Abstract • Features, such as ephemeral messaging, encryption, and trail obfuscation, encourage users to communicate more freely whilst feeling secure that third parties are not intercepting their data. However, these features also encourage criminal usage as they are advertised as offering messaging that ensures that only the intended receiver can access. • The study focuses on WhatsApp, Signal, Snapchat, and Telegram. Four popular applications that make use of a range of anti-forensic features. The use of these applications by criminals is increasing due to the secureness these features advertise • This study aims to identify what data can be recovered from Snapchat, WhatsApp, Signal and Telegram and seeing which (if any) of these artefacts could be used as evidence in a criminal investigation. Using an iPhone and Android, alongside Cellebrite.
Project Details • This study aimed to investigate secure messaging applications used on mobile platforms to identify which data can be recovered and used for evidential purposes. • The project uses the Model of Argument, a model used for a research investigation. Investigations study a cause and effect relationship between a dependent and independent variable. The independent variable in the study is the applications used and the dependent is how many artefacts can be gathered from the applications.
• The study focuses on the 1-to-1 messaging features that the applications provide. • Forensic images of the devices were taken. Different forensic image types are available and an Advanced Logical image was taken of the iPhone. Logical, File System and Physical images were taken of the Samsung device. • These images were then investigated and the results noted.
Project Results • Artefacts were gathered from both devices for all applications. • However, different amounts of data were gathered from the applications, depending on the features being tested. • The mobile device operating systems may also have effected the amount of data gathered. • The next slide shows a table representation of the results found.
Results Feature being tested Voice and Video Calling
Snapchat All
iPhone Signal WhatsApp All
All
Messaging
None
None
All
Media Sharing
None
None
All
Contact Lists
None
None
All
Status Updates Secret Chats Self-Destructing Messages Deleting Messages for both Sender and Receiver
Stories
Location Sharing
Samsung Telegram
Snapchat
Signal
Telegram
All
Image
Image
All
All
All
Call Receipts
All
All
All
All
Contents but no sender/receiver Self-Destructed details None None Name and linking All rawValue
All but sender/recipient details None All
None
All None
None
None
None
None
None
None
None
None
None
None
None
None
None
Evidence but no contents
None
None
None
Evidence but no contents
None
None
None
Media found but no indication they were from WhatsApp
None
Located in WhatsApp folders but no indication they were story media
All
Evidence in an image but no contents
All
None
All
Conclusion • The study showed WhatsApp generated the most forensic data and Signal gathering the least. • Following the analysis of the results the continuation of research into the understanding of how the applications communicate with the file systems of devices is emphasised. • An idea to create a liaison team between the application developers and forensic teams would help with the understanding of where the information resides in a device’s file system. Research and communication between the two teams may be helpful for forensics teams to influence in development of the applications so that their storage systems are forensics friendly