"print"},{"value":"1941-6229","type":"electronic"}],"subject":[],"published":{"date-parts":[[2012,10,1]]}}}