Analysis and Retrieval of Digital Forensic Evidence on the X Social Media Application Using the Static Forensic Method

Abstract

This study discusses the application of static digital forensic methods to analyze evidence of cybercrime on the social media platform X. The research is based on a simulated case involving violations of Indonesia’s Electronic Information and Transactions Law (UU ITE), specifically concerning the distribution of pornographic content, hate speech, cyberbullying, and the spread of hoax X. The investigation was conducted by seizing the suspect’s devices, including a laptop and a 15GB flash drive, which were then xamined using FTK Imager and Autopsy forensic tools. The acquisition process was carried out using FTK Imager to create a digital image while maintaining data integrity through MD5 and SHA-1 hash verification. The subsequent analysis was conducted using Autopsy to identify hidden files, deleted files, file system structures, and relevant metadata. The investigation uncovered various types of digital evidence such as illicit images, social media activity logs, SQLite database files, email artifacts, and user activity data directly linked to the suspect’s X  account. The findings indicate that static forensic methods are effective in preserving original data during investigation. Furthermore, the forensic tools used in this study proved capable of systematically identifying, extracting, and processing digital evidence accurately. This research contributes to the field of cybercrime law enforcement, particularly in supporting the process of proving digital-based crimes committed through social media platforms.