Social media video content is an important part of any investigation or analyst's work. The platforms that host videos can rapidly take down content based on their policies, which are not universal & are at the discretion of the platform. Additionally, users of the platforms are also in control of their content & can remove it without notice.
This leads to a key requirement where investigators & analysts need to be able to download content offline for further analysis & to often preserve evidence that applies to any number of use-cases. Being able to do this without reliance on web-hosted or 3rd party tools gives us confidence in always being able to achieve the download, whilst reducing privacy and attribution concerns that an investigator might have which is introduced when using 3rd party tools as they often rely on advertising revenue to stay online. Note: trademark & copyright laws should be adhered to at all times, so be aware of your actions & OSINT Combine takes no responsibility for any actions as a result of using these techniques.
We are going to learn the guiding principle which will allow you to target most platforms that host video content, and then walk-through how to do this on Facebook, Instagram, SnapChat, TikTok & YouTube simply to demonstrate the approach.
When videos are hosted on websites, they are generally delivered to the end-user in MP4 or WebM format. This is done via embed code which wraps the video content into the user-interface and usually restricts direct downloads via a right-click on the video itself when it is playing. However, the fact the content is being delivered means it has to be referenced to an original source, usually via a content-delivery-network (CDN). This is where we apply the basic principle of:
This process can be different, which we will see with YouTube, particularly if the content is delivered in WebM format. However, as a principle, the above approach will work for a large portion of video content delivered via social media or online.
The below examples are simple walk-throughs of how this occurs which highlights the guiding principle above. There will often be slight variations, which we will see with Facebook & YouTube, so you may need to dig around.
You will see that Facebook varies slightly. Due to the availability of the static-html version of the site by visiting mbasic.facebook.com, we are able to do the process without developer tools.
YouTube delivers content via WebM, instead of MP4. This means we need to extract the stream URL first which will then let us download the holistic video using VLC which is a light-weight media viewer available on all operating systems (www.videolan.org).
If we applied the general approach & filtered by "WebM" instead of "MP4", we could download a link to the raw stream but it would not capture the entire video for offline use. This is why we use VLC first, then view the captured stream back in a browser to allow us to download it.
The process is simple & should allow for repeatable success across not just the examples above, but most platforms delivering video content. This is important to reduce our reliance on 3rd party tools & maintain control over any attribution of our actions. Additionally, It is important to respect appropriate trademarks & copyright of the material you are seeking to download.