Finding pictures on Facebook and Instagram and filtering them by date
During Open Source investigations we often come across situations in which we need to find a picture of a location that was taken on a specific day. Or perhaps a range of dates. In this article I want to discuss how you can use Google and YouTube, Facebook and Instagram to find visual evidence from a specific place at a specific point in time.
Facebook (and the new, less functional Graph Search)
Some of us still recall the good old days when you could easily type in a search query like this one in the URL bar to find hidden content on Facebook:
https://www.facebook.com/search/39875583837/photos-in
Here you tell Facebook to search for pictures at Times Square, New York, this is what is called Graph Search. However, as you will notice when you click on that link, it doesn’t work anymore.
Since last month (June 2019) Facebook has made some drastic changes to the way these search are executed. Luckily for us, Henk van Ess, Dan Nemec and “sowdust” have done some great efforts in updating existing tools and informing journalists, investigators and other OSINT enthusiasts on how to perform these searches with the remodeled Graph Search.
For more background see the thread above.
Searching videos and pictures on Facebook
Now let’s take a step back and just look at how you can find a video that was filmed at Times Square and uploaded to Facebook on January 1, 2018. We just open up our Facebook account and type “Times Square”, then let’s say we want to look for videos.
- First we will type Times Square.
- We select videos.
- We select the date.
At step 3 we immediately run into our first problem. We can only select a year and a month, not the exact date (such as January 1, 2018).
This is not a huge problem since we have the dates right below the video, we can quickly browse through them and go to one that was uploaded on the 1st of January. Nevertheless, this is annoying and can waste your time. Especially for popular locations which are visited by thousands of people everyday. What can we do to select the day as well?
I previously mentioned sowdust (github) who helped Henk van Ess and Dan Nemec with the new, working version of the graph.tips website and now we will have a deeper look at it. We will focus first on finding videos from Times Square. The full and working URL(s) are:
https://graph.tips/facebook.html and https://sowdust.github.io/fb-search/
They will refer you to, essentially, the same page.
Once you open the page you want to do the following:
- Select videos from the first drop down menu.
2. Now add the date that you want to search for and select Add date filter.
3. Add the keyword you are looking for, in this case Times Square.
4. Open the URL in a new window.
You can also add the filter, Live, to only search for videos that were broadcast live when uploaded.
Searching for photos by upload date on Facebook
We can do the same for photos. The only difference is that we will select photos in the drop down menu instead of videos.
When you open the new URL you will see 9 images grouped horizontally in three rows of three images. You can click on them and verify they are from the date you specified. You might get images that are marked on a different day (one day difference) and that can be explained by the time difference from your location compared to the location where this picture was taken/uploaded.
Now let’s try to click on See all to see the other images from that place and that time. When you do this, you will notice that your filter will be discarded by Facebook and that you will once again look at photos from random dates. Now comes a rather nerdy trick that you can apply to avoid this.
the full URL that you get when you add the filter and before you click on See all is this:
After you click on See all:
Let’s break it down and explain what we are looking at. In the first URL you see:
filters=eyJycF9jcmVhdGlvbl90aW1lIjoie1wibmFtZVwiOlwiY3JlYXRpb25fdGltZVwiLFwiYXJnc1wiOlwie1xcXCJzdGFydF95ZWFyXFxcIjpcXFwiMjAxNFxcXCIsXFxcInN0YXJ0X21vbnRoXFxcIjpcXFwiMjAxNC0xMFxcXCIsXFxcImVuZF95ZWFyXFxcIjpcXFwiMjAxNFxcXCIsXFxcImVuZF9tb250aFxcXCI6XFxcIjIwMTQtMTBcXFwiLFxcXCJzdGFydF9kYXlcXFwiOlxcXCIyMDE0LTEwLTExXFxcIixcXFwiZW5kX2RheVxcXCI6XFxcIjIwMTQtMTAtMTNcXFwifVwifSJ9
everything behind filters= is Base64 and can be decoded with a Base64 decoder. Once you do that you will see that it equals to this:
{“rp_creation_time”:”{\”name\”:\”creation_time\”,\”args\”:\”{\\\”start_year\\\”:\\\”2014\\\”,\\\”start_month\\\”:\\\”2014–10\\\”,\\\”end_year\\\”:\\\”2014\\\”,\\\”end_month\\\”:\\\”2014–10\\\”,\\\”start_day\\\”:\\\”2014–10–11\\\”,\\\”end_day\\\”:\\\”2014–10–13\\\”}\”}”}
This makes sense as this is the filter that we apply to filter the date. Remember this string that appears when we add a filter on the graphs.tips website? Hopefully you will now understand what this is.
