Social Media Intelligence: Twitter

Twitter is a social network and micro-blogging service launched in 2006. It is mainly used to connect people with the same interests based on the content posted. Basically, users create a profile and write posts (called Tweets)  announcing their thoughts on a topic, current location, plans for the day, or maybe a link to something that they feel is important or beneficial to others.  Twitter limits most posts to 280 characters. Tweets can contain photos, short videos, and URLs in addition to text.

A user can "follow" other users and constantly see what others are posting. Likewise, a user's "followers" can see what that user is up to on a constant basis. The premise is simply sharing small details of your life for all of your friends to see, as well as the rest of the world.  Twitter use hashtags (prefixed with pound symbol, #) to group similar topics or subjects. People—even when they do not know each other—can engage in conversation based on a hashtag.

Twitter data can be used for many types of investigations. Law enforcement may use this data to verify or disprove an alibi of a suspect. When a suspect states in an interview that he was in Johannesburg the entire weekend, but his Twitter feed displays his tweet about a garden in Lagos, he has some explaining to do. Private investigators may use this content as documentation of an affair or negative character. Occasionally, a citizen will contact the authorities when evidence of illegal activity is found within a person's tweets. The possibilities are endless.

Obtaining information from Twitter can be conducted through numerous procedures, all of which are explained in this post. You do not need to be logged in to their service in order to conduct queries on their website.

Twitter Search

This is the official site's search interface, but it is nothing different than the search field at the top of any Twitter profile or search result. A Twitter simple search allows you to perform a basic search within the Twitter database. However, do not underestimate this little box, as you can add advanced search operators—similar to Google advanced search operators—to your search query to force it to dive deep and return accurate results, as you are going to see later.

Twitter Advanced Search

This page will allow for the search of specific people, keywords, and locations. The only problem here is that the search of a topic is often limited to the previous seven to ten days. Individual profiles should display Tweets as far back as you are willing to scroll. This can be a good place to search for recent data, but complete archives of a topic will not be displayed. The following explains each section.

• All of these words: The order of wording is ignored here, and only the inclusion of each of the words entered is enforced. 
• This exact phrase: Every Twitter search takes advantage of quotes to identify exact word placement. Optionally, you can conduct the search here to get precise results without quotes.
• Any of these words: You can provide multiple unique terms here, and Twitter will supply results that include any of them. This search alone is usually too generic.
• None of these words: This box will filter out any posts that include the chosen word or words.
• These Hashtags: This option will locate specific posts that mention a topic as defined by a Twitter hashtag. This is a single word preceded by a pound sign (#) that identifies a topic of interest. This allows users to follow certain topics without knowing usernames of the user submitting the messages.
• From these accounts: This section allows you to search for Tweets from a specific user. This can also be accomplished by typing the username into the address bar after the Twitter domain, such as twitter.com/JoseffMoronwi. This will display the user's profile including recent Tweets. 
• To these accounts: This field allows you to enter a specific Twitter username. The results will only include Tweets that were sent to the attention of the user. This can help identify associates of the target and information intended for the target to read.
• Mentioning these accounts: While these messages might not be in response to a specific user, the target was mentioned. This is usually in the form of using "@". Anyone mentioning me within a tweet may start it with @JoseffMoronwi.
• Dates: The final option allows you to limit a search to a specific date range.

You can replicate all of these queries with manual search operators within the search field available on every Twitter page. Knowing the Twitter search operators instead of relying on the advanced search page has many benefits. First, we can use these techniques to monitor live Twitter data. Secondly, manual searches allow us to better document our findings. This is vital if your discoveries will be used in court.

