Saving Bozo Eruptions

I normally suggest using the WayBack Machine to preserve Bozo Eruptions, but there is another way to do this. takes a ‘snapshot’ of a webpage that will always be online even if the original page disappears. It saves both text and a graphical copy of the page for better accuracy. Saved pages will have no active elements and no scripts, to guard agianst malware. However, the stored page with all images must be smaller than 50Mb. Pages which violate our hoster’s rules (cracks, porn, etc) may be deleted.

Bear in mind that when you archive a page, your IP is being sent to the the website you archive.

This site also shortens URLs of what you archive much like tinyurl, and do and only supports search by URLs and domains as in the Google or Bing site: command.

A handy bookmarklet button for your toolbar is offered on the site.

Searching Periscope & Meerkat

Periscope, the free iPhone app from Twitter is the clear winner against first-comer Meerkat. Periscope is mobile live streaming that lets the user share what is happening right now and relive it later thanks to the service’s saved streams feature.

At the moment, from the investigator’s perspective, Periscope and Meerkat offer an opportunity to see a lot of useless streaming video if you don’t know how to search effectively. Both are hard to search by keyword or topic–you usually have to search via people.

You can use Getxplore and link your Twitter account to them. This will then allow you to see current Periscope and Meerkat streams and then enter search quires to find the types of streams that you are looking for.

Another option is the Twitter search and programs such as Tweet Deck or Hootsuite which you can setup to constantly pull Periscope and Meerkat streams direct to you dashboard. Simply add #Periscope OR #Meerkat as a search term and now you will have access to every single live-streaming video that is shared to Twitter.

You can refine the search by geography as in  #periscope OR #Meerkat near:”Toronto, Ontario” within:50mi. To further filter results add keywords to make the search even more specific, (#periscope OR #Meerkat) AND (Jays OR Skydome).

Finding Deleted Tweets is a web service that let’s members create a daily newspaper of sorts containing their favorite material that they then sharing it with their followers. Here are some points that the investigator should note:

  • A lot of content of these papers comes from Twitter.
  • These papers are archived.
  • Twitter users sometimes delete Tweets
  • Deleting Tweets on Twitter are not deleted on sites like is a content curation service. A Content Curator is someone who continually finds, groups, organizes and shares the best and most relevant content on a specific issue online. These sites are a good place to find content deleted from the originating social networking site.

If you go to and use their search feature, you won’t find anything unless your search is for the title of a paper. Their search doesn’t look within individual articles.

To find mentions of content from Twitter, or any other content, use the Site: operator. When using this search strategy, search by the Twitter account’s name and the user name (@username) along with any keywords that might apply to what you are looking for.

Finding Bozo Eruptions on Twitter

On Tuesday, 18 Nov 2014, Twitter announced that it has finished indexing every public tweet ever made since the social networking service launched in 2006.

Fortunately for investigators, Twitter does not provide bulk deletion. This means that most people will not take the time to examine their Tweets for Bozo Eruptions. However, batch deletions are possible, by using third-party sites like Tweet Deleter, Tweet Eraser and TwitWipe. If someone deletes some Tweets, Twitter admits that “Deleted tweets sometimes hang out in Twitter search, [but] they will clear with time.” Unfortunately, when a user deletes a tweet, it eventually disappears from Twitter’s search results, as well as from any accounts that follow the account along with any retweets of the deleted tweet.

Fear not intrepid investigator, fore hope and a lot of searching might uncover someone who copied into his own tweet a deleted tweet, which will remain as will any tweets quoted on sites elsewhere.

Propaganda War

Shooting down a passenger jet has exposed some good old-fashioned Soviet-style propaganda. It’s not as good as some of Putin’s efforts, but it’s interesting to watch.

The Wayback Machine has captured some very interesting evidence that Russian-backed terrorists shot down Malaysia Airlines Flight MH17. In a post by Igor Girkin on Vkontakte, Russia’s Facebook clone, the Ukrainian terrorist leader who is also known as Strelkov, claimed his forces downed what he thought was a Ukrainian military transport plane.

The Russian-backed terrorist claims he shot down Malaysia Airlines Flight MH17 was caught by the Wayback Machine and publicized on their Twitter account, @InternetArchive ( See The Christian Science Monitor article that translates the content and provides a timeline of the attempts by the terrorists to hide this and blame the Ukraine government.

Meanwhile over at Wikipedia, the Twitter account @RuGovEdits monitors Wikipedia edits by the Russian government. It reveals Russia’s efforts to shift the blame to the Ukrainian government. Putin’s office and Russian media outlets made multiple edits to the page for the murder of the MH17 passengers to blame the “Ukrainian military”. @RuGovEdits should be trustworthy as the Wiki-twitterbot code is widely available on Github.

