Facebook Cache

Overview

Evidence: Facebook Cache Description: Collect Facebook Store Application Cache Category: Applications Platform: windows Short Name: fcbkc Is Parsed: No Sent to Investigation Hub: No Collect File(s): Yes

Background

Facebook app caches images including profile pictures, shared photos, and media from the news feed and messages. These cached images are stored in the OSMeta image_cache directories.

Data Collected

This collector gathers structured data about facebook cache.

Collection Method

This collector gathers Facebook image cache directories from the app package LocalState containing cached visual content.

Forensic Value

Facebook cache contains images from conversations, posts, and profiles. This helps recover visual evidence, identify contacts through profile pictures, and understand viewed content.