Twitter Search Operators

The Twitter database is getting larger daily. Thousands of tweets are posted each second. To find your way within this huge volume of data, it is necessary to use advanced search operators to refine your searches. The following search operators can be incorporated into a Twitter simple search to find related tweets more precisely:

• Use the “” operator to search for an exact phrase or word. Here’s an example: “Infidels jihad”. 
• To search for more than one search term, use the OR operator. Here’s an example: infidels OR Jihad (this will search for tweets containing either the word infidel or the word jihad or both).  
• The negation operator (-) is used to exclude specific keywords or phrases from search results. Here’s an example: malware -stuxnet (This will search for tweets with the word malware but not related to stuxnet.) The negation query can be expanded to exclude more words/phrases using the OR operator like this: Jihad -(Taliban OR Hamas OR Hezbollah). This will search for Jihad and exclude tweets about Taliban and Hamas and Hezbollah. 
• To search for tweets containing a specific hashtag, use the (#) pound sign. Here’s an example: #Jihad (this will search for all tweets containing the Jihad hashtag).
• To search for tweets sent from a specific Twitter account, use the from operator . Here is an example: from:JoseffMoronwi. This provides a better view into his thoughts. This results page give us insight to the messages he is sending out. You can use Twitter default filters to narrow your search results within a specific result set after using the from operator. This would only display the tweets from our target which were replies to someone else (from:JoseffMoronwi filter:replies). 
• The following search within Twitter would display only the tweets by my target which do NOT include replies (from:JoseffMoronwi -filter:replies)
• The to operator followed by the Twitter handle will show all tweets sent to a specific person. Here’s an example: to:JoseffMoronwi. We now see all of those incoming messages that he cannot control. While he can prohibit them from being seen on his profile, he cannot block us from this search. You combine these options to create an extremely targeted query. The following Twitter search tells a different story (to:JoseffMoronwi from:osamabinladen).
• To find all tweets that reference a specific Twitter account, use the @ operator. Here’s an example: @JoseffMoronwi (this will retrieve all tweets that reference the JoseffMoronwi account).
• To search for tweets sent from a specific location, use the near operator followed by the location name. Here’s an example: “infidels” near Kabul (this will search for tweets containing the exact phrase infidels and sent from near Kabul).
• To search for tweets sent from within a specific distance from a specific location, use the within operator. Here’s an example: near:Mosul within:15mi (this will return tweets sent within 15 miles from Mosul).
• To search for tweets sent since a specific date, use the since operator followed by the date. Here’s an example: infidels since:2011-01-01 (this will return all tweets containing infidels and sent since January 01, 2011).
• To search for tweets sent up to a specific date, use the until operator. Here’s an example: infidels until:2011-01-01 (this will return all tweets containing infidels and sent until date January 01, 2011).
• To find all tweets that ask a question, use the ? operator. Here’s an example: infidel? (this will return all tweets containing infidel and asking a question).

• To exclude retweets, use the -RT operator. Here’s an example: Infidels -RT (this will search for all tweets containing the Infidels search keyword but exclude all retweets).
• To search for tweets from a specific source, use the source operator followed by the source name. Here’s an example: infidels source:tweetdeck (this will return all tweets containing infidels and sent from tweetdeck (common sources are tweetdeck, twitter_for_iphone, twitter_for_android, and twitter_web_client).

To limit Twitter returned results to a specific language, use the lang operator. Here’s an example: infidels lang:ar (this will return all tweets containing infidels in the Arabic language only). To see a list of Twitter-supported language codes, go to this page.

Please note that you can combine more than one Twitter advanced search operator to conduct a more precise search. For example, type “Infidels Jihad” from:JoseffMoronwi -Filter:replies lang:en to get only the tweets containing the exact phrase Infidels Jihad from the user JoseffMoronwi that are not replies to other users and in the English language only.

Note! Twitter allows you to save up to 25 saved searches per account. To save your current search result, click “More search actions” at the top of your results page and then click “Save this search.”

Twitter Person Search

Locating your target's Twitter profile may not be easy. Unlike Facebook, many Twitter users do not use their real name in their profiles. You need a place to search by real name. Twitter's official search page is recommended before trying third parties. After searching any real name or username within the standard Twitter search field, click through the five menu options, which are each explained below.

