Archive for the 'Twitter' Category

Finding Deleted Tweets is a web service that let’s members create a daily newspaper of sorts containing their favorite material that they then sharing it with their followers. Here are some points that the investigator should note:

  • A lot of content of these papers comes from Twitter.
  • These papers are archived.
  • Twitter users sometimes delete Tweets
  • Deleting Tweets on Twitter are not deleted on sites like is a content curation service. A Content Curator is someone who continually finds, groups, organizes and shares the best and most relevant content on a specific issue online. These sites are a good place to find content deleted from the originating social networking site.

If you go to and use their search feature, you won’t find anything unless your search is for the title of a paper. Their search doesn’t look within individual articles.

To find mentions of content from Twitter, or any other content, use the Site: operator. When using this search strategy, search by the Twitter account’s name and the user name (@username) along with any keywords that might apply to what you are looking for.

Finding Bozo Eruptions on Twitter

On Tuesday, 18 Nov 2014, Twitter announced that it has finished indexing every public tweet ever made since the social networking service launched in 2006.

Fortunately for investigators, Twitter does not provide bulk deletion. This means that most people will not take the time to examine their Tweets for Bozo Eruptions. However, batch deletions are possible, by using third-party sites like Tweet Deleter, Tweet Eraser and TwitWipe. If someone deletes some Tweets, Twitter admits that “Deleted tweets sometimes hang out in Twitter search, [but] they will clear with time.” Unfortunately, when a user deletes a tweet, it eventually disappears from Twitter’s search results, as well as from any accounts that follow the account along with any retweets of the deleted tweet.

Fear not intrepid investigator, fore hope and a lot of searching might uncover someone who copied into his own tweet a deleted tweet, which will remain as will any tweets quoted on sites elsewhere.

Propaganda War

Shooting down a passenger jet has exposed some good old-fashioned Soviet-style propaganda. It’s not as good as some of Putin’s efforts, but it’s interesting to watch.

The Wayback Machine has captured some very interesting evidence that Russian-backed terrorists shot down Malaysia Airlines Flight MH17. In a post by Igor Girkin on Vkontakte, Russia’s Facebook clone, the Ukrainian terrorist leader who is also known as Strelkov, claimed his forces downed what he thought was a Ukrainian military transport plane.

The Russian-backed terrorist claims he shot down Malaysia Airlines Flight MH17 was caught by the Wayback Machine and publicized on their Twitter account, @InternetArchive ( See The Christian Science Monitor article that translates the content and provides a timeline of the attempts by the terrorists to hide this and blame the Ukraine government.

Meanwhile over at Wikipedia, the Twitter account @RuGovEdits monitors Wikipedia edits by the Russian government. It reveals Russia’s efforts to shift the blame to the Ukrainian government. Putin’s office and Russian media outlets made multiple edits to the page for the murder of the MH17 passengers to blame the “Ukrainian military”. @RuGovEdits should be trustworthy as the Wiki-twitterbot code is widely available on Github.

Saving Bozo Eruptions for Posterity

During research projects I sometimes come across astounding levels of stupidity posted for all to see. Sometimes this occurs in obscure corners of the interweb, sometimes it’s done on Twitter.

If I think an instance of stupidity might become important in the future, I manually archive the web page or Tweet by submitting it to the Wayback Machine using the Save Page Now option.

This doesn’t work with all sites, but when it works, the “Bozo Eruption” will be available on an authoritative site in the future. There won’t be any question that the eruption occurred if someone has second thoughts and removes it from the site.

Social Search — The Event Horizon

Events create a lot of social media chatter. Within this chatter or noise, the Investigator must find useful data. If the origin of the investigation is an event at a particular location, then searching for chatter that is related to the location may move the investigation forward.

GeoTagging is the process of adding geographical identification metadata to social media messages and other content such as images. Searching by the location usually entails entering the Latitude and Longitude of the location.

Twitter Geotags

Twitter allows users to include geotags with their tweets. Some third-party developers are using this feature. For example, Twellowhood, Twitter Local, and Twitter Nano.

Twitter Nano

Twitter Nano allows me to improve the signal-to-noise ratio when the starting point is an event or situation that I can identify with Latitude and Longitude. This will allow the Investigator to identify the people who have an interest or involvement in the event under investigation.

Of course, this doesn’t work if the user-of-interest hasn’t enabled geotagging. However, those with geotagging enabled often identify others who don’t have it enabled.

