Thank you to all for the response and excellent feedback on our previous post outlining key Twitter metadata fields. As promised, here are some key metadata fields for each Facebook entry. These fields provide important evidence, investigation context and circumstantial evidence to establish authenticity, if properly collected and preserved. Facebook changes their APIs from time to time, so we will be reporting any such changes and updates when they occur:
| Metadata Field | Description | ||||||||
| Uri | Unified resource identifier of the subject item | ||||||||
| fb_item_type | Identifies item as Wallitem, Newsitem, Photo, etc. | ||||||||
| parent_itemnum | Parent item number-sub item are tracked to parent | ||||||||
| thread_id | Unique identifier of a message thread | ||||||||
| recipients | All recipients of a message listed by name | ||||||||
| recipients_id | All recipients of a message listed by user id. | ||||||||
| album_id | Unique id number of a photo or video item | ||||||||
| post_id | Unique id number of a wall post | ||||||||
| application | application used to post to Facebook
(i.e, from an iPhone or social media client) |
||||||||
| user_img | url where user profile image is located | ||||||||
| user_id | Unique id of the poster/author of a Facebook item | ||||||||
| account_id | unique id of a users account | ||||||||
| user_name | display name of poster/author of a Facebook item | ||||||||
| created_time | When a post or message was created | ||||||||
| updated_time | When a post or message was revised/updated | ||||||||
| To | Name of user whom a wall post is directed to | ||||||||
| to_id | Unique id of user whom a wall post is directed to | ||||||||
| Link | url of any included links | ||||||||
| comments_num | Number of comments to a post | ||||||||
| picture_url | url where picture is located | ||||||||
As mentioned earlier, you will not get all this key metadata from a printout, screen capture, or even most compliance archive tools. Best practices technology specifically designed to collect, preserve, search and produce social media for eDiscovery is required.