• Top: This displays popular tweets matching your query. If your target is popular, you may see something here. I typically avoid this tab as it allows Twitter to determine what evidence I should see instead of selecting content based on specific queries.
• Latest: This presents a reverse-chronological list of data which matches your search. It always begins with the most recent post and goes backward. This works well when searching a topic, but not when locating a target's profile.
• People: Scrolling through this list allows you to look through the photo icons and brief descriptions to identify your target. Clicking on the username will open the user's Twitter profile with more information. This is the best option for searching by real name or username.
• Photos: This searches for any photos matching your query. This has been helpful when attempting to identify images posted by unknown people who mentioned your target by name.
• Videos: This searches for any videos matching your query. This often locates videos associated with your target.

Twitter Directory

If you still cannot locate your target's profile, you may need to resort to the Twitter Directory. This tries to allow you to browse through the millions of Twitter profiles alphabetically. First, choose the first letter of the first name of your target. This will present a range of options. You then need to select the range in which your target would be listed, and that selection would open a new window with hundreds of name range options such as "Joseph Moronwi - Joseph Moro". You will need to keep using this drill down method until you reach a list of actual profiles that meet your criteria. This is the most difficult of methods, but sometimes it might be all you have. Consider a target who used a misspelled version of his real name (for example : Joseff instead of Joseph). You might find him out this way.

Search By Email Address

Technically, Twitter does not permit search of a user by email address. Even if a profile for a user with that email address exists, you will get no result if you try this search method.

You can get around this restriction by using a feature in the Twitter mobile app. This technique will require a new Twitter account and the Twitter app present within a virtual Android device. This could also be replicated on a physical mobile device, but that is not recommended.

Within Android, open the Contacts application and add the email address of your target within a new contact and save the entry. Open the Twitter app, navigate to the left menu and select "Settings and privacy", click on "Privacy and safety", then "Discoverability and contacts". You can then manage your data and allow Twitter to sync your Android contacts to their service.

Enabling this feature will not display your contacts within the application. Instead, look at your notification bar within Android. You should see a pending notification which states "Find your friends on Twitter". Clicking this should present the "Suggested Followers" screen.

Enter the personal email address of your target into your Android contacts. This will immediately identified him as a "Friend" and Twitter will encourage you to add him. You now know that he associated his personal email address with this Twitter account. Twitter will encourage you to add these profiles, but do not choose that option. If you do, your target will be sent a notification from your account.

Search By Location

If you are investigating an incident that occurred at a specific location and there are no known suspects, Twitter allows you to search by GPS location. We could use Twitter's advanced search to search by zip code but that will be too broad. The following search on any Twitter page will return tweets known to have been posted within one kilometer of the GPS Coordinates 35.9594, -38.9981

geocode:35.9594,-38.9981,1km

There are no spaces in this search. This will be a list without any map view. They will be in order chronologically with the most recent at top. The "lkm" indicates a search radius of one kilometer. This can be changed to 5, 10, or 25 reliably. Any other numbers tend to provide inaccurate results. You can also change "km" to "mi" to switch to miles instead of kilometers. If you want to view this search from the address bar of the browser, the following page would load the same results.

https://twitter.com/search?q=geocode:35.9594,-38.9981,1km

You can add search parameters to either of these searches if the results are overwhelming. The following search would only display Tweets posted at the listed GPS coordinates that also mention the term "Jihad". Notice that the only space in the search is between "km" and "jihad".

geocode:35.9594,-38.9981,1km "jihad"

It would be inappropriate at this point to not address the lack of geo-enabled tweets. This search might have been fruitful a few years ago because an alarming number of twitter users were unwittingly sharing their locations with every post. The situation today is the polar opposite. Twitter's default setting is to not share your location. A user must enable this option in order to appear within these search results. Its incredibly rare in my experience to apprehend a criminal using a locations enabled tweet. However, we should be aware of the possibility.

Mandatory and Optional Search Term

You may find yourself in a situation where you need to search for both mandatory and optional phrases. Twitter does not provide a published solution for this. However, it does support this type of search. 

Assume you are investigating threats against a victim named Deborah Samuel. You believe that people may be tweeting about her with reference to violence. Searching her name alone produces too many results. Placing the name within quotes forces Twitter to only give you results on those exact terms, which is your "mandatory" portion. Additional optional words could be added with the term "OR" in between each. This term must be uppercase, and will only require one of the optional words be present within the search results. Consider the following query on Twitter.

