OSINT Toolbox Talk: Streamline your OSINT activity, visualise Twitter activity and extract Instagram content

OSINT Workflow

Extracting video content from Facebook

Before we begin, this article is designed to raise your confidence in using ‘Developer Tools’ to isolate and extract Facebook video content. As the article will point out, these manual processes are not perfect, but they will instil confidence in your capability to learn how to use ‘Developer Tools’ for OSINT purposes. If you are looking for an easy solution to download public and private videos from Facebook, we recommend that you download and install the ‘FB Down’ Google Chrome extension (https://chrome.google.com/webstore/detail/video-downloader-plus/njgehaondchbmjmajphnhlojfnbfokng).

… If you are looking to potentially learn some techniques with regards to the manual extraction of Facebook videos, then please read on.

Before we jump right in, I am obliged to point out that accounts used for scraping are not allowed without Facebook’s permission, and can therefore be locked by Facebook anti-scraping mechanisms. Also note, the use of Sock Puppets on social media platforms and within official settings (Law Enforcement / Government / Military) is often strictly regulated by legislation. Investigators should direct their attention to their national legislation before undertaking any activities on social media. The information in this article is for information / educational / research purposes only and should not be interpreted in any other way.

Extracting media content from Facebook manually can be a difficult challenge – especially with regards to high-quality videos. In this demonstration, we will extract a video from the Number 10 Downing Street Facebook page featuring UK Prime Minister Boris Johnson speaking outside of my old workplace – the Permanent Joint Headquarters in Northwood.

First, open the target video in a new tab so that it can be viewed within a layout similar to the animated GIF file below.

A quick and easy way to download this Facebook video is by forcing the browser window to access it in Facebook’s Mobile-Basic (mbasic) mode. To do this, all you need to do is replace the video URL from ‘https://www.facebook.com/7303343452/videos/909702339631972’ to ‘https://mbasic.facebook.com/7303343452/videos/909702339631972’. By doing so, we are requesting the basic mobile page for this video. When we click on the video to view it, we can now download the video as an MP4 file.

Download Facebook video using the MBASIC mode

One issue we immediately notice from using this methodology is that the video is of very low quality. In most cases, this is not ideal for the investigator. Because of this, we must now look at another method to extract a high-quality video. This next method requires us to use ‘Developer Tools’ within our browser, preferably Google Chrome, to isolate a high-quality video. However, this next method is also far from perfect due to Facebook’s method of compressing media files. Their method of compression involves separating audio from video files, resulting in one video file (without sound) and one audio file containing the video audio. These two files are then compressed and executed simultaneously when a video is played. This means that if we use this next method of isolating and extracting a video from Facebook, we must download the video file and audio file, then use a video editor to connect them together.

So, let’s give this next method a go so we can see.

With our target video open in our browser, we should open Developer Tools by clicking F12 on our keyboard. With Developer Tools now open, click on the ‘Network’ tab and then play the video as you normally would in the same browser window. Looking at the Network window in Developer Tools, we can see several items appearing every few seconds as the video is playing. At this point, you should now pause the video in your browser and then inspect the items listed in the Network window by hovering your mouse cursor over each. What we are looking for are items that contain a long sequence of numbers that are separated by an underscore, within that sequence of numbers you should also see the filetype.

Download Facebook video using 'Developer Tools'

As we discussed a little earlier, Facebook’s method of compression separates audio from video files, resulting in two separate files, one audio and one video. In most cases, both the video and audio files are in a ‘.mp4’ file. However, in other cases, and as shown in our example, the video file is contained in a ‘.webm’ file and the audio is contained in a ‘.mp4’ file.

We will now look to extract the video file. On one of the items which contain our number sequence and ‘.webm’ filetype, we should right-click on our mouse, hover over ‘Copy’ and select ‘Copy link address’.

Download Facebook video using 'Developer Tools'

With our URL copied, we now need to use a text editor such as Microsoft’s native ‘Notepad’. For the more proficient coders, I would recommend using Sublime Text. In our text editor, paste the copied link and remove ‘&bytestart=3684046&byteend=386276’ from the end of the URL. This should result in a URL similar to ‘https://video-cph2-1.xx.fbcdn.net/v/t39.25447-2/10000000_220361133383058_4261019864984314508_n.webm?_nc_cat=108&ccb=1-5&_nc_sid=5aebc0&efg=eyJ2ZW5jb2RlX3RhZyI6ImRhc2hfdnA5XzVzZWNnb3BfbWlucmVzX2hhbG9fMTUwMGtfZnJhZ18yX3ZpZGVvIn0%3D&_nc_ohc=Np9826PONFUAX9Oxduk&_nc_ht=video-cph2-1.xx&oh=3bf0c8eddfa87a0b8a90d9725875cc30&oe=6130112C’.

You should now copy this URL and paste it into a new tab on your browser. This will open up the video in a high-quality format. From here, we can now right-click on the video and select ‘Save video as..’.

Download Facebook video using 'Developer Tools'

With our video now saved, we can now repeat the process to find the associated audio file, isolate it and save it. In our example, this is relatively easy as all we need to look for in the Network window is for a similar long sequence of numbers with the filetype ‘.mp4’. All we need to do is follow the same process as we did for the video file, then use a video editor to bind both of the files together.

However, returning to the issue of separate audio and video files, this process can be somewhat tricky when the video and the audio files are both in ‘.mp4’ format. In this situation, it is a matter of guesswork as you would need to use the same process described above to discover the video and audio files.

This solution is most certainly not perfect – as explained at the start of this article. However, this has taken you through the motions of using the ‘mbasic’ and ‘Developer Tools’ process to isolate and extract media from Facebook – giving you more confidence to look beyond the front end of the social media platform.

Let's talk today Are you ready to begin discussing our range of training and capability development solutions?