When you click on See all, this disappears and something else appears behind f=. This cannot be decoded with Base64. It is some type of anti-CSRF token that’s generated on the spot when you log in and lasts for several hours, it is (likely) tied to your Facebook account and cannot be predicted (or shared with others), as explained by Dan Nemec in this tweet.
We can use this token, however, to show all photos of Times Square on January 1, 2018. We will need to copy this token and paste it into the first URL. Copy only the parts that are in bold:
Now paste it into the first URL, between your keyword (bold) and &epa (in italics)
Then it will look like this:
https://www.facebook.com/search/photos/?q=times%20square&f=Abp2v7X7McNmyTMs0PsXMA78jr7y72ulkoNYRGspBWTnS5wNxNgnll9IHP2xGOl5fLoXTkPbLNNVZYYEBuvOyedNhiENFM2PcrsQms0NxtF7SwIk_7sQARI4S6tRYMtpxRg&epa=FILTERS&filters=eyJycF9jcmVhdGlvbl90aW1lIjoie1wibmFtZVwiOlwiY3JlYXRpb25fdGltZVwiLFwiYXJnc1wiOlwie1xcXCJzdGFydF95ZWFyXFxcIjpcXFwiMjAxNFxcXCIsXFxcInN0YXJ0X21vbnRoXFxcIjpcXFwiMjAxNC0xMFxcXCIsXFxcImVuZF95ZWFyXFxcIjpcXFwiMjAxNFxcXCIsXFxcImVuZF9tb250aFxcXCI6XFxcIjIwMTQtMTBcXFwiLFxcXCJzdGFydF9kYXlcXFwiOlxcXCIyMDE0LTEwLTExXFxcIixcXFwiZW5kX2RheVxcXCI6XFxcIjIwMTQtMTAtMTNcXFwifVwifSJ9
With the above you will be able to scroll down as much as you want and you will only see the pictures from the same date.
This is far from an ideal solution; it is time consuming. Because of that I opened an issue on Github to see if we can automate this by intercepting the token when emulating a click on See all with one of the tools created by sowdust.
More information in this thread:
Filtering locations by date with Instagram
Instagram is known to have very unfriendly search function. It is very difficult to find posts according to a date and finding something according to the location can also be a pain.
Let’s say you want to find pictures from Istiklal avenue in Istanbul from October 14, 2016. First you will need to go into Instagram and search for istiklal caddesi. Then you select the location, not the hashtag.
Now you will see plenty of pictures from this location, but let’s say that you need to find pictures from October 2016 (for example because you want to chronolocate this picture). Since we are in 2019 this would mean that you would have to spend several minutes, maybe an hour or more scrolling down the search results to get to 2016.
There is a way to specify the date by calculating a certain timestamp used by Instagram. You need a relatively complex formula to calculate this timestamp that you can then copy into the address bar, I won’t go into details about how this is calculate exactly, but if you wonder how to calculate this you can check this video. Calculating the date with this formula involves converting the date that you want to search for into Unix time, subtracting the Instagram Epoch time from it, converting the decimal value into binary then adding zeros to it and so on. Just watch the video if you want to have the full explanation.
This method is relatively old, the video was uploaded by YouTube user chis tophr in 2017 but it worked when I last tried it (today, July 9, 2019).
Calculating the timestamp can be automated and it has already been done for you by the author of the aforementioned video. You don’t even need to install Python on your computer; you can execute this script on your browser, here on repl.it.
If you have Python installed, then it doesn’t hurt to be a little script kiddie (like me) and save this useful 41 lines of code on your desktop so that if this website ever goes offline, you will have this somewhere safe.