"Deborah Samuel" kill OR stab OR fight OR burn OR beat OR punch OR death OR die

This caught my attention in the results. A young Muslim man expressing support for violence backing it up with a Bible passage. An investigator might want to beam his searchlight on this radical user.

Date Range Search

If you are searching vague terms, you may want to filter by date. Although this option is now available on the Advanced Search page, I believe it is critical to understand how Twitter handles this work. Assuming you are investigating a terror threat that occurred a few weeks or a month ago. 

A search on Twitter of the terms "terror threat" will likely apply only to recent posts. Instead, consider a date specific search. The following query on any Twitter page would provide any posts that mention "terror threat" between January 1, 2022 and May 19, 2022.

since:2022-01-01 until:2022-05-19 "terror threat"

You can combine this search technique with the "to" operator or a name search (or both). This allows you to go further back in time than standard profile and Twitter feed searches typically allow. Consider an example where Twitter user @IslaamWins is your target. You can visit his live Twitter page and navigate back through several tweets of this user. However, you will reach an end before obtaining all Tweets. This could be due to Twitter restrictions or browser and computer limitations. He currently has 35,700 tweets. Even if you could make it through all of his Tweets, you are not seeing posts where he is mentioned or messages sent publicly to him. It is recommend to split this search by year and include mentions and messages directed toward him. The following search within Twitter displays all Tweets from the Twitter name IslaamWins between January 1, 2021 and December 31, 2021.

from:IslaamWins since:2021-01-01 until:2021-12-31

This may create a more digestible collection of Tweets that can be properly collected and archived. Because you are unlikely to be able to scroll that far, there may be no other methods to identify these tweets. In investigations involving targets with several thousand posts, it is recommended to conduct multiple searches within Twitter that span several years. The following would collect yearly sets of Tweets posted by IslaamWins since 2020.

from:IslaamWins since:2020-01-01 until:2020-12-31
from:IslaamWins since:2021-01-01 until:2021-12-31
from:IslaamWins since:2022-01-01 until:2022-12-31
...

This same technique can be modified to display only incoming Tweets to IslaamWins for these years. Replace "from" with "to" to obtain these results. The 2010 posts would appear as follows.

to:IslaamWins since:2020-01-01 until:2020-12-31

You can combine all of these options into a single result, but only after you have tried the more precise options mentioned previously. While the next search should return all of his outgoing Tweets, incoming Tweets, and mentions, it is not always complete. The following would include this data for 2020.

"IslaamWins" since:2020-01-01 until:2020-12-31

A date range search has numerous applications. Any supported Twitter search should work combined with dates. A location search for a given date connected to an investigation could be one example. As a test of the possibilities, consider that you want to identify an email address for the target @JoseffMoro. His live Twitter page will not reveal this, as he no longer posts his email, presumably to prevent spam. However, the following search is quite productive.

from:JoseffMoro email since:2019-01-01 until:2021-12-31

This isolates only his posts from the beginning of Twitter until the end of 2019. Only three results are present, including the Tweet as seen in the figure above.

Media, Likes, and Links

The Filter operator is powerful to filter results based on different criteria. The following are examples of the most popular filters:

• To search within a Twitter conversation, use the filter operator with the replies keyword. Here’s an example: infidel Filter:replies (this will return all tweets that contain the keyword infidels and are replies to other tweets).
• Use the images keyword to return tweets that contain an image within it. Here’s an example: infidels Filter:images (this will return all tweets that contain the keyword infidels and have an image embedded within them).
• To return tweets with video embedded with them, use the videos keyword (similar to the images filter). Here’s an example: infidel Filter:videos.
• To return tweets containing an uploaded video, Amplify video, or Periscope video, use the native_video operator. Here’s an example: infidels filter:native_video (this will return all tweets containing the search keyword infidels that have an uploaded video, Amplify video, or Periscope video).
• To return tweets with either image or video, use the media operator. Here’s an example: infidels Filter:media.
• To return tweets with a news URL linked to them, use the news keyword. Here’s an example: ISIS Filter:news (this will return tweets containing ISIS within them that are mentioned by a news source).
• To return tweets that contain a link (URL) within them, use the links keyword. Here’s an example: infidels Filter:links.
• To return text-only tweets, use the text keyword. Here’s an example: infidels Filter:text.
• To return tweets from verified users only (verified accounts have a blue check mark near their names), use the Verified operator. Here’s an example: infidels Filter:verified.
• To search for video uploaded using the Twitter Periscope service, use the Periscope filter. Here’s an example: infidels filter:periscope (this will search for all tweets containing the infidels keyword with a Periscope video URL).

