Certification & Online Trace Collection · service active
WACZ · ISO 28500/ eIDAS timestamping/ Client area
C.E.R.T.O.
Sign in Register free
IT EN
C.E.R.T.O. / Modules / Web pages / Facebook
PLATFORM · FACEBOOK

Facebook

Comments on posts and videos, profile, timeline posts and friend list — with each person's identifier and picture.

It switches itself on
  1. You paste the address into the forensic browser.
  2. You start a web page acquisition, as always.
  3. C.E.R.T.O. recognises the platform and does the rest.

No option to tick, no separate module to buy, no extra cost: it is the Web pages module, at its own rate.

On a Facebook post the defamation or the threat is often not in the content: it is in the comments below. And the comments are exactly what a screenshot cannot take, because the platform shows a few at a time and hides the rest behind a “view more comments”.

Facebook exposes no public address comparable to Instagram's: everything goes through a single internal channel, over POST, with session parameters. C.E.R.T.O. follows it there, and when what it collects does not match what the page shows it records both numbers and the difference, instead of picking the more convenient one.

What goes into the bundle

What gets acquired

Only what the program actually does: every item matches a collection that exists in the code and has been tested on real acquisitions.

Comments and replies

On posts and videos, with text, author, date and counters. The frames captured during extraction end up in the bundle as a gallery, with a PDF carrying their hashes.

Profile

Profile identity — identifier, name, picture, stable address — taken from the payload the page already carries.

Timeline posts

The text of each post, when it was published and the stable address where it lives. The bundle used to carry the page's “full text”: an undifferentiated block of twenty-six thousand characters containing nothing useful.

Friend list

Name, numeric identifier and picture for each person, following the list page after page to the end. Measured in the field on a profile with 692 friends.

Recognised addresses

What you can paste

Recognition looks at the domain and the shape of the address. If it recognises nothing, it stays an ordinary web page acquisition: nothing is lost.

  • facebook.com/…/posts/<id>post with its comments
  • facebook.com/watch/?v=<id>video with its comments
  • fb.watch/<codice>shortened video link
  • facebook.com/<profilo>profile, timeline and friends
In the bundle

Where what it collects ends up

Folders inside the BagIt bundle, alongside everything else from the web acquisition: WACZ archive, screenshots, network traffic, certificates, report.

  • social/facebook/
  • raw-api/

The bundle's interactive.html dashboard presents them in tables with search and sorting, and works offline, on a double click, even on a computer without C.E.R.T.O. installed.

The raw response stays in the bundle

Where collection goes through a service, every response is preserved verbatim with its provenance envelope: queried address, method, status, moment of receipt. Anyone contesting the data can go back to the source rather than trusting our table.

Sealed like every acquisition

A BagIt 1.0 bundle with an Ed25519 signature, a double RFC 3161 timestamp and a CASE/UCO description, verifiable by anyone, offline, with the included verifiers.

It says when it stops

The document reports how many items the platform announces, how many were collected and why collection stopped. A stated limit is worth more than an asserted completeness.

FAQ

Frequently asked questions

The questions we are asked most often about this platform.

Can the comments on a Facebook post be acquired?
Yes, and it is often the part that matters. Comments and replies to comments are collected by querying the same data source the platform uses to build the page, not by photographing the screen. Every response stays in the bundle exactly as received, and the document states how many items Facebook announces, how many were collected and why collection stopped.
Do I need to be signed in to Facebook?
It depends on what is public. The built-in forensic browser lets you sign in with your own credentials when the content requires it, and what gets acquired is exactly what that account could see at that moment — a circumstance the bundle states, because it is part of the context of the evidence.
Do I have to tell C.E.R.T.O. I am acquiring Facebook?
No. You paste the address and start a web page acquisition as usual: C.E.R.T.O. recognises the platform and the shape of the address by itself and switches on the dedicated collection. No option to tick, no extra cost.
Same module

The other platforms

All inside the Web pages module, all recognised from the address, all at the same rate.

Collect evidence from Facebook.

Register for free and download C.E.R.T.O. Desktop for Windows and macOS from your client area.