Authors: Graeme Horsman
DFRWS USA 2018
Abstract
With the increased popularity of online video streaming comes the risk of this technology’s subsequent abuse. With a number of cases noted in 2017 where individuals have engaged with illegal or policy breaching video content, digital forensics practitioners are often tasked with investigating the subsequent ‘fingerprint’ of such acts. This is often to determine both the content of a stream in question and, how it has been interacted with, typically from an analysis of data residing on a suspect’s local device. This article provides an examination of the forensic procedures required to identify and reconstruct cached video stream data using both YouTube and Facebook Live as example case studies. Stream reconstruction methodologies are offered where results show that where a YouTube and Facebook Live video has been played, buffered video stream data can be reassembled to produce a viewable video clip of content.