My Forensics Research onto FB localstorage files.

Background

I delivered this presentation to a board of professors, executives, even one person who was worked on Director & Associate General Counsel at Meta.

Facebook Marketplace and other kinds of marketplace apps are an increasingly popular way for those online to connect and sell to one another. Yet, this growing platform also represents a potential ground for nefarious actors to connect. This paper focuses on a theoretical situation centering on a possibly foreign organization that communicates with its hidden operatives within the country through the use of marketplace apps. Marketplace apps are valued in this use case owing to their high existing traffic, ability to communicate inconspicuously, and potential to bypass traditional forensic processes like iMessage or regular Facebook Messenger.

For this work, two Facebook accounts were created and made to interact with one another on Facebook Marketplace. The iPhone belonging to the buyer was imaged using iMazing, and plist database files were inspected for information about chat history and notification history.

The investigation found recoverable artifacts, including: account creation timestamps (revealing user onboarding dates), notification logs (exposing interaction metadata like user ID and notification time), time-on-app sessions (correlating activity with messages), FFLogger.sql entries (tracking sessions and hardware), and Marketplace item JSON data (detailing listings with URLs and metadata). These artifacts provide forensic value by enabling timeline reconstruction and allowing further investigative leads.