How to investigate a faceboook / instagram impersonation case?

Let us consider a cybercrime scenario where there is a fake facebook, instagram account created which is impersonating a genuine person. Following steps should be taken for investigation.

1. First step would be to register or note the case in your internal police system or records and generate a reference number.
2. Profile Link is the key to investigation of any facebook or instagram account. Take the link from the complainant for further use. Many a times complainant will come with just a screenshot of will show in his phone, in that case, ask the victim to share the link for further use.
3. Now go to the LERS portal for Facebook . A detailed article is already published on the link on step by step guide to requesting data.
4. Facebook will provide IP address and phone number related to the account which is of critical importance.
5. Phone number can be used to seek data from Telecom operator and suspect information can be obtained.
6. Many a times, if phone number is 'virtual number', then the IP address is very much useful.
7. Use the websites for "IP LookUp" for identifying the information of IP Address. For Example - IP Info. By searching the IP address obtained from Facebook records on IP Info, following details are obtained:
8. This IP can again be given to the concerned telecom operator or the hosting provider (in this case Google). Time Stamp is of utmost importance while seeking for IP data.
9. Telecom service provider will give multiple user information because of NATing of IP Address. "Port Number" becomes very much important in such cases to identify original subscriber.

   

10. Thus, after matching the IP with destination IP and port number, original subscriber can be found out. It is interesting to note that facebook's IP in the suspect's IPDR will have ":face:b00c:"