Learn search techniques, how to conduct in-depth profile analysis and other strategies to reveal insights on Facebook.

Social media platforms are considered a gold mine of information for OSINT researchers. While some platforms are more focused on specific types of content, such as Instagram for photos and TikTok for videos, other platforms, such as Facebook, publish all types of content, including text posts, photos, videos, and live streams, in addition to user check-ins or geographical information.

This article will focus on gathering OSINT data from a major social media platform, Facebook. We will explore various methods and tools OSINT researchers can employ to extract meaningful data from Facebook. It is worth noting that I have already covered how to utilize OSINT techniques and tools to search within popular platforms, such as Mastodon, Reddit, X, Instagram and Discord. Those guides were a part of our social media intelligence (SOCMINT) guides. SOCMINT is a subtype of OSINT that is concerned with gathering intelligence from social media platforms. However, before beginning our OSINT journey on Facebook, let us first briefly introduce Facebook's history and discuss how to navigate its interface.

Facebook background information

Facebook, now under Meta Platforms, Inc., which includes WhatsApp, Instagram, Messenger and Oculus, was launched in 2004 by Mark Zuckerberg and his college roommates. The platform is considered the largest social media platform globally, with more than 3.07 billion monthly active users worldwide as of September 2024 (see Figure 1). The large user base and the diverse global societies that use Facebook services have made it a crucial source for gathering intelligence across various fields, including law enforcement, military, intelligence, marketing and academic research.

Chart of most used social media platforms worldwide 
Figure 1 - Most used social media platform worldwide, Facebook is still the first one. Source: https://backlinko.com/facebook-users

Facebook's diverse features, such as users' personal profiles, business pages, groups and events appeal to OSINT investigators and provide multiple avenues for them to collect valuable information. Facebook’s users range in age, belonging to both the older generations and Generation Z, unlike some platforms like TikTok, where most of the users are younger.

Searching within Facebook is challenging for OSINT researchers due to the complex privacy settings and frequent policy and search changes by Meta. This underscores the urgency and importance of staying updated on the latest OSINT techniques specific to Facebook, as it is crucial for effective data collection.

Understanding Facebook structure

The foundation of Facebook's social media network is composed of the following four features:

  1. Profiles
  2. Pages
  3. Groups
  4. Events

The focus of this guide will be discussing how to inspect Facebook individual's profiles.

Facebook profiles

Any user can register for a Facebook account as long as they meet Facebook's age requirements (13+ years in most countries) and agree to the platform's terms of service. These personal profiles allow users to interact with other Facebook users, share content such as videos, images and check-ins, and post status updates. Users can post stories (not status messages) that disappear after 24 hours, while regular status updates remain on the profile until deleted by the user.

To open a Facebook account, you must provide your real name and an email address or phone number. Your birthday and gender are also required. Although users can give fake names, this is against Facebook's official usage policy; verifying users using government documents has not been strictly enforced until now.

Users can engage with other people's content published on Facebook through:

  • Reactions - Like, Love, Care, Haha, Wow, Sad and Angry
  • Comments - Text, GIFs, images, stickers, or even short video replies
  • Shares - Reposting content of other Facebook users to their timelines, groups or via private messages
  • Save - Bookmarking posts for later view
  • Follow - Receiving updates from users without being friends

Inspecting Facebook user's profiles

Personal Facebook profiles provide a rich source of information for OSINT researchers. Even when Facebook users are unwilling to share much information about themselves, the Facebook networking features, which allow interaction with different entities (pages, groups, and other users), can still reveal much information about the user.

OSINT gatherers can collect the following information by inspecting Facebook user's profiles:

Basic information - Includes Facebook username, personal name, gender, birthday, hometown, and geographic location. Seeing this information depends on the user's current privacy settings. However, it is common for Facebook users to display such information publicly, making it easy to track their demographic and geographical background (see Figure 2).

intro section of a Facebook profile 
Figure 2 - The Intro section of the Facebook profile may show important information about the user, such as account creation date, hometown, current location and employer

Employment and education - This includes Job titles, companies had worked and working for them now and schools attended. Most users share such information, which helps OSINT reveal work history and educational background.

