Facebook Cache
Overview
Section titled “Overview”Evidence: Facebook Cache
Description: Collect Facebook Store Application Cache
Category: Applications
Platform: windows
Short Name: fcbkc
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”Facebook app caches images including profile pictures, shared photos, and media from the news feed and messages. These cached images are stored in the OSMeta image_cache directories.
Data Collected
Section titled “Data Collected”This collector gathers structured data about facebook cache.
Collection Method
Section titled “Collection Method”This collector gathers Facebook image cache directories from the app package LocalState containing cached visual content.
Forensic Value
Section titled “Forensic Value”Facebook cache contains images from conversations, posts, and profiles. This helps recover visual evidence, identify contacts through profile pictures, and understand viewed content.