FEDIS: Graph-Based Social Media Evidence Collection with Correlation-Aware Forensic Analysis

Abstract

Online Social Networks (OSNs) have emerged as a major source of digital evidence in cybercrime investigations, abuse detection, and online incident analysis. Publicly available data, such as posts, comments, reactions, and user interactions, provide critical insights into suspicious activities and behavioral patterns. However, extracting and analyzing such data in a forensic context remains challenging. Existing social media data acquisition approaches primarily rely on web scraping or API-based techniques that produce unstructured outputs (e.g., raw text and images) without preserving the relationships among entities such as users, posts, and interactions. This results in the loss of contextual information essential for forensic analysis. Furthermore, data collection and analysis are often performed separately, resulting in delayed investigations and limited real-time insight. To address these limitations, this paper focuses on two key forensic requirements: (i) efficient and structured acquisition of social media evidence and (ii) correlation-aware analysis of interactions. We propose FEDIS, a unified forensic data acquisition and analysis system that integrates a hybrid DOM-TAO data model, graph-based representation, and parallel keyword-based search. Experimental results demonstrate that FEDIS achieves complete relationship preservation, improves data collection completeness, and significantly reduces search latency compared to traditional approaches, making it practical for real-world social media forensic investigations.