Understanding Expected vs. Actual Counts in Maltego Evidence

Data Completeness and Transparency in Maltego Evidence

Maltego Evidence is designed to preserve and manage digital evidence across multiple use cases. A core principle of the tool is transparency of stored data. While we strive for comprehensive data collection, achieving 100% completeness is not always possible due to limitations imposed by social networks or technical constraints.

For example, when storing followers of an Instagram profile, it may not be possible to retrieve the full list of followers. Even within the Instagram app, you cannot view all followers of a profile. To maintain transparency, Maltego Evidence clearly indicates what data has been successfully stored and what could not be retrieved.

Expected vs. Actual Counts

To provide clarity, Maltego Evidence introduces the concept of expected vs. actual counts. Whenever a counter is displayed (e.g., number of friends, followers, posts), two values will be shown:

• Expected count: The number reported by the social network.
• Stored count: The number successfully preserved in Maltego Evidence.

We can have a look at an example:

In this example we can assume the following:

• Friends
  • According to the network the user has 281 friends
  • We were able to store 253 of these within Maltego Evidence
• Followers
  • According to the network the user has 5.600 followers
  • We were able to store 5.133 of these within Maltego Evidence
• Following
  • According to the network the user follows 67 accounts
  • Either the Following storing was disabled and thus we didn't store any of those, or there was a major issue with the task
• Postings
  • We couldn't figure out how many postings the user has made - that information was not disclosed to us in any form (e.g. on Facebook we don't know how many postings a user has made)
  • However we have stored 133 for that user

These numbers will be everywhere in the future, e.g. number of answers on a comment, number of media items for a posting, etc. They will also be shown in your reports.

The crawling of counts as displayed on the network is a new scraping feature and we will need to build new logic around that. Thus not all numbers can be retrieved in all networks at the moment. We have most of them already on Instagram, Facebook, Twitter and TikTok. Other network and other counts will follow subsequently.