A Forensic Methodology for the Analysis of Twitter Application in Android Devices

Twitter is one of the major social networking platforms used by millions of users every day. On every second, around 6000 tweets are sent through Twitter. The forensic analysis of Twitter application is of utmost importance to crime investigators as it can contain a rich set of evidential artefacts. The physical acquisition of Android devices can unveil the forensic artefacts stored in the Twitter application database, but only the most recent tweets and messages. This paper introduces a new methodology to forensically extract Twitter cloud data using the access tokens present in Android devices. The tokens enable investigators to get authenticated access to Twitter cloud servers and further access to the entire data using Twitter APIs. The response data is encoded in JavaScript Object Notation (JSON) format, which is further analyzed to identify the attributes of each tweet object.