Reconstructing streamed video content: A case study on YouTube and Facebook Live stream content in the Chrome web browser cache

With the increased popularity of online video streaming comes the risk of this technology's subsequent abuse. With a number of cases noted in 2017 where individuals have engaged with illegal or policy breaching video content, digital forensics practitioners are often tasked with investigating the subsequent ‘fingerprint’ of such acts. This is often to determine both the content of a stream in question, and, how it has been interacted with, typically from an analysis of data residing on a suspect's local device. This article provides an examination of the forensic procedures required to identify and reconstruct cached video stream data using both YouTube and Facebook Live as example case studies. Stream reconstruction methodologies are offered where results show that where a YouTube and Facebook Live video have been played, buffered video stream data can be reassembled to produce a viewable video clip of content.