How To Hide From Twitter

Lately, I have been working with clients who face serious security threats. Some of these people are surprised by what can be learned about them from internet searches. Removing this information is a challenge, especially from social media sites like Twitter.

Twitter presents an interesting challenge. Once you publish a Tweet, a lot of other websites take your Tweet and reproduce it in a database. Topsy, Snap Bird, the Library of Congress, and many others get in on the act.

Of course, you can delete your Twitter account, but your Tweets will live on in a third party database.

The best solution that I have found is to remove all the Tweets from your account rather than deleting the account itself. When some third party site comes to collect your tweets to update their database, they also overwrite or delete your old Tweets and replace them with nothing matching the empty Twitter profile.

Doing this also prevents some malicious adversary from waiting thirty days then opening a new account using your deleted Twitter account name. Of course, keeping the account also allows you to start using it for some subtle disinformation.

If your Twitter account has thousands of Tweets like mine does, then you need an automated deletion service.

Twit Wipe fits the bill. Provide the service with your Twitter password and set it lose. Once Twit Wipe has done its job, change the Twitter password.

After thirty days, you should start searching for the deleted Tweets to identify any sites that still have them. If they still exist on some sites after sixty days, then consider requesting their removal.

Snap Bird

If you want to see all the Tweets from a particular Twitter account, then you are out of luck if you don’t know about Snap Bird. Twitter allows you to only search or see about a week’s worth of Tweets.

Snap Bird allows you to survey all the Tweets for a particular user if you select “Someone’s timeline” as the type of search.

This is extremely useful when trying to assess the nature of the person behind the Twitter account. Sometimes, you will find that the account is really just a bot that retweets what it finds. Sometimes, you find the account is owned by somebody with an axe to grind. Sometimes, you find the person behind the account is an activist of some type. You learn these things from reviewing all the tweets to see the general theme of the account.

The point is, you won’t know what you’re dealing with unless you can see all the Tweets coming from that account and Snap Bird allows you to do that.



One of my favourite search engines for Twitter is Topsy which indexes and ranks search results based upon the most influential conversations occurring every day about each specific term, topic, page or domain queried.

I have been using this for almost two years as my go-to search engine for tweets about issues that currently interest my clients.

Getting to Know the Neighbourhood — Twitter Via RSS

To monitor someone’s Tweets, but not actually publicly follow the Twitter account, use Twitter to RSS. This service allows you to enter the name of a public Twitter account and create an RSS feed for popular RSS readers like Google Reader.

This won’t work if the account owner selected the Protect my tweets box in the account settings.

Local News on Twitter

If you provide a location in your Twitter profile settings, then following @topix_local will get you tweets about the location.  To stop getting alerts, simply stop following @topix_local.  This needs a city name in your profile settings to be effective so that it picks-up the hashtag (#city).

UPDATE: You won’t get very many Tweets using @topix_local compared to using TweetDeck and creating a column for #City.  But of course, in TweetDeck, you will get everything with the city hashtag, whether it’s news or not.

Where has Google Gone?

Google Realtime Search Goes Missing;

The Google Wonder Wheel Is Gone;

Google Squared and News Timeline disappear;

and the removal of the Google News Archive search page are a mystery.

Getting to Know the Neighbourhood – Tracking Tweets

Google, Bing, & Twitter

Google and Bing Social have indexed tweets since 2009. You may also install greasemonkey and a script to put Twitter results on your Google search results page.

Twitter & RSS

Go to Twitter Search, run a search query, click the “Feed for this query” link next to the orange RSS button, and paste the URL into Google Reader. All tweets  for your search will be stored for you.

The “Advanced Search” allows you to set more specific parameters for your search. You can even specify whether you want to see positive or negative tweets, or tweets that ask a question.


Dan Zarella (@danzarrella) a Social Media expert who works at HubSpot, has launched a tool for those interested in measuring your most retweetable days & times. It is called TweetWhen.

This could be useful in some investigations involving Twitter.

@LocusCommunis on Twitter

You can find me on Twitter as @LocusCommunis. This will include the a lot of links to useful sites that I find as I wade through my daily workload.

Twitter Searching

This Twitter thing has become a necessity to the connected. It is also an evolving search problem for Investigators.

Searching Twitter isn’t as straightforward as I would like. Content disappears in a short time in many search facilities and search results differ depending on which search facility you use.

18 Useful Twitter-related Sites

Here are 18 Twitter-related sites that I have found useful: Continue reading ‘Twitter Searching’