An experimental approach for locating WhatsApp digital forensics artefacts on Windows 10 and the cloud
by Yaman Salem; Majdi Owda; Amani Yousef Owda
International Journal of Electronic Security and Digital Forensics (IJESDF), Vol. 15, No. 3, 2023

Abstract: The increased popularity of WhatsApp resulted in its extensive use as a tool in planning unlawful activities. In order to conduct an investigation in WhatsApp, the WhatsApp artefact should be located. This poses challenges to digital forensic investigators. This study investigates WhatsApp artefacts on Windows volatile and non-volatile memories. WhatsApp desktop and WhatsApp web were analysed. A set of four experiments were conducted. Experiment 1 investigates WhatsApp web artefacts via the cloud, experiment 2 investigates WhatsApp web artefacts on non-volatile memory, experiment 3 investigates WhatsApp desktop artefacts on non-volatile memory, and experiment 4 investigates WhatsApp web/desktop artefacts on volatile memory. Results demonstrated that all related artefacts were recovered from the WhatsApp web via the cloud. Moreover, a log file containing user's activities, contact numbers, and browser history, were recovered from non-volatile memory. Messages in clear text and part of images were recovered from volatile memory. This study provided a holistic approach for locating and analysing WhatsApp artefacts.

Online publication date: Tue, 02-May-2023

The full text of this article is only available to individual subscribers or to users at subscribing institutions.

 
Existing subscribers:
Go to Inderscience Online Journals to access the Full Text of this article.

Pay per view:
If you are not a subscriber and you just want to read the full contents of this article, buy online access here.

Complimentary Subscribers, Editors or Members of the Editorial Board of the International Journal of Electronic Security and Digital Forensics (IJESDF):
Login with your Inderscience username and password:

Username:        Password:          Forgotten your password?

Want to subscribe?
A subscription gives you complete access to all articles in the current issue, as well as to all articles in the previous three years (where applicable). See our Orders page to subscribe.

If you still need assistance, please email subs@inderscience.com