Pages

Tuesday, 30 July 2013

How to trap tweets in a hurry

Disclaimer: I don't know if any of these methods are forensic enough to be considered evidence in a police investigation or court situation, I am not a lawyer but presumably you'd be able to affirm that they're genuine under 'oath'. I generally capture tweets during or after fun things like conferences, to embed them in blogs, however the techniques below are a bit less fun (eg if someone is being abusive or evasive) so... please be careful about how you use them!

Notes
URL = a web address, typically beginning with http:// or www...
This post assumes you're visiting http://twitter.com as opposed to third party apps (plenty you can do with those too).

For most of these techniques you don't actually need a Twitter account to do them, however for the bits where you do need one you can easily create a new account if you don't want to use your own.  

If the person from whom you wish to capture tweets has blocked you should still be able to view their tweets (though you can't favourite or retweet them), also they may not show up in a search when you're logged in.

Note that blocking someone does not stop them from seeing your tweets. At all.

Echofon on iPhone currently lets you view the profile of someone who's blocked you though that may change.

Table of contents
1. A useful general thing - how to exploit Google's cache
2. Using screenshots
3. Tools like Storify / Chirpstory
4. Embed the tweet in a blog before it's deleted
5. Freezepage
6. Email the tweet to yourself
7. Favstar
8. Political tweets
9. Finding difficult-to-find or deleted tweets
10. Miscellaneous

1. A useful general thing - how to exploit Google's cache
Note: you don't need a Twitter account to do this.

Search for the person's twitter handle, in the results there'll be a little downward pointing green arrow, click on that then click on 'Cached', that's the link to use. See pic below.
















What you'll end up with is unlikely to be particularly visually appealing - it's just the tweets without the nice layout, but - depending on the time - you may be able to see the tweet you're after if it's been deleted already - however you'll need to do something with it, it is not permanent.

If the person deletes all their tweets and publishes a fresh one then Google will re-index their page and the cache of tweets-of-interest may disappear. If you find a cache of tweets you'd need to take a screenshot (2) or use Freezepage (4).

2. Take a screenshot
Note: you don't need a Twitter account to do this.

Useful comment from skeptools (see below) is to make sure you grab the URL in the screenshot too (you may additionally want to capture it as text as well). If you don't want to include your other tabs or bookmarks you can open the tab in a fresh window and use the view menu to hide or display stuff.

Screenshots on PCs - Prt Scr for whole screen, Alt+Prt Scr for just the active window
This is unlikely to be suitable forensically as it can easily be altered, but click the Prt Scr (Print Screen) button on your keyboard. This silently copies the content of the screen to your clipboard - it doesn't actually 'print' anything, if you open a programme like Word (or Paint, where you can amend or tidy up the image) you can paste it and save a copy. If you only want to capture a browser window rather than your entire desktop, hold down the Alt key then Prt Scr.

Screenshots on Macs
Note 'Command' = the ⌘ key
Command-Shift-3 Capture the entire screen to a file
Command-Shift-Control-3 Capture the screen to the Clipboard
Command-Shift-4 Capture a selection to a file
Command-Shift-Control-4 Capture a selection to the Clipboard
Source: http://support.apple.com/kb/ht1343

Screenshots on iPhones
Press the on/off button (at the top right) and the 'home screen' button at the bottom. This will copy whatever's on your screen to your camera roll. 

3. Storify (or Chirpstory)
Note: you don't need a Twitter account to do this on Storify (you can use Facebook) but you do for Chirpstory.

Once captured a tweet will persist even if it's subsequently deleted from Twitter (proof). Chirpstory is great for grabbing a bunch of tweets (50 at a time) from a user, or a hashtag. Storify lets you grab 20 at one go.

If you are grabbing individual tweets from different users you can do that too - might want to use the LINK tool on Storify to save the tweet by its own address (you can get that from Twitter, either on the timestamp or Expand link) rather than keeping searching for individuals. You can also use Storify's search for tweets sent to a person and capture a full conversation - tweets taken out of conversational context can give a misleading impression.

Don't forget that you don't have to publish the Storify to trap tweets in this way. You can just save it / them as a draft story. Storify has a tendency to email people whose tweets have been incorporated into a story (this only happens if the person has used Storify themselves though, and has signed up to receive these messages) so worth being aware of.  Obviously if you don't publish it no-one else will be able to see it until you do.

4. Embed the tweet in a blog before it's deleted
Note: you don't need a Twitter account to do this 

I've found WordPress.com to be better than Blogger for the way it presents embedded tweets.

In Wordpress you can usually just take the URL of the tweet (on Twitter.com you can get it from the time or datestamp which is next to the tweet-sender's name) and paste it directly into the Visual editing window. In Blogger you need to change to the HTML editing window and then paste in the embed code (it won't work in Compose view).

To get the embed code hover over a tweet and notice that the pale grey text in the bottom right goes darker. Click on More then click on Embed Tweet [see (6) for more on using the Email tweet option], copy the 'blockquote' text that appears and paste it into the editing window.

If the tweet is later deleted, or the person makes their profile private, your embedded version will remain, however people will obviously no longer be able to interact with it by clicking through and seeing the tweet on Twitter (because it's not there), nor can they reply to it or favourite it even if they're logged in to Twitter while visiting your blog.

More info on embedding tweets from Twitter's support.
Detailed info from Twitter's developers on embedding tweets.

