fblogs

A local, offline viewer for a Facebook "Data Logs" export.

Facebook's data download has one section left unticked by default: Data logs. It takes about 15 days, arrives as a separate archive, and holds the deep telemetry tier the tidy profile export never shows you: request logs, device and network fingerprints, proximity-based location, the third-party vendors reading your activity, and the advertisers holding your contact info.

fblogs ingests that export into a single SQLite database and serves a fast, searchable, forensic UI on 127.0.0.1. No cloud, no upload, no external calls at runtime. Your export never leaves your machine.

Tested against a real export: 429,793 rows across 161 tables, ingested into a ~450 MB database, fully searchable in the browser.

Companion tool to the write-up on blog.osintph.info. Built by OSINT-PH.

---

Features

• One-command ingest of the whole export (.zip or unzipped folder) into fblogs.db (SQLite + FTS5 full-text index).
• Query view: browse any of the 161 tables with live row counts, full-text search across every field at once, filter by Manila date range, and page through results.
• Overview dashboard: activity-over-time (the retention cliff), a pattern-of-life heatmap, time-spent-by-platform, and top-talker bar charts for busiest tables, third-party vendors, advertisers, and outbound domains.
• Redaction for screenshots: everything is visible by default (it is your data). Flip one switch and PII-carrying fields (IP, location, cookies, user agent, session IDs, post/content URLs) black out as marker bars, so you can screenshot for a blog without leaking anything. Click a bar to reveal a single value.
• Offline and self-contained: standard-library Python, one HTML page, no CDN, no browser storage. Runs on an air-gapped host. Binds to localhost only.

---

Quick start

git clone https://github.com/osintph/fblogs.git
cd fblogs

python3 -m venv .venv
. .venv/bin/activate
pip install -r requirements.txt

# build the database from your export (zip or unzipped folder both work)
python3 ingest.py /path/to/facebook-export.zip

# serve, localhost only
python3 app.py            # http://127.0.0.1:8713

Then open http://127.0.0.1:8713. On a headless server, tunnel instead of exposing it:

ssh -L 8713:127.0.0.1:8713 you@your-server

There is also a ./run.sh that bootstraps the venv and dependencies on first run.

---

How it works

The export stores every table as JSON under data_logs/content/<category>/<table>/, each row carrying a Unix timestamp and a list of label_values. ingest.py flattens that into one events table (category, table_name, ts, data as JSON) plus a tables_meta catalogue and an FTS5 index over the flattened text. app.py is a small FastAPI service exposing /api/meta, /api/query, /api/timeline, and /api/overview; index.html is the whole UI in one file.

ingest.py       export  ->  SQLite (schema, flattening, FTS build)
app.py          FastAPI JSON API + static page (query_only, localhost)
index.html      single-page UI (vanilla JS, system fonts, no deps)
run.sh          venv-bootstrapping launcher
requirements.txt

The server opens SQLite in query_only mode and never writes back to the export or the database.

---

Search syntax

The search box is SQLite FTS5:

Query	Matches
spotify	rows containing the word spotify
"custom audience"	the exact phrase
ip AND cookie	both terms present
brandwatch OR talkwalker	either term
stores near*	prefix match

Invalid FTS syntax returns a friendly error rather than crashing.

---

Configuration

• Timezone: display is Asia/Manila. Change MANILA near the top of app.py.
• Redaction set: the labels that black out in screenshot mode are SENSITIVE_LABELS in app.py, matched as case-insensitive substrings. Add or remove entries and refresh.
• Bind address / port: python3 app.py --host 0.0.0.0 --port 9000 only if you deliberately want LAN access. There is no auth; the security model is "localhost only." If you expose it, put it behind your own reverse proxy with access control.

---

Privacy

fblogs is built for reading your own export. It makes zero outbound requests at runtime. The only network access in the whole workflow is the one-time pip install to fetch FastAPI and uvicorn; after that it runs fully offline. Nothing is uploaded, ever.

Do not commit real data: the included .gitignore excludes *.db, *.zip, data_logs/, and the venv.

---

License

AGPL-3.0. Same as Suri. If you run a modified version as a network service, share your changes.