To search for tweets according to the number of likes, replies, and retweets, use the following operators:

• Use the min_retweets: operator followed by a number. Here’s an example: infidels min_retweets:50 (this will return all tweets containing the OSINT search keyword that have been retweeted at least 50 times).
• Use the min_replies: operator followed a number to return all tweets with NUMBER or more replies. Here’s an example: infidels min_replies:10 (this will return all tweets containing the infidels search keyword that have 10 or more replies).
• Use min_faves: followed by a number to return all tweets with NUMBER or more likes. Here’s an example: infidels min_faves:10 (this will return all tweets that have at least 10 or more likes and that contain the infidels search keyword).

Note that the username of a target could be the keyword in all of the searches discussed. Example is JoseffMoronwi Filter:images. It will retrieve all images posted by the user @JoseffMoronwi.

Deleted, Suspended, and Missing Tweets

Twitter users may delete their own accounts if there is suspicion that an investigation is under way. If this happens, searching on Twitter will not display any of the posts. Furthermore, a person might only delete individual Twitter posts that are incriminating, but leave non-interesting posts on the profile to prevent raising suspicion associated with deleting an entire account. Some users may find their accounts suspended for violating Twitter's terms of service. In any of these scenarios, it is still possible to retrieve some missing posts using various techniques.

If you encounter a Twitter user that has recently deleted some or all of their messages, you can conduct a cache search of their profile. There are various ways to do this, and I will demonstrate the most common. In this example, I conducted a search on Twitter for "deleted all my Tweets" on May 19, 2022. This provided many users who posted that they had just deleted all of their content. This helped me identify a good target for this type of demonstration. The first user I located was "amnargess". She had one Tweet and it referenced deleting all of her posts.

I attempted a search on Twitter of from:amnargess, which provided no results. I conducted a search of to:amnargess, which provided dozens of incoming messages from her friends. This was a good start. Next, I conducted a search of her profile given below on Wayback Machine.

http://web.archive.org/web/*/twitter.com/amnargess

This presented me with 6277 entries which are captures of her profile from April 19, 2022 to May 19, 2022 the day she announced the deletion of her tweets. A tweet of April 19, 2022 is shown below. 

Next, I returned to Google to obtain further data. I searched the following, which provided only results that possess a URL that begins with twitter.com, then my target's username, then "status". This will force Google to present direct links to actual posts.

site:twitter.com/amnargess/status

Replicate this process on Bing and Yandex to obtain different results which could build a more robust profile of the target.

Twitter Post Details

Assume that you have identified an individual Tweet of interest. The URL of the message will appear similar to

https://twitter.com/Inv_Abdul4/status/1526207218009399296?s=09

but you may want a few more details. If there is an image embedded into the Tweet, you can click on it to see a larger version. However, this is sometimes not the original image size. In order to see the original full-size version, right-click the image and choose "View image". This will load a new URL such as the following.

https://pbs.twimg.com/media/FS4tFrdX0AA_vLY?format=jpg&name=medium

After removing "&name=medium" from the URL, the full image is available. You can save this image by right-clicking and choosing "Save image as". This example is as follows

https://pbs.twimg.com/media/FS4tFrdX0AA_vLY?format=jpg

Tweet Deck

Tweet Deck is owned by Twitter, and it can take advantage of the live Twitter "Firehose". Every public tweet on Twitter is is contained in this massive data stream. Many Twitter services do not have access to this stream, thus their results are limited. To use Tweet Deck, you must first create and sign up for an account. The "Create Account" button on the website will walk you through the process. Alias information is acceptable and preferred. The plus symbol (+) in the upper left area will add a new column to your view. There are several options presented, but the most common will be "Search" and "User". The "Search" option will create a column that will allow you to search for any keywords on Twitter. The following is a list of search examples and how they may benefit the investigator.

