Expected vs. Real Counts

Maltego Evidence is, among other use-cases, an evidence preservation tool for many. Thus transparency of data is key. At the same time Maltego Evidence might sometimes not be able to achieve 100% data completeness. For example when storing followers of an instagram profile, we might not get all of the followers by instagram. Not even on the instagram app will you be able to view all followers of a profile. Thus we want to be transparent in our outputs what we did save and what we didn't save.

With expected vs. real counts Maltego Evidence tries to go a step in that direction. Everywhere where there is any "counter", meaning a display of how many items a user has, there will be to numbers displayed.

We can have a look at an example:

In this example we can assume the following:

• Friends
  • According to the network the user has 281 friends
  • We were able to store 253 of these within Maltego Evidence
• Followers
  • According to the network the user has 5.600 followers
  • We were able to store 5.133 of these within Maltego Evidence
• Following
  • According to the network the user follows 67 accounts
  • Either the Following storing was disabled and thus we didn't store any of those, or there was a major issue with the task
• Postings
  • We couldn't figure out how many postings the user has made - that information was not disclosed to us in any form (e.g. on Facebook we don't know how many postings a user has made)
  • However we have stored 133 for that user

These numbers will be everywhere in the future, e.g. number of answers on a comment, number of media items for a posting, etc. They will also be shown in your reports.