WEBVTT 00:00.960 --> 00:05.280 In this video, we're going to take a look at a Twitter mind map, and you could download this in the 00:05.280 --> 00:06.440 resource section. 00:07.280 --> 00:11.760 Now technically it's not Twitter anymore, it's X now. 00:12.240 --> 00:19.320 However, I've been using this for a long time, um, before it got taken over and had the name change, 00:19.320 --> 00:22.080 so I'm just used to that now. 00:22.120 --> 00:23.520 Mind maps are great. 00:23.520 --> 00:30.080 I love using mind maps not only to kind of illustrate different points, but also I tend to use mind 00:30.080 --> 00:38.240 maps when I'm working on something particularly complex, or there's a lot of steps to it. 00:38.240 --> 00:45.840 Things like if I'm investigating a phishing email, spear phishing email, and I'm tracking down who 00:45.840 --> 00:52.560 it is, what's going on, what the payload is, etc., etc. I might use a mind map to kind of map that 00:52.560 --> 00:53.000 out. 00:53.600 --> 00:55.280 So let's take a look at this one. 00:55.520 --> 01:00.720 And mind maps are great for again kind of mapping things out. 01:01.560 --> 01:04.600 And this particular one for Twitter or X. 01:06.420 --> 01:07.380 since. 01:07.620 --> 01:16.100 Well, unfortunately, since it got taken over, they really killed a lot of useful features in it that 01:16.100 --> 01:24.300 allow open source intelligence investigators to actually investigate things, and also for doing metrics 01:24.300 --> 01:25.060 and whatnot. 01:26.460 --> 01:30.300 That's why it's important to fall back onto the basics. 01:30.300 --> 01:32.180 So let's take a look at this. 01:32.700 --> 01:39.020 So if we're doing an investigation on on Twitter X first we have the username. 01:40.220 --> 01:43.820 Wherever you're starting from you're always going to have be able to get the username. 01:44.180 --> 01:47.620 Now from here we could take a look at when did they join. 01:48.340 --> 01:50.740 Was it creation around a significant event. 01:52.420 --> 02:01.100 Likes who brought her look at into the individual by looking at what they clicked is like what they 02:01.100 --> 02:02.060 replied to. 02:02.100 --> 02:04.380 Again, a broader look into the individual. 02:04.540 --> 02:07.700 That or individuals that are running the account. 02:07.740 --> 02:08.740 Twitter handle. 02:09.200 --> 02:13.200 Do a search for that particular handle and see if it comes up anywhere else. 02:13.600 --> 02:16.800 This is a parody or a similar name to someone else. 02:18.880 --> 02:20.000 Who are they following? 02:20.360 --> 02:21.720 Well, let's go up here actually. 02:22.600 --> 02:23.600 Twitter posts. 02:24.120 --> 02:26.280 So comments from the comments. 02:26.280 --> 02:29.160 Who's commenting on their posts with their usernames? 02:29.160 --> 02:30.720 What are their Twitter pages? 02:32.120 --> 02:32.920 What do they like? 02:32.920 --> 02:34.120 Comment, retweets? 02:34.120 --> 02:35.960 Media following followers? 02:36.360 --> 02:44.760 Basically, we take the same same steps that we're taking with the main account and looking at the people 02:44.760 --> 02:49.200 that are commenting or liking the post from this individual. 02:49.840 --> 02:51.560 Take a look at the retweets again. 02:52.720 --> 02:53.760 Who are they retweeting? 02:53.760 --> 02:54.480 What do they like? 02:54.520 --> 02:55.960 What were they doing? 02:56.800 --> 03:03.200 Does any of that, um, post or repost tie back to the person we're investigating? 03:04.000 --> 03:07.560 And we do the same thing with who they're following, who's following them. 03:07.920 --> 03:09.440 And we get to the media. 03:09.440 --> 03:11.320 So what type of media are they posting? 03:11.360 --> 03:12.560 Is there any metadata? 03:12.660 --> 03:14.820 Probably not, because it gets scrubbed. 03:15.780 --> 03:17.380 Is there a possible geolocation? 03:17.380 --> 03:21.220 We can take a look at the photo and try to determine where the location is. 03:21.500 --> 03:24.980 What is the content within that photo or that video? 03:25.820 --> 03:27.940 What's the possible context behind it? 03:27.980 --> 03:31.900 Was there any sort of manipulation, photo or video wise? 03:32.180 --> 03:33.820 Is it a bot account? 03:34.140 --> 03:37.740 Take a look at, uh, how it's posting. 03:37.740 --> 03:44.420 Potentially put it in some like bot or not or other programs to try to determine if it's a bot. 03:44.660 --> 03:46.900 Take a look at how it's how it's speaking. 03:46.900 --> 03:55.940 Is it, uh, AI generated, uh, text that is, uh, producing and are there any archived or modified 03:55.940 --> 03:56.380 posts? 03:56.380 --> 03:57.540 Did they edit the post? 03:57.540 --> 04:00.580 And can you find any things like Internet Archive? 04:01.020 --> 04:09.340 These are different ways in kind of a kind of a walk through of investigating Twitter or X accounts 04:09.340 --> 04:10.660 and posts. 04:11.380 --> 04:14.860 And again, this is available for download in the resource section. 04:14.940 --> 04:17.500 Thank you so much for watching, and I'll see you in the next video.