Evidence: Facebook Cache
Description: Collect Facebook Store Application Cache
Category: Applications
Platform: windows
Short Name: fcbkc
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Facebook app caches images including profile pictures, shared photos, and media from the news feed and messages. These cached images are stored in the OSMeta image_cache directories.
Data Collected
This collector gathers structured data about facebook cache.
Collection Method
This collector gathers Facebook image cache directories from the app package LocalState containing cached visual content.
Forensic Value
Facebook cache contains images from conversations, posts, and profiles. This helps recover visual evidence, identify contacts through profile pictures, and understand viewed content.
