NOTE: This is a revised and updated version of my article published originally in the E-Forensics Magazine in May 2020.
There isn’t a more famous and well regarded source of video content on the whole Internet than YouTube – this is a commonly known fact.
What is also commonly known is that some videos on YouTube are not accessible to the general public and are uploaded in secrecy, to be shared only with a precisely defined audience.
Investigators often limit their searches to searching by keywords or to utilising advanced Google operators to maximise potential keyword results.
However, when searching for hidden content on YouTube, keyword searches don’t work in most cases.
Sometimes when we know the exact date range, we might be able to uncover some content, especially if it was copied or shared amongst several profiles and it was not deleted from every single one.
But this often depends on being able to locate and source the videos from sources other than the YouTube platform.
So what can we do on YouTube itself?
Types of YouTube content
When a user uploads a video to YouTube, there are three main privacy settings to choose from for that
video:
1. Public – nearly every video on YouTube, by default viewable by anybody, anywhere, with no
restrictions.
2. Private – an invitation-only video, not searchable, not indexed anywhere and not visible publicly.
Sharing private videos with users who were not invited to view them does not work and no connection
and viewing of such videos is possible.
3. Unlisted – a video that does not display on a user’s channel and is not searchable. However, unlisted
videos do not disappear from the public YouTube stream – you simply have to have the correct URL link
that is also shareable with other users.
There are two good methods of searching for unlisted videos.
The first method involves using Google search operators to search for specific text that YouTube used
to mark unlisted videos with:
site:youtube.com “This video is unlisted” OR “This video is unlisted. Only those with the link can see it”
This is a very broad search and it’s based on detecting the above text.
It will not be very useful for searching for specific keywords, it will simply return videos from the site (YouTube) marked with the phrases seen above.
Note that many of the videos found this way are old and that some have been listed publicly since being initially unlisted on users’ profiles. Yet, they are still associated with being unlisted.
If you are trying to find specific content by keywords that appear in the title, you can modify your search to something like this:
site:youtube.com “This video is unlisted” intitle:joke
The second method can be more reliable, but this depends on the context of your investigation.
There is a website that indexes unlisted videos:
There you can search for a more defined keyword.
To illustrate this with an example, let’s search for a well known British boxer, Amir Khan.
You can follow the video from the link, which brings us to the original video on Reebok’s official YouTube channel:
https://www.youtube.com/watch?v=ECadNbHrNig
The video will play as normal and you can freely share it.
But to contrast this, if you were to manually look for it on Reebok’s official YouTube channel, it won’t be found there….
Preview a YouTube video by frames
Every video on YouTube that is indexed and available online has its frames captured and recorded by the platform.
Triaging a video by frames can be useful if you are trying to get a quick YES/NO answer or perhaps to reverse search for those image frames on Google or elsewhere.
To illustrate this, we can use our Amir Khan video from Reebok:
https://www.youtube.com/watch?v=ECadNbHrNig
ECadNbHrNig – this is the unique video identifier.
Use that to paste into the URL as seen below:
https://img.youtube.com/vi/ECadNbHrNig/0.jpg
You can then manipulate the digits (but only from 0 to 3) in order to preview the video frames captured
by YouTube.
Note that the first frame marked with 0 will have the best quality.
- https://img.youtube.com/vi/ECadNbHrNig/0.jpg
- https://img.youtube.com/vi/ECadNbHrNig/1.jpg
- https://img.youtube.com/vi/ECadNbHrNig/2.jpg
- https://img.youtube.com/vi/ECadNbHrNig/3.jpg
Finding deleted videos on YouTube
When a video gets removed from YouTube, it is gone off the platform for good.
But we know that in many cases (not always) online content tends to stick around in places other than where it was initially uploaded.
Sometimes, YouTube videos get indexed by the Wayback Machine, depending on how long they were available for before they were removed.
For example, our Amir Khan video is not archived by the Wayback Machine, therefore it’s not accessible on that archive.
But to demonstrate this technique works and how it works, I intentionally picked an old video that was on YouTube for a long time before it was deleted for violating YouTube’s terms of service:
https://www.youtube.com/watch?v=t1wjL4BqXlI
The link to the Wayback Machine content for this video is here:
https://web.archive.org/web/20121101000000*/https://www.youtube.com/watch?v=t1wjL4BqXlI
Navigating through various snapshots of the Wayback Machine we notice that we not only have access to various older iterations of YouTube, but also to comments located under the video, as well as some useful information such as user account names, user interactions, additional URL links, etc.
In this case the actual video does not play (it’s a HTML archive), but you can navigate through video frames using the slider under the video screen.
Also this method allows for scraping additional content and taking it away for the purpose of conducting further investigation.
List of Youtube search filter links
Above I illustrated some methods of manipulating URLs to obtain Youtube video frames.
Youtube allows you to use search filters to narrow down search criteria and these filters are accessible from the Youtube page after you have conducted your initial search.
Sometimes however it might be easier to go directly to the URL and search from there.
This works well with settings like incognito mode or whenever for some reason you don’t want to use Youtube’s search interface (digital footprint?) or be logged in and associate your search activity with your Google account.
So how does this work?
Let’s imagine we want to search for a term “pasta”.
To search directly from the URL, simply replace the term “pasta” in the URL string with a keyword of interest (I marked it in bold within the URLs below).
Any time you have a space (like for instance “tasty pasta”), the URL string must containt a + symbol instead of a space, so you are searching for “tasty+pasta”.
- YT Channel search:
https://www.youtube.com/results?sp=EgIQAg%253D%253D&search_query=pasta
- YT Playlist search:
https://www.youtube.com/results?sp=EgIQAw%253D%253D&search_query=pasta
- YT Live Video search:
https://www.youtube.com/results?sp=EgJAAQ%253D%253D&search_query=pasta
PS. To finish this off, two handy resources to add to your YouTube OSINT arsenal:
Watch Frame by Frame – allows for manually navigating through a full video, frame after frame.
YouTube Data Viewer – presents video metadata in a handy format, with some extracted thumbnails for reverse image search.