• "Victim Name": A homicide investigator can monitor people mentioning a homicide victim.
• "School Name": A school can monitor anyone mentioning the school for suspicious activity.
• "Subject Name": An investigator can monitor a missing person's name for relevant information.
• "Event": Officials can monitor anyone discussing a special event such as a festival or concert.

The "User" option will allow you to enter a Twitter username and monitor all incoming and outgoing public messages associated with the user. If several subjects of an investigation are identified as Twitter users, each of the profiles can be loaded in a separate column and monitored. Occasionally, this will result in two of the profiles communicating with each other while being monitored. You can also use the Geocode search mentioned earlier within Tweet Deck. A column that searches "geocode:35.9594,-38.9981,1km" will display a live feed of Tweets posted within the specified range. A more precise search of "geocode:35.9594,-38.9981,1km jihad" would add the keyword to filter the results. 

Third Party Resources

Next, we'll look at third-party search engines. Before you can submit any queries, most of these sites need you to sign in with your Twitter account. This is largely due to Twitter's anti-fraud and anti-abuse measures. When this is essential, I always advocate utilizing a “junk” Twitter account. To perform any tasks, you will be required to provide the third party service access and control of your account. If you use your genuine personal account, this can be a security and privacy issue.

All My Tweets

This website provides a clean display of all of a user's Twitter posts on one screen. It will start with the most recent post and list previous posts on one line each. This view will display up to 3,200 messages on one scrollable screen. This provides two analysis methods for digesting large amounts of data. Pressing "Ctrl" + "F" on the keyboard will present a search box. Any search terms can be entered to navigate directly to associated messages. The page can also be printed for archiving or distribution to assisting analysts. This is a very good way of reading through the Tweets of an active user. This also prevents you from constantly loading more Tweets at the end of every page throughout a profile.

Tweet Beaver

It is the most powerful online option for exporting content from an account or exploring association that we have. There are currently fourteen unique options within this site and I'll go over each one with examples of how to use them. Note that you must be logged in to a Twitter account for any of these to work, as they all leverage the Twitter API in order to function. Please only use covert accounts, and never your own personal Twitter login information.

Convert Name to ID: This is the most reliable way to take a Twitter username, such as @Inv_Abdul4, and convert it to the corresponding user number, which is 1483530770165780484. This can be vital for investigations. Users can always change their username at any time, but the user number cannot be modified.

Convert ID to Name: This is the opposite of the above technique. If you had previously identified jms_dot_py as your target Twitter account only to fnd later that he had changed his username, you could easily locate his profile by providing the assigned user number (1483530770165780484).

Check if two accounts follow each other: As the title implies, this option quickly sorts out whether two users follow each other. An actual output appears below. 

@JoseffMoro does not follow Inv_Abdul4
@JoseffMoro follows @JoseffMoronwi

Download a user's favorites: This is the first tool where we can choose to either display the results on the screen or download them as a CSV spreadsheet. This option simply extracts a user's favorite's (or likes) as discussed earlier. The results include the original author, date and time, text of the message, a direct URL to the post, and the author's bio.

Search within a user's favorites: If the previous technique produces too many results, this option allows you to filter by keyword. Since you could search within the file you downloaded or on the screen of results, I find this feature to be of little use. 

Download a user's timeline: This may be the most useful all of these options. Provide a target Twitter name and TweetBeaver will extract the most recent 3,200 posts from the account. When I have a Twitter target of interest, I run this tool on the account daily. Furthermore, it will include the date and time of each post and the direct URL to the message. It helped me obtain the new posts every day, and identify previous posts deleted after my initial acquisition. 

Search within a user's timeline: Similar to the favorites search tool, I find this one redundant.

