Over 40% of the world’s population uses the Internet, and 74% of them use social networking sites (Duggan, Ellison, Lampe, Lenhart, & Madden, 2015). As of September 2015, the most popular social networking sites were Facebook, Twitter, LinkedIn, Pinterest, and Google Plus+ (ebizmba, 2015). In addition, 40% of mobile phone users sampled use social media sites on their phone, and 28% reported using social networking sites daily (Duggan et al., 2015). Social networking sites may be defined as “web-based services that allow an individual to construct a public or semipublic profile within a bounded system, articulate a list of other users with whom they share a connection, and view and traverse their list of connections and those made by others within the system” (Boyd & Ellison, 2008, p. 211). Social networking sites (SNS) allow users to maintain old relationships, while also connecting with new acquaintances or even strangers on the Internet. Although they are the most commonly used, social networking sites make up only a subset of social media.

Prior to the boom of personal computers, traditional computer investigations were of the theft of computer components. However, computers now play either a target (e.g., hacking), tool (e.g., cyberbullying), or incidental (e.g., storage device for evidence) role in criminal investigations (c.f., Maras, 2012). In addition, traditional crimes committed through the use of computer technology are now referred to as “old crimes with new tricks,” such as cyberbullying, Internet child pornography use, and cyberterrorism. Brunty and Helenek (2013) outlined the different ways in which social media may be used by criminals: burglary, social engineering, phishing, malware, identity theft, cyberbullying, cyberstalking, exploitation, sexual assault, prostitution, organized crime, and cyberterrorism. Not only are social media sites used to commit crimes, criminals may leave a trail of digital evidence, including posts, short message service (sms) communications, photos, or geotaging, to name a few.

Traditional computer forensics evolved into the field of digital forensics in response to the variety of digital devices, other than traditional computer hardware, that housed digital evidence. Computer forensics was no longer a term that accurately represented the various forms of digital evidence. Digital evidence is defined as information that is either transferred or stored via a computer (Casey, 2011), and digital evidence may be found on mobile devices, global positioning systems (GPS) devices, gaming systems, and networks, to name a few. Thus, digital forensics is an umbrella term that refers to the analysis of digital evidence, which includes network forensics (Internet traffic), computer forensics, mobile-device forensics (e.g., cell phone), and malware forensics (e.g., viruses; Casey, 2011). Regarding social media, digital evidence may be found on the physical device or on the network (Brunty & Helenek, 2013).

If the digital evidence is on the network (e.g., stored by the social media site), the data may be spread over many servers, providers, and users, which may require the use of big data analytics (Nelson, Phillips, & Steuart, 2015). If there is the potential for social media evidence, the first step for law enforcement is to send a preservation order to the Internet service provider (ISP) to prevent any changes to the data for 90 days until a court order to search warrant is issued (EC-Council, 2010). However, the preservation order must reference a specific account and time frame.

Digital evidence from social media use may be found on traditional desktop computers and laptops as well as mobile devices, such as tablets and smartphones. For traditional desktop computers and laptops, social media sites are accessed through an Internet browser (e.g., Safari, Internet Explorer), whereas social media may be accessed through apps or traditional Internet browsers depending upon the mobile device. First, these Internet browsers are great sources of potential digital evidence, including browsing history, searches, sites visited, and stored login and password information (c.f., Casey, 2011). In addition, these Internet browsers also maintain a “cache,” which is a repository for storing copies of previously visited websites that expedites the processing of information when reopening a site (c.f., Brown, 2006; Clancy, 2011). Social media artifacts are primarily located in the browser cache (c.f., Cusack & Son, 2012).

The future of digital forensics will depend on the ever-changing world of technology, but as it stands currently, there is a strong demand in the law enforcement community for social media forensics. Thanks to the globalization of technology, the number of social media users will continue to increase. For instance, there were 1.59 billion social network users in 2013, and this number is expected to increase to 2.44 billion by 2018. In addition, there was a significant increase in the number of multiplatform use from 42% in 2013 to 52% of online users in 2014 (PRC, 2015). In other words, online adults are more likely to use two or more social media sites. Thus, not only are almost all criminal investigations involving at least one form of digital evidence, when these cases involve social media, it is plausible that the majority of them will involve more than one form of social media as well. For example, The University of Alabama experienced a cyber threat on September 21, 2014 after someone by the username, Authur Pendragon, posted an ominous comment on a YouTube video (see Seigfried-Spellar et al., 2015). This threat fueled a fury of miscommunication, rumors, and panic that reached beyond The University of Alabama campus thanks to social media. The Authur Pendragon incident was a hot topic on social media sites/apps, including YouTube, Twitter, Facebook, YikYak, GroupMe, and Reddit. More specifically, the threat became a trending topic on Twitter with the hash tag, #Pray4Bama (Seigfried-Spellar et al., 2015).