Relationship insights – This includes:

  • Friends list: If a user privacy setting allows showing a friends list, then it can reveal social connections and networks, which helps map relationships or identify associates (see Figure 3)
friends list of a Facebook user 
Figure 3 - Checking the list of Friends of a Facebook user
  • Family details: Some users list family members and marital status, providing clues about their personal relationships and extended networks. If this information is not shared directly, checking posted photos, videos and tags can reveal such relationships (see Figure 4)
Example of Facebook profile features revealing family relationship details 
Figure 4 - Tags in photos, videos and text posts can reveal family relationships

Behavior and interests – This includes:

  • Posts and status updates: Facebook users often post about their daily lives, political views, hobbies (sports, music, nature) and interests. This gives insight into target users' behavior, daily routines and thinking. We can also check the other pages in the target profile, such as: Sports, Music, Movies, TV shows, Books, Apps and Games, Likes, Events and Reviews given (see Figure 5). All these pages reveal much information about the target profile's personality and interests. For example, analyzing target user preferences in music, books and movies can reveal their cultural tastes, political views or religious beliefs
Top links of a Facebook profile shows user's interests and hobbies 
Figure 5 - Check the top links in the target Facebook profile page to access more information about user interests and hobbies
  • Liked pages and groups: Pages and groups followed by a Facebook user can reveal ideological thinking, brand affiliations or memberships in specific communities (e.g., local social groups, professional societies, etc.)
  • Check-ins and locations: Location-tagged posts or check-ins can map a person's geographical movements, such as revealing travel habits or frequented places (see Figure 6)
Check-ins feature on Facebook profile 
Figure 6 - Check-ins reveal important information about the target user's previous locations and the date when they visited them

Multimedia content - This includes:

  • Photos and videos: These include images shared publicly, which can provide details about a user's physical appearance, possessions (watches, cars, house), locations visited or social circles (friends and family). OSINT researchers can also exploit metadata (such as timestamps and geotags) embedded in media files for more info
  • Profile and cover photos: When a user makes their profile private, they usually leave the profile and cover pictures public and can be visually inspected.

Practical techniques for inspecting Facebook profiles

Before beginning to show how to use OSINT techniques to inspect Facebook profiles, let us first explain how to retrieve any Facebook user ID.

Facebook ID

Facebook sets a unique ID for each user profile, page or group. This ID is a unique numerical identifier assigned to each Facebook account. It is used to track and identify individual users within the Facebook platform.

To retrieve a Facebook user ID, you can use the following services, all you need to do is copy the URL of accessing the target Facebook user/page/group page:

Facebook ID can feed into other OSINT tools to automate some areas of investigation.

Facebook username and display name

Each Facebook profile should have a username and a display name. The username is unique and is used to distinguish a user across the Facebook platform. The username is also known as the Facebook handle.

After accessing the target Facebook profile page, the username is found in the page URL. Username is case-insensitive; hence, username is similar to userName. For example, https://www.facebook.com/thunder.weaver.5 The last part of the URL "thunder.weaver.5" is the username part.

Display names can be anything the user chooses; they commonly point to the Facebook user's actual name. The display name is the one shown on user posts and comments and it is next to the profile photo (see Figure 7).

Facebook profile username and display name 
Figure 7 - Facebook username and display name

Many social media users choose to use the same Username and Display Name on different platforms, such as Facebook, X, Reddit and Mastodon.

There are online services that reverse-search usernames, allowing OSINT gatherers to find all other social media websites where the same username is used.

