Source-linked AI summary
Forensic Analysis of WhatsApp Messenger on Android Smartphones
Cosimo Anglano
TL;DR
The paper addresses the need for comprehensive forensic analysis of WhatsApp artifacts on Android smartphones. It decodes and interprets generated artifacts, then correlates them to reconstruct contacts and message chronologies and infer contact and message changes. The study concludes that these artifacts provide evidentiary information, while its results are limited to Android.
Problem
Existing WhatsApp forensic work was limited in scope, motivating comprehensive analysis of artifacts generated on Android smartphones.
Method
The paper analyzes WhatsApp artifacts through controlled experiments on YouWave-emulated Android devices and correlates the resulting databases, logs, and files.
Results
Correlating WhatsApp artifacts reconstructs contacts and message chronologies and reveals contact additions or deletions, deleted messages, exchange times, and conversation participants.
Takeaways & Limitations
WhatsApp artifacts can provide evidentiary information that is unavailable from isolated artifacts, including historical contact and message events.
Takeaways & Limitations
The reported results apply only to Android because WhatsApp artifacts differ across smartphone platforms.
Abstract
from arXiv · showhide
We present the forensic analysis of the artifacts left on Android devices by \textit{WhatsApp Messenger}, the client of the WhatsApp instant messaging system. We provide a complete description of all the artifacts generated by WhatsApp Messenger, we discuss the decoding and the interpretation of each one of them, and we show how they can be correlated together to infer various types of information that cannot be obtained by considering each one of them in isolation. By using the results discussed in this paper, an analyst will be able to reconstruct the list of contacts and the chronology of the messages that have been exchanged by users. Furthermore, thanks to the correlation of multiple artifacts, (s)he will be able to infer information like when a specific contact has been added, to recover deleted contacts and their time of deletion, to determine which messages have been deleted, when these messages have been exchanged, and the users that exchanged them.
1 Introduction
Instant messaging applications are increasingly important sources of investigative evidence, and WhatsApp's prevalence motivates detailed Android forensic analysis. The paper addresses limitations in prior work by decoding and correlating WhatsApp artifacts to recover broader information.
- Instant messaging applications can provide rich evidentiary information because they are used in both legitimate and illicit activities.
- WhatsApp's widespread use and large Android user base make its smartphone client a significant target for digital forensic analysis.The paper focuses on Android to maximize the potential investigative impact of the work.
- Prior studies focused mainly on reconstructing message chronology and neglected other important WhatsApp artifacts.
- The paper decodes and interprets all artifacts and data generated by WhatsApp Messenger on Android devices.
- Correlating artifacts supports inferences about contact changes, message delivery and deletion, and group-chat membership over time.
2 Related works
Existing forensic studies examine instant-messaging applications across platforms, but the paper distinguishes its work through broader and more complete WhatsApp artifact analysis and correlation on Android.
- Other studies analyzed different instant-messaging applications or focused on iOS devices and iTunes backups.
- The paper considers all WhatsApp artifacts, including contact databases, log files, avatar pictures, and preference files.
- Compared with prior work, it provides a more thorough analysis of these artifacts and explains how they can be correlated for evidentiary inferences.
- Studies including WhatsApp on Android focused on encryption algorithms or partial acquisition and analysis rather than identifying and correlating all generated artifacts.
3 Analysis methodology and tools
The study uses controlled experiments on software-emulated Android devices to identify and analyze WhatsApp-generated data while improving repeatability, controllability, and acquisition simplicity.
- Controlled usage-scenario experiments were followed by examination of sending and receiving devices to identify, extract, and analyze generated data.
- Open-source acquisition tools were avoided because they might alter memory contents and produce modified or incomplete data.
- Device-specific acquisition tools could prevent third parties from replicating experiments without the same device model and software tool.
- The study replaces physical devices with YouWave-emulated Android devices whose internal memory is stored in parseable VirtualBox files.
- The authors compared WhatsApp behavior and generated data on YouWave with results from real smartphones and prior literature.
- The test-bed used YouWave virtual machines running Android 4.0.4 and WhatsApp 2.11, with one virtual device assigned to each experimental role.
- The emulation approach reduces contamination and incomplete-acquisition risks while supporting repeatability, controllability, and lower study costs.
4 Forensic analysis of WhatsApp Messenger
WhatsApp supports multiple communication modes and content types, and its Android artifacts are stored across files that the paper analyzes and correlates to infer forensic information.
- WhatsApp supports user-to-user communications, broadcast messages, group chats, and exchanges of text, multimedia, contacts, and geolocation data.
- User profiles include a WhatsApp name, status line, and avatar, which are stored centrally and downloaded by users who add the person to their contacts.
- WhatsApp artifacts on Android are distributed across files whose names, locations, and contents are catalogued in Table 1