The forensic acquisition of content, sites or web pages is a service that with the evolution of digital technology has become increasingly in demand as it allows the evidence and contents to be crystallized in the exact moment before they are removed or modified. Complete websites or individual pages, social networks (Facebook, Twitter, Instagram, Linkedin, Youtube), journalistic portals, blogs and forums are among the most frequent case studies.
In the world of digital forensics there are some professional tools implemented to respect the best practices imposed by the forensic sciences approved by the scientific community that allow the crystallization of contents. The most widespread is certainly FAW (Forensics Acquisition of Website).
FAW is the first forensic browser born in 2011 and was created by two Italians: Davide Bassani and Matteo Zavattari. It is addressed to law enforcement, investigators, notaries, lawyers, technical consultants, CTP, CTU, brand protection companies or even for simple private users who must acquire web pages to be produced in criminal or civil proceedings.
Unlike solutions such as Web Archive, Archive.is or Hashbot, FAW was the first software able to acquire in a certified way also pages protected by credentials, such as Facebook, including photo galleries, chats, reserved areas, allowing the verification of acquisitions by third parties.
At the end of August 2019 version 8.0 will be released. It is an absolute novelty that we have been able to try in preview. The software comes with a completely redesigned graphic interface in a dark style.
In addition to the normal software used so far, other new tools have been added that allow safer and more automated acquisitions, especially on Facebook, Instagram, You Tube, Vimeo, Wechat, Weibo and Renren social media.
Starting FAW we get the interface that resembles that of a browser but that provides some additional features and configurations. In particular, in addition to that of “Navigation”, the functions of “Acquisition”, “Setting the Capture Area” and “Capture” are immediately evident.
The acquisition phase will activate the recording of network traffic and a screencast as well as record all the operations performed by the user (keylogger, mouselogger, windows events).
The user can then select the area of the page to be acquired and proceed with the acquisition of all the elements connected to the page itself (html, frames, http headers, images, scripts, https certificates, etc.).
Following the forensic acquisition of a web page, FAW will produce a folder containing all the acquired elements and a report in word and pdf format.
The result of the precautionary acquisition of the page or of the website can be integrated into a forensic examination and go to compose a certification of the existence of particular web pages, chats, galleries of images or videos particularly useful in the case of defamation, slander, threats, intellectual property theft, plagiarism, cloning and copying of copyrighted content.