We can also search for a target Facebook Display Name to see where it appears online using Google dorks. Here are five search queries:

  • "Display name" | This query will search for the exact phrase or display name
  • "Display Name" site:facebook.com OR site:x.com OR site:instagram.com | Search for display name on three social media platforms
  • "Display Name" filetype:pdf OR filetype:doc OR filetype:docx | Search for display name within documents (PDF, DOC, DOCX)
  • "Display Name" site:reddit.com OR site:quora.com OR site:forums.example.com | This query searches for display name on popular discussion forums
  • "Display Name" blog OR article | This query searches for blog posts and articles that mention the specified display name (see Figure 8)
Google dork example to search for articles and blogs written by a specific name 
Figure 8 - Search for articles and blogs written by a specific name using Google dorks

Facebook cover photo and profile picture

Two photos are linked to each Facebook profile: the cover photo, which appears at the top of the profile page and the profile photo, which appears on user posts and comments. Valuable information can be acquired by inspecting these pictures. Here are some techniques:

Visual analysis

The first thing we need to do is visually analyze the profile pictures. They may reveal information about the user's personal preferences, interests, hobbies, lifestyle or current location by checking any landmarks or geographical features in the photos. Some users may make their Facebook profile locked. Hence, we cannot click the profile image or cover photo to display the large size. In that case, we can use enlargement services to enlarge the picture and make its details clearer. Here are some free online image enlargement services:

Emotional analysis

For personal photos, we can conduct an emotional analysis to determine the user's emotional status when they took the picture. Here are some tools for executing emotional analysis on a picture containing a human face.

  • FaceReader – A professional software for automatic facial expression recognition and analysis (see Figure 9)
Facereader tool 
Figure 9 - Using the FaceReader to detect human emotion status from their facial images
  • Morphcast – Require email registration to receive a license key
Images and video metadata

Digital files, such as photos and videos, contain metadata. Metadata is data about data and it provides important information about the file. For example, image metadata may contain the GPS coordinates showing where the image was captured, the capturing device type (smartphone or camera model), the date and time when the photo was captured and other technical information like shutter speed and ISO settings.

Unfortunately, Facebook removes EXIF metadata from uploaded media content for privacy reasons. This practice helps protect users' sensitive information buried within digital media files, such as geographical location data, from being unintentionally revealed. However, you may prefer to inspect images and videos found on Facebook for any remaining metadata. In that case, you can use the following tools (Please note that these tools can only reveal metadata that Facebook has not stripped away):

Reverse image search

Facebook profiles and cover images should be reverse-searched to see where they appear online. We should also reverse search any image on the target Facebook feed or included in their comments. Here are some search engines for conducting reverse image searches:

If you prefer using an extension for reverse image search, you can use "Search by Image" Chrome extension. It allows you to conduct a reverse image search across different platforms.

Facebook user bio

A Facebook user bio contains important information for OSINT gatherers. Aside from their names, education and the company they work for, a Facebook user bio may include a user's contact information, such as phone numbers and email addresses, in addition to links to other social media profiles, blogs or personal websites.

For each piece of information in a user bio, we should execute specific OSINT searches:

Contact information investigation

This includes searching for target phone numbers and email addresses

Reverse phone lookup services

There are many online services that allow us to find the caller's name by reverse-searching their phone number. Here are some online services:
 

WhatsApp/Telegram/Signal presence

Some online services allow us to receive user ID or their name from popular internet chat messaging applications, such as Telegram and WhatsApp, by providing their phone numbers:

  • Callmebot - Get Telegram ID from phone number

If we have the target username (for example, we can start by using the same Facebook username), we can use the Telegram global search function found in the top-right corner of the Telegram App (see Figure 10)

Telegram global search function in the Telegram app 
Figure 10 - Search for a Telegram username

To identify if the target Facebook user's phone number is registered on WhatsApp, you can try the following method:

Add the number to your phone's contact list. WhatsApp uses the WhatsApp contact list and the native contact list stored on your mobile phone to identify registered WhatsApp users.

Public directories and databases

There are several public directories and databases where you can search for information associated with a phone number:

  • Whitepages - Find people and contact info (email address, phone numbers and mailing addresses)
  • TruePeopleSearch – A free people search service. With updated records on nearly every single adult living in the US

To find links to white pages websites worldwide, check WHITEPAGES.FR

Email addresses

When having a target email address, we should utilize the following online services to find any information related to it: 

Email verification tools

Verify if the email is correct and functioning:

  • Hunter – Validate email addresses and identify related domain names.
  • EmailChecker – Email verifier and checker
  • Verifalia -  Free email address validator

Data breach databases

We should search within data breach repositories to see if the target Facebook email address appears in previously breached websites. These databases can reveal compromised credentials and associated accounts (such as accounts on other platforms with the same email address) and may display exposed personal information.

Here are some search engines for breached websites:

Domain registration records

If a Facebook user's bio includes one or more websites, we should investigate these domains. This investigation should include:

  • WHOIS Lookup.
  • Domain History
  • Associated IP Addresses
  • Website Content Analysis
  • Linked Websites

I have already created a dedicated guide on revealing website ownerships that describes all these techniques.  

Inspecting Facebook posts

A Facebook post can provide valuable insights into an individual or group's activities, interests and connections. Here are the key elements of a Facebook post and how OSINT gatherers can exploit them.

Post content

The text in the post can reveal information about the user's opinions, experiences and behavioral patterns. The post may contain links to external resources, tags connecting to other Facebook users and multimedia content such as images, videos or shared articles. Location check-ins, attended events and timestamp data can also provide important contextual information about user activities and movements.

To search within a specific Facebook user profile, go to their profile page (I'm using Facebook on the web browser) and then click on the three dots in the right-hand corner of the profile page (see Figure 11).

Search within a specific Facebook user profile 
Figure 11 – Search within a specific Facebook user profile

Facebook posts may contain, in addition to text, an image (or many images) or a video. In that case, we can use a third-party service to download these media files onto our device to inspect them further using other tools.

  • Fdown - Facebook video downloader
  • Fdownloader – Download Facebook videos with high-quality
  • Snapsave – A Facebook video downloader with low and high quality 1080p - 2K - 4K

When analyzing Facebook videos using sentiment analysis tools, we should extract text from them first. Here are some tools to facilitate this task:

  • Piktochart Video – Convert video to text, support 60 languages. Requires registration with email to use the service
  • Restream - Transcribe video to text using AI technology
  • Maestro - Video to text

Every Facebook post displays the original publication date and time. The timestamp is displayed using the viewer's local timezone (see Figure 12).

Facebook post timestamp 
Figure 12 - Viewing Facebook post timestamp

When a post has been edited (new content added or deleted), Facebook displays a link "View edit history" in the post menu (see Figure 13). However, depending on user privacy settings, some edits may be hidden.

Facebook post edit history 
Figure 13 - View post-edit history

Using the Wayback Machine, we can check a public Facebook post edit history or previous versions.

We should take care of the following considerations regarding Facebook post timestamps:

  • Post timestamps can be changed through page settings. We should consider this fact and cross-reference important posts' timestamps with other resources
  • Scheduled posts will display the publication time, not the scheduling time
Post engagement

This includes reactions, comments and shares. Facebook users can react to a post using Like, Love, Haha, Wow, Sad or Angry emotions, which clearly indicates their emotional response to the content. For example, analyzing reaction patterns to specific types of content can reveal a user's ideological leanings, interests and potential affiliations.

Comments provide deeper insights into users' thoughts about the post's contents, including agreements, disagreements or other debates. Comment analysis can reveal:

  • User close circles and relationships
  • Linguistic patterns of users
  • Active time and frequency of interactions
  • Links to external content or references – some comments may contain links to external websites, an image or video

Shares indicate the post's reach and virality, displaying its popularity and identifying users who actively amplify specific messages or ideologies.

Sentiment analysis

Sentiment Analysis of text in posts and comments can reveal the user's emotional state or attitude towards a particular topic. This can be achieved using natural language processing techniques. Here are some tools for executing sentiment analysis on social media posts:

With over 3 billion active users worldwide, Facebook remains the largest and most widespread social media platform. Its broad user base and extensive public data availability make it the first source for OSINT gatherers when conducting SOCMINT investigations.

In this guide, I covered one aspect of Facebook OSINT, focusing on individual user investigations. In a later guide, I will provide detailed methodologies for conducting comprehensive searches across Facebook pages and groups, including advanced search techniques and data collection strategies.
 

Tags
Anonymous research OSINT research Social media