C.E.R.T.O. / Modules / Web pages / Messenger & Direct

PLATFORM · PRIVATE CONVERSATIONS

Messenger & Direct

Private Messenger conversations — including end-to-end encrypted ones — and Instagram Direct threads, collected by walking back up the conversation without losing the messages already scrolled out of view.

It switches itself on

You paste the address into the forensic browser.
You start a web page acquisition, as always.
C.E.R.T.O. recognises the platform and does the rest.

No option to tick, no separate module to buy, no extra cost: it is the Web pages module, at its own rate.

A private conversation is a different evidentiary object from public content, and it deserves its own pipeline: here there is no service to query. On end-to-end encrypted Messenger there is no network channel from which to obtain the text — verified in the field: zero responses containing cleartext. The only possible source is what the application decrypted and drew on screen, and this module documents exactly that, and nothing more.

There is a trap, though: Messenger recycles the page. As you walk back up the conversation, messages scrolled out of view are removed — measured: 27, then 44, 55, 81, 68, 94, 65 messages present at different moments. Anyone who scrolls to the top and only then collects gets a badly incomplete bundle with no error signal at all. So here collection happens at every step and accumulates, recognising duplicates.

What goes into the bundle

What gets acquired

Only what the program actually does: every item matches a collection that exists in the code and has been tested on real acquisitions.

Conversation messages

Text, author and direction (sent or received), collected at every step of the walk-up and deduplicated, because in the page the messages carry no identifier to rely on.

Frames of the walk-up

The conversation as it appeared on screen step after step, with the hash of every image.

The limit, declared

The bundle states that the source is the content rendered on screen and not a network channel, because on an encrypted conversation that channel does not exist. It is information whoever weighs the evidence needs.

Recognised addresses

What you can paste

Recognition looks at the domain and the shape of the address. If it recognises nothing, it stays an ordinary web page acquisition: nothing is lost.

facebook.com/messages/t/<id>Messenger conversation
facebook.com/messages/e2ee/t/<id>end-to-end encrypted conversation
instagram.com/direct/t/<id>Instagram Direct thread

In the bundle

Where what it collects ends up

Folders inside the BagIt bundle, alongside everything else from the web acquisition: WACZ archive, screenshots, network traffic, certificates, report.

social/messaging/

The bundle's interactive.html dashboard presents them in tables with search and sorting, and works offline, on a double click, even on a computer without C.E.R.T.O. installed.

The raw response stays in the bundle

Where collection goes through a service, every response is preserved verbatim with its provenance envelope: queried address, method, status, moment of receipt. Anyone contesting the data can go back to the source rather than trusting our table.

Sealed like every acquisition

A BagIt 1.0 bundle with an Ed25519 signature, a double RFC 3161 timestamp and a CASE/UCO description, verifiable by anyone, offline, with the included verifiers.

It says when it stops

The document reports how many items the platform announces, how many were collected and why collection stopped. A stated limit is worth more than an asserted completeness.

FAQ

Frequently asked questions

The questions we are asked most often about this platform.

Can an end-to-end encrypted conversation be acquired?

Yes, but it is right to know how. On an encrypted conversation there is no network channel from which to obtain the text — verified in the field — so the source is what the application decrypted and drew on screen on the operator's already-authenticated device. The bundle says so plainly, because it is information whoever weighs the evidence needs.

Why is scrolling the chat and taking screenshots not enough?

Because Messenger recycles the page: as you walk back up the conversation, messages scrolled out of view are removed. Anyone who scrolls to the top and only then collects gets a badly incomplete bundle with nothing to signal it. C.E.R.T.O. collects at every step of the walk-up and accumulates, recognising duplicates.

Do I need to sign in to the account?

Yes: a private conversation is visible only to its participants. You sign in with your own credentials from the built-in forensic browser, and what gets acquired is exactly what that account could see at that moment.