Instagram script kiddie 101
Now when looking at this code it will ask you to provide a URL of a location (remember, this works only for locations, not for hashtags) that you want to search for. The URL can be anything so let’s use the URL the script provides.
- Enter the URL, we’ll use https://www.instagram.com/explore/locations/95099702/mgm-grand-las-vegas/
- Enter the date, we’ll use October 14, 2016. It must be in this format 1999/7/27. No zeros.
- After you press enter you will get this URL.
https://www.instagram.com/explore/locations/95099702/mgm-grand-las-vegas/?max_id=1361215877650841600
We are only interested in this part and we can ignore the rest:
Now we want to take a location that we are actually interested in. I will take Istiklal caddesi in Istanbul because I want to chronolocate my own profile picture on Twitter. The URL for this location is:
https://www.instagram.com/explore/locations/160806401274594/istiklal-caddesi/
I will just add that last bit to the very end of this URL so it will become:
https://www.instagram.com/explore/locations/160806401274594/istiklal-caddesi/?max_id=1361215877650841600
Be sure to scroll down until Most recent and then you will see the filtered pictures. If you look under Top posts you might see more recent images.
This works slightly different from what we saw with Facebook. How so? For starters, this will bring you back to the date you selected, but it will also show posts from before this date. So if you selected Oct 14, 2016 it will also show posts from September 2016, August 2016, July and so on. You will not see, posts from after October 14, 2016 because of the filter that you applied.
Unfortunately this works slightly differently for hashtags and we are still working on finding a solution for this. See this thread and feel free to help us out:
How to use Google to search for YouTube videos based on upload date
Have you ever tried finding videos on YouTube based on their upload date? Well, I have and I can tell you it’s awful. Let me explain. Let’s use the same example again, Istiklal avenue in Istanbul in October 2016.
We will search for videos from that street on YouTube and we’ll try to sort by date.
When we sort by upload date we will get the newest videos first by default. In other words you’d have to scroll down a lot, like with Instagram.
There is an option on the left to filter videos from the last hour, today, this week and so on. This, however, doesn’t help if we are looking for something that happened on October 14, 2016 or November 2017.
Therefore the solution would be to use a Google search operator to look for videos from YouTube and to use a custom date range.
- Go to Google and type site:youtube.com this will eliminate results from all sites but YouTube.
- Now type your keyword, istiklal caddesi and press enter to search.
- You will have to press Tools > Any Time > Custom Range.
- Now specify the time period you want to search for, I will search for October 13, 2016 — October 15, 2016.
Now you will get results from YouTube.com that only match that date range and contain the words Istiklal caddesi. You can take it further and specify the duration or the quality of the video.
Using other social media websites to find user-generated content and why this is important
There are infinite possibilities to find user generated content for your online monitoring, verification efforts or investigation and I’ve only touched upon a few websites. I suggest you try out Twitter advanced search together with geocode: and keywords such as www.instagram.com as well to find things on Twitter. I won’t even start about VK, Telegram and all other websites, there are just too many to discuss here, but you should know the wealth of information that is out there that you can use when you are trying to find reference material in areas that don’t have good Google Street View coverage or when you need more recent pictures from a location.
Let’s say you are trying to confirm someone took a picture at Dam Square in Amsterdam this month. Odds are high that Google Street view won’t have the latest imagery so you’d have to go to social media to find pictures from users from that place and from that time to confirm they took the picture this month, or earlier. But that’s a topic that we will cover in a different article.
Edit on November 30, 2019: whopostedwhat.com
A couple of months ago the website whopostedwhat.com added a function that automates time filtering for an Instagram location. I meant to add this to the article but I completely forgot, apologies for that.
You will see that this website also has some old Facebook graph search functions. They do not work anymore but the Instagram time filter does. This simplifies the process for people who are not into technical things.
Update on April 13, 2019: Instagram
I should have updated the article a long time ago but didn’t. The trick to go back in time to search for posts tagged to a certain Instagram location doesn’t work anymore and hasn’t worked for some time already (more than a year).