Saving Bozo Eruptions for Posterity

During research projects I sometimes come across astounding levels of stupidity posted for all to see. Sometimes this occurs in obscure corners of the interweb, sometimes it’s done on Twitter.

If I think an instance of stupidity might become important in the future, I manually archive the web page or Tweet by submitting it to the Wayback Machine using the Save Page Now option.

This doesn’t work with all sites, but when it works, the “Bozo Eruption” will be available on an authoritative site in the future. There won’t be any question that the eruption occurred if someone has second thoughts and removes it from the site.

Social Search — The Event Horizon

Events create a lot of social media chatter. Within this chatter or noise, the Investigator must find useful data. If the origin of the investigation is an event at a particular location, then searching for chatter that is related to the location may move the investigation forward.

GeoTagging is the process of adding geographical identification metadata to social media messages and other content such as images. Searching by the location usually entails entering the Latitude and Longitude of the location.

Twitter Geotags

Twitter allows users to include geotags with their tweets. Some third-party developers are using this feature. For example, Twellowhood, Twitter Local, and Twitter Nano.

Twitter Nano

Twitter Nano allows me to improve the signal-to-noise ratio when the starting point is an event or situation that I can identify with Latitude and Longitude. This will allow the Investigator to identify the people who have an interest or involvement in the event under investigation.

Of course, this doesn’t work if the user-of-interest hasn’t enabled geotagging. However, those with geotagging enabled often identify others who don’t have it enabled.

How To Hide From Twitter

Lately, I have been working with clients who face serious security threats. Some of these people are surprised by what can be learned about them from internet searches. Removing this information is a challenge, especially from social media sites like Twitter.

Twitter presents an interesting challenge. Once you publish a Tweet, a lot of other websites take your Tweet and reproduce it in a database. Topsy, Snap Bird, the Library of Congress, and many others get in on the act.

Of course, you can delete your Twitter account, but your Tweets will live on in a third party database.

The best solution that I have found is to remove all the Tweets from your account rather than deleting the account itself. When some third party site comes to collect your tweets to update their database, they also overwrite or delete your old Tweets and replace them with nothing matching the empty Twitter profile.

Doing this also prevents some malicious adversary from waiting thirty days then opening a new account using your deleted Twitter account name. Of course, keeping the account also allows you to start using it for some subtle disinformation.

If your Twitter account has thousands of Tweets like mine does, then you need an automated deletion service.

Twit Wipe fits the bill. Provide the service with your Twitter password and set it lose. Once Twit Wipe has done its job, change the Twitter password.

After thirty days, you should start searching for the deleted Tweets to identify any sites that still have them. If they still exist on some sites after sixty days, then consider requesting their removal.

Snap Bird

If you want to see all the Tweets from a particular Twitter account, then you are out of luck if you don’t know about Snap Bird. Twitter allows you to only search or see about a week’s worth of Tweets.

Snap Bird allows you to survey all the Tweets for a particular user if you select “Someone’s timeline” as the type of search.

This is extremely useful when trying to assess the nature of the person behind the Twitter account. Sometimes, you will find that the account is really just a bot that retweets what it finds. Sometimes, you find the account is owned by somebody with an axe to grind. Sometimes, you find the person behind the account is an activist of some type. You learn these things from reviewing all the tweets to see the general theme of the account.

The point is, you won’t know what you’re dealing with unless you can see all the Tweets coming from that account and Snap Bird allows you to do that.


Getting to Know the Neighbourhood — Twitter Via RSS

To monitor someone’s Tweets, but not actually publicly follow the Twitter account, use Twitter to RSS. This service allows you to enter the name of a public Twitter account and create an RSS feed for popular RSS readers like Google Reader.

This won’t work if the account owner selected the Protect my tweets box in the account settings.

Local News on Twitter

If you provide a location in your Twitter profile settings, then following @topix_local will get you tweets about the location.  To stop getting alerts, simply stop following @topix_local.  This needs a city name in your profile settings to be effective so that it picks-up the hashtag (#city).

UPDATE: You won’t get very many Tweets using @topix_local compared to using TweetDeck and creating a column for #City.  But of course, in TweetDeck, you will get everything with the city hashtag, whether it’s news or not.

Getting to Know the Neighbourhood – Tracking Tweets

Google, Bing, & Twitter

Google and Bing Social have indexed tweets since 2009. You may also install greasemonkey and a script to put Twitter results on your Google search results page.

Twitter & RSS

Go to Twitter Search, run a search query, click the “Feed for this query” link next to the orange RSS button, and paste the URL into Google Reader. All tweets  for your search will be stored for you.

The “Advanced Search” allows you to set more specific parameters for your search. You can even specify whether you want to see positive or negative tweets, or tweets that ask a question.