Get a user's account data: This utility provides a great summary of the account information. The benefit of this method of obtaining the data is that it is quick and presented in a standard view. I can collect this information about many users, publicly available from any Twitter account and all results will have the same format. This can aid in presentation during prosecution. 

Bulk lookup user account data: Similar to the previous but allowing bulk submissions. This feature allows you to input numerous accounts within one query and generate a CSV report.

Download a user's friends list: This option collects a target's list of accounts that he or she follows. This is similar to a typical friends list on Facebook, but approvals on either end are not required. 

Download a user's followers list: This is a list of the people who follow the target on Twitter. This is less likely to contain actual friends, but all associated accounts should be investigated.

Find common followers of two accounts: This is a feature which can quickly identify people of interest based on co-targets. Consider the following. Twitter user @Inv_Adul4 has been identified as a suspect in your terrorism investigation. He seems to be very friendly with Twitter user @IslaamWins, and he once discussed jihad within public posts with this new second person of interest. IslaamWins has 25,000 followers and Inv_Abdul4 has 12,000. There is no great way to look through these in order to find other suspects. However, TweetBeaver can quickly identified the people who follow both targets.

Find common friends of two accounts: Similar to the above, this only looks at the "friends" of each target. In other words, the people each target follows on Twitter.

Social Bearing

This robust solution combines the features of many resources within this chapter into one search. It relies on the Twitter API, so it will only analyze the most recent 3,200 Tweets. While searching my own account, I received a summary which included the following. Investigative benefits are next to each.

• Total audience reach: This tells me whether the target has true followers or "fakes". 
•  Total impressions: This tells me an accurate size of the target's audience. 
• Total ReTweets: This discloses if the target's audience engages with the content. 
• Total audience favorites: This confirms engagement from the target's audience. 
• Tweet sentiment: This indicates positive or negative tone within comments. 
• Tweet types: This identifies new content versus ReTweets of others. 
• Tweet sources: This discloses the source of submission, such as mobile, desktop, or API.
• Domains shared: This summarizes the web links posted within Tweets. 
• Word cloud: This provides a summary of the most common words posted.
  

The graphical output of this resource is impressive, but the CSV export is more useful. Additionally, we can query an account directly via static URL. This allows us to include this resource in our automated tools. My account can be seen at the following URL.

https://socialbearing.com/search/user/joseffmoronwi 

This service also offers geo search options.

Twitter Biography Changes

Similar to the way that users delete Tweets and comments, they also modify the information within their Twitter biography on their profile page. Several sites have come and gone which attempt to record these modifications, and my current favorite is Spoonbill. Use of this free service from the home page requires you to log in to your Twitter account. However, a direct URL query will display any stored results. If you were researching my Twitter handle, the following address would bypass the account login.

https://spoonbill.io/data/joseffmoro/ 

This page displays several changes I made to my account including changing my name and location. Searching more active people will usually reveal many pages of changes, and will always display the previous content as stricken, and highlight any changes in green. I do not recommend creating an account to use this service, it will demand access to the people you follow, which could jeopardize your investigation.

 

Twitonomy

One Twitter analytics website that stands out from the rest is Twitonomy. This is the most complete analytics service that I have found for a single Twitter handle. A typical user search would fill four pages of screenshots. The main analytics portion identifies the average number of posts by day of the week and by hour of the day. It also displays from which platforms the user tweets.

Twitter Location Information

While privacy-aware individuals have disabled the location feature of their accounts, many users enjoy broadcasting their location at all times. Identifying a user's location during a Twitter post is sometimes possible through various methods. Prior to 2014, identifying the GPS details of every post of many users was simple. Today, most of these identification techniques are no longer working. A manual Twitter search method for identifying posts by location was explained earlier. That technique is best for current or live information, and is limited to only recent posts. You may have a need for historical details from previous posts from a specific location. I have had better success with historical data than current content in regard to geolocation. I believe this is because most people unknowingly shared their location while Tweeting for many years. When Twitter changed the default location option to "Disabled", most users never intentionally reenabled the feature. Fortunately, there are third-party websites that collected this historical data, and can assist with easy searching. The following options will work best when you are investigating events that occurred several years prior. While you may get lucky and receive some recent posts, the majority could be quite old.

