Forensic Analysis of Instant Messenger Applications on Android Devices

• Mobile messaging enables people to exchange messages, images, videos, activities, and events, while privacy is increasingly vulnerable to hackers and fraudsters [2012 Alfred].Source: §1 · p. 1
• Criminals use WhatsApp and Viber to exchange information around crimes, partly because extracting phone data is difficult and application logs are not saved by internet service providers.Source: §1 · p. 1
• The paper examines data stored by instant messenger applications on phones and forensic techniques for extracting it, given its potential role in cybercrime investigations [2010, Mohammad I. Husain].Source: §1 · p. 1

2. FORENSIC CHALLENGES AND STORAGE ARTIFACTS

• Forensic procedures should avoid changing or writing data on the original device, and the section emphasizes identifying the structures and locations where messenger artifacts are stored.Source: §2 · p. 2, §2.4 · p. 2

2.1 Android Forensics & Challenges

• Android forensic examination is complicated by encryption, deletion, remote wiping, and continual application and operating-system updates that challenge investigators and available tools.Source: §2.1 · p. 2

2.2 Proposed Method

• The proposed method uses Cellebrite UFED filesystem extraction on five Android phones running three Android versions to examine internal files and directory structures.Source: §2.2 · p. 2

2.3 FileSystem Acquisition

• UFED filesystem extraction collects the files and folders in internal memory, including database and configuration files, with each application's data stored in a separate folder.Source: §2.3 · p. 2

2.4 Artifacts,

• WhatsApp messages reside in internal-memory databases, while downloaded or uploaded media files are stored on the external memory card; Viber has five database files, three of which are important for forensic examination.Source: §2.4 · pp. 2–3

3. Methodology

• The study examines whether messaging and information-sharing activity using WhatsApp and Viber is stored in Android phones' internal memory, using forensically accepted equipment and conditions on rooted and non-rooted phones.Source: §3 · p. 3

3.1 Testing Equipments & Environment

• The test environment included forensic workstations, servers, hardware, software, and write blockers for the phone examinations.Source: §3.1 · p. 3

3.2 Testing & Analysis

• The testing process has three stages: scenario testing, filesystem analysis, and identification.Source: §3.2 · p. 3

3.2.1 Scenarios

• The pre-installed-app scenario examined applications that users had already used heavily; WhatsApp use covered almost all features, while Viber use covered its basic features.Source: §3.2.1 · p. 3

Installing applications manually & conducting User

• In the manual-installation scenario, researchers installed both applications, performed predefined activities using their features, and used them continuously for more than two weeks.Source: Installing applications manually &… · p. 3

3.2.2 FileSystem Analysis

• After filesystem extraction, the researchers examined acquired files and directories for relevant application databases and logs, their data, and database structures.Source: §3.2.2 · pp. 3–4

• The researchers loaded the UFED-generated .ufd file into Physical Analyzer for application analysis.Source: §1 · p. 4
• Physical Analyzer displayed artifacts for WhatsApp during the examination.Source: §1 · p. 4
• Physical Analyzer displayed no data related to Viber in this analysis.Source: §1 · p. 4

2. Manual Analysis of data

• Manual review found a databases folder and several .db files in both WhatsApp and Viber directories.The authors describe these files as containing important data.Source: §2 · p. 4

3.2.3 Identification

• The identification stage searched internal memory for activity logs because the logs were not stored on the phone’s external memory card.Extracted folders and directories were explored for application artifacts.Source: §3.2.3 · p. 4
• Table 8 is titled as the UFED-generated Android hash-value record.The supplied table passage gives its scope, not the hash values.Source: Table 8 · p. 4

4.1 WhatsApp Application Forensic Examination & Artifacts

• Table 9 is titled as WhatsApp information from Physical Analyzer.The supplied table passage does not specify its artifact values.Source: Table 9 · p. 5
• Across tested Android versions, WhatsApp’s directory structure remained the same, with almost all user-activity logs stored in internal-memory databases alongside date and time stamps.The section says detailed descriptions appear later in the paper.Source: §4.1 · p. 5

4. EXPERIMENTS AND RESULTS

• Three of the five tested phones had both applications pre-installed and in use for more than three months, and substantial information was retrieved from those phones.The other tested phones had WhatsApp pre-installed and Viber installed for the research.Source: §4 · p. 5

4.1.1 Artifacts Found in UFED Physical Analyzer

• WhatsApp’s UFED Physical Analyzer output included user chat sessions and timestamps for each session.The authors refer to Table 9 for artifact information.Source: §4.1.1 · p. 5

4.1.2 Artifacts found in Manual Analysis

• Manual WhatsApp analysis found msgstore.db for chat history and wa.db for contacts, with messages, phone numbers, timestamps, and chat-list entries in the databases folder.The folder path is \data\data\com.whatsapp\databases\.Source: §4.1.2 · pp. 5–6
• Manual WhatsApp analysis also found the account user’s profile picture in com.whatsapp/files.The passage points to a screenshot of real phone logs at the end of the paper.Source: §4.1.2 · p. 6

4.2.1 Artifacts Found in UFED Physical Analyzer

• UFED Physical Analyzer showed no Viber traces or artifacts on the examined phones.Source: §4.2.1 · p. 6

4.2.2 Artifacts Found in Manual Analysis

• Viber examination reported records and logs of messaging history and calls made and received by users.The passage places this result in the manual-analysis discussion.Source: §4.2.2 · p. 6

Physical Analyzer but showing WhatsApp Artifacts

• Viber_data and Viber_messages were identified as two files holding Viber logs, despite having no file extensions.Source: Physical Analyzer but showing WhatsApp… · p. 6
• The two extensionless Viber files were recognized as database files and opened in SQLite Database Browser.Source: Physical Analyzer but showing WhatsApp… · p. 6
• The examined Viber files contained data the authors characterized as important.Source: Physical Analyzer but showing WhatsApp… · p. 6

5. SUMMARY

• WhatsApp examination recovered chat artifacts, timestamps, and sent- and received-file names in Physical Analyzer, although the files’ storage locations were not found.Manual analysis found msgstore.db for chats and timestamps, wa.db for contacts, and an Avatars folder containing correspondents’ profile pictures.Source: §5 · pp. 6–7
• Manual Viber examination recovered message logs and call history with timestamps, including call numbers and sent and received messages.The paper identifies Viber_call_log.db for call information and Viber_messages and Viber_data for messages and contact-list information.Source: §5 · pp. 6–7
• For Viber, manual analysis mattered because Physical Analyzer displayed no application artifacts or data.Source: §5 · pp. 6–7

6. CONCLUSION AND FUTURE WORK

• Manual analysis found WhatsApp and Viber artifacts, including chat history, messages, sent and received media locations, contacts, call details, and timestamps.These artifacts were identified in extracted data and could help forensic investigators and agencies in cyber investigations.Source: §6 · p. 7
• Physical Analyzer provided artifacts related to WhatsApp only, while manual folder-by-folder analysis found artifacts for both applications.Source: §6 · p. 7
• The analysis focused on live artifacts and did not examine deleted-data recovery or recovery after a factory reset; both were left for future work.Source: §6 · p. 7