Note, if your blog contains any material that may be under someone else's copyright then it can be taken down very quickly by a DMCA takedown notice (generally this happens along the lines of 'disable blog first, ask questions later), so if you need to keep that material make sure you back up your blog.

5. Freezepage
Note: you don't need a Twitter account to do this.

Freezepage will let you permanently capture an individual tweet (using its URL) or one page of a user's most recent tweets. In either case it's essential to use the http:// and NOT the https:// version otherwise it won't work.

One 'frozen' this will maintain a copy of tweets that are subsequently deleted or made private.

If the tweets are already deleted and you only have a cached copy (see 1) then you can freeze a copy of the cache (and it should actually reformat it so that it looks quite Twitter-like, the cache itself is usually a bit of a mess as the Twitter styles aren't applied to the page).

I tend not to delete my tweets so it should be possible to click through (hover over various tweets) and see them in original context. Example of one of my tweets | example of a page of my tweets | a page of my cached tweets (from July 2013, via Google).

Note that if you have a free Freezepage account and don't log in regularly your page will be removed - either log in regularly if you really need to keep it, or you'll have to pay to use the service (or Google for alternatives).

6. Email the tweet to yourself
Note: you will need a Twitter account to do this (unless you copy and paste tweet into a message!)


On the website version (twitter.com) hover over the tweet to bring up the extra options, choose More... and then select 'Share via email'. You can send the tweet to yourself (or anyone else provided they've not blocked this option). If you don't have a Twitter account you can only see the Embed tweet option.

On Echofon for iPhone, click on any tweet, then select the More option and 'Mail this tweet'.

Twilert is a free service (enhanced version is paid) which will send you an emailed 'alert' with tweets from a person or that contain a particular hashtag.

Peter English also points out (in the comments below) that you can have someone's tweets sent to you by text message. I suspect this will cost you money so check with your phone provider. I've not tried this one but I think you have to activate it on Twitter.com in your settings - ie you will need a Twitter account yourself.

7. Favstar
Note: you don't need a Twitter account to do this.

Favstar.fm is a tool that automatically captures tweets that have been favourited or retweeted. It seems to do it for pretty much everyone as far as I can tell. Apparently a tweet sent publicly which has been RTed or favourited will remain on Favstar.fm even after the person makes their account private. I don't know if it will remain if the tweet's been deleted though. It's definitely worth a look

8. Political tweets
Note: you don't need a Twitter account to do this.

As skeptools says in a comment below http://www.politwoops.com/countries keeps an eye on all deleted tweets by politicians around the world. Here's the UK version http://www.politwoops.co.uk/ 

9. Can't find the tweet you're after?
Note: you don't need a Twitter account to do this.

If you can remember what was in the tweet you can search for words (and you can also search for a whole or partial URL, eg searching for brodiesnotes shows tweets linking to this blog, you don't need the full URL). Even if the original tweet has been deleted someone may have manually retweeted it.

Note that manual RTs can be altered so it's probably not forensically reliable in which case responses to original tweets may be corroborating evidence. To find tweets sent to someone just search for the @name, eg you can see tweets sent to (and from!) me).

Favstar.fm (see (7)) is also useful for uncovering some tweets. Google cache (see (1)) may help but equally it might not - it's very dependent on timing.

Older tweets may have been picked up by various archiving tools such as section 4 in this page on Finding things that aren't there any more on the internet, and storing things that are.

Archiving sites
http://archive.org/web/web.php
http://archive-org.com/

10. Miscellaneous
Note: you don't need a Twitter account to do this.

There's also a free screen recorder bundled into Mac (OX 10 and above I think) that would record a video of your screen with tweets on it, for no other reason than it's less tamperable-with than a screenshot. You can also 'save page as html' in most browsers but I don't think this is particularly reliable.

If you know of other tools let me know and I'll add them:
@JoBrodie
jo. brodie at gmail. com



6 comments:

  1. One thing I would add is to always make sure you capture the URL where you saw the tweets in some fashion, depending on the method. For instance, when I take a screen shot of Tweets I always include the URL bar in the screen shot, showing where my browser was at the time. It doesn't eliminate, but at least it helps address accusations that you somehow mocked up the captured tweet.

    ReplyDelete
  2. Oh, another note - if the deleted Tweet was sent by a politician of some stripe, chances are it is already being tracked by a piece of software called politiwoops. Check out http://www.politwoops.com/countries for a list of countries covered.

    ReplyDelete
    Replies
    1. Goodness, I had never heard of this! Thanks.

      Delete
  3. You can also choose to have all of somebody's tweets (prospectively - not retrospectively) sent to you as text messages.

    ReplyDelete
    Replies
    1. That's in the settings bit of Twitter isn't it - you have to add your mobile phone number... never done it myself but interesting to know it's doable, ta. I also discovered that Favstar.fm will automatically start noticing any tweet that's favourited or retweeted and even if the account is subsequently locked it still has the information.

      Delete

Comment policy: I enthusiastically welcome corrections and I entertain polite disagreement ;) Because of the nature of this blog it attracts a LOT - 5 a day at the moment - of spam comments (I write about spam practices,misleading marketing and unevidenced quackery) and so I'm more likely to post a pasted version of your comment, removing any hyperlinks.

Comments written in ALL CAPS LOCK will be deleted and I won't publish any pro-homeopathy comments, that ship has sailed I'm afraid (it's nonsense).