Heavy AI

Heavy AI, formerly Omnisci, is a massive database platform developed through collaboration between MIT and Harvard. Historically, each college had their own interface into this data, which supplied Twitter post locations from past Tweets. Each interface provided new ways of searching information. Both websites have been disabled, and the entire project has warped into Heavy AI. This website can search by topic, username, or location. It can also combine all three options to conduct a detailed search. Results appear as blue dots on a dark map. Each dot represents a Tweet which possesses location data to the chosen area.

One Million Tweet Map

This service only displays the most recent one million Tweets on an international map. They do not have access to every Tweet available, often referred to as the "firehose", but they offer new Tweets every second. I would never rely on this map for complete data about a location. However, monitoring a large event can provide live intelligence in an easily viewed format. I recommend using a mouse scroll wheel to zoom into your location of interest. Once you are at a level that you can see single Tweets, you can click any of them to see the content. The page will automatically refresh as new information is posted.

Tweet Mapper

If your target possesses Tweets with location data, but the previous two options failed to locate anything, this map could reveal the data. The project appears to be abandoned, but I receive occasional results.

Fake Followers

There are a surprising number of Twitter accounts that are completely fake. These are bought and sold daily by shady people who want to make their profiles appear more popular than they really are. There are two websites that will assist in distinguishing the authentic profiles from the fraudulent. They both require you to be logged in to a Twitter account, and I will compare the results of each.

Spark Toro

The most robust option is SparkToro. Analyzing my target account, it declared that 35% of my followers were "accounts that are unreachable and will not see the account's tweets". It also provided some metrics and a full explanation as to how it achieves its results. This is something the others do not disclose. Once you have logged in to a Twitter account, you can query further users at the following static URL.

https://sparktoro.com/fake-followers/joseffmoro

Twitter Audit

This option identifies the percentage of your target account's followers that are "fake" and provides very few details. It also allows for submission through a static URL, but you still need to request an audit once you get to the page. The following would display results for my own page.

https://www.twitteraudit.com/joseffmoro

Miscellaneous Twitter Sites

Each time, a new site arrives that takes advantage of the public data that Twitter shares with the world. These sites offer unique ways of searching for information that Twitter does not allow on their main page. This partial list is a good start to finding information relevant to your target.

Twiangulate

Earlier, we saw  how we could use TweetBeaver to filter most of your target's Twitter friend and follower data. If it should become unavailable, there are two additional websites which can assist. Twiangulate identifies mutual friends on two specific accounts. This can quickly identify key users associated within an inner circle of subjects.

Tinfoleak

Get detailed information about any Twitter account and see what each account leaks. You need to supply your email address to receive the detailed report.

Foller Me

This service is very similar to the previous Twitter analytics options. Providing a Twitter username presents the typical bio, statistics, topics, hashtags, and mentions analysis that you can find other places.  Note that the results are displayed in Universal Time, so you will need to convert as appropriate for your suspect. 

TweetTopic

This simple tool provides one feature that I have found helpful in my investigations. Once you supply the target Twitter username, it collects the most recent 3,200 Tweets and creates a word cloud. This identifies the most common words used within posts by the target. There are several sites that do this, but this service takes it a vital step further. Clicking on any word within the result displays only the Tweets that include the selected term. Clicking on any of the text circles would immediately identify posts related to those terms. I have used this when I have a target with too many posts to read quickly. TweetTopic allows me to quickly learn what my target posts about and immediately delve into any topics of interest to my investigation.

Trendsmap

Monitoring trends on Twitter can provide intelligence on a global scale. The keywords that are currently being posted more than any other terms in a specific area could be of interest. This can identify issues about to surface that may need attention. This type of analysis is common during large events such as protests and celebrations. Several websites offer this service, but I choose Trendsmap. You can search either topics or a location. Searching a location will provide the top keywords being posted as well as a heat map to identify peak usage.