Computer forensics tools, such as EnCase (Guidance, 2012) and the Forensic Toolkit (Access Data, 2012), are used by examiners to recreate files and data from a suspect's computer. An image of the hard drive is taken to replicate the original data source to ensure evidence integrity as all analysis is carried out on the image of the original hard drive. A forensics tool is then used to recreate the logical structure of the underlying file system. A computer forensic analyst views the files, both extant and deleted, and files of interest are reported with supporting evidence, such as time of investigation, analyst's name, the logical and actual location of the file, etc. However, as discussed above, these tools are designed to analyse evidence retrieved from storage media rather than examine data from online sources such as social media. This is problematic as investigations involving social networks formed through social media have risen in prominence due to the information about a suspect that these data sources may yield to the forensic examiner.