New Digital Forensics Research Reveals Hidden Timestamps in Facebook and Instagram Links
New research reveals hidden timestamps and tracking data in Facebook and Instagram links, offering fresh clues for digital forensic investigations.
A digital forensics researcher has discovered that certain Facebook and Instagram tracking links contain more information than previously understood, including timestamps and identifiers that could help investigators reconstruct online activity.
The findings were published by Ryan Benson of Hindsight Foundry on October 8, 2026, and were featured in a November 3 digital forensics news roundup.
The research focuses on "fbclid", a tracking parameter automatically added to some links opened through Facebook and Instagram. Although these identifiers appear to be random strings, Benson found that newer versions contain structured information.
By examining approximately 50,000 URLs collected from sources including Common Crawl and the Wayback Machine, the researcher identified embedded fields associated with click timestamps, browser identifiers, source applications, and advertising information.
One particularly significant discovery involved timestamps that use a nonstandard reference point rather than the conventional Unix epoch.
Benson incorporated the decoding capability into Unfurl, an open-source forensic tool that examines URLs and extracts potentially useful information from encoded identifiers.
For investigators, these findings could provide additional context when examining browser histories, archived webpages, phishing links, and other digital evidence.
A recovered tracking URL may help establish when a link was generated or indicate which application produced it, potentially supporting the reconstruction of an investigative timeline.
However, the research has important limitations.
The format was reverse-engineered and has not been officially documented by Meta. Some field interpretations remain provisional, and not every tracking identifier contains the same information.
Furthermore, a timestamp or browser identifier does not independently establish who clicked a link or prove that a particular person accessed a webpage.
The findings demonstrate how apparently insignificant URL parameters can contain useful forensic artifacts, while reinforcing the need to validate their meaning before relying on them as evidence.