Automated Identification and Reconstruction of YouTube Video Access

Abstract

YouTube is one of the most popular video-sharing websites on the Internet, allowing users to upload, view and share videos with other users all over the world. YouTube contains many different types of videos, from homemade sketches to instructional and educational tutorials, and therefore attracts a wide variety of users with different interests. The majority of YouTube visits are perfectly innocent, but there may be circumstances where YouTube video access is related to a digital investigation, e.g. viewing instructional videos on how to perform potentially unlawful actions or how to make unlawful articles.When a user accesses a YouTube video through their browser, certain digital artefacts relating to that video access may be left on their system in a number of different locations. However, there has been very little research published in the area of YouTube video artefacts.The paper discusses the identification of some of the artefacts that are left by the Internet Explorer web browser on a Windows system after accessing a YouTube video. The information that can be recovered from these artefacts can include the video ID, the video name and possibly a cached copy of the video itself. In addition to identifying the artefacts that are left, the paper also investigates how these artefacts can be brought together and analysed to infer specifics about the user's interaction with the YouTube website, for example whether the video was searched for or visited as a result of a suggestion after viewing a previous video.The result of this research is a Python based prototype that will analyse a mounted disk image, automatically extract the artefacts related to YouTube visits and produce a report summarising the YouTube video accesses on a system.

Untitled

“…Namun begitu, kewujudan pelbagai laman perkongsian video pada masa kini dilihat tidak khusus bagi tujuan pendidikan (Snelson, 2008). Laman-laman ini lebih dikenali sebagai media sosial yang mengandungi pelbagai kandungan video tidak ditapis serta memudahkan pelajar mengakses video berunsur keganasan, kekejaman, hiburan, dan sebagainya (Buzzi, Buzzi & Leporini 2011;Patterson & Hargreaves, 2011). Kebimbangan pihak sekolah mahupun IPT terhadap penyebaran nilai atau budaya tidak sihat melalui laman perkongsian video ini telah menyebabkan ianya dihad dari diakses di dalam kawasan sekolah atau kampus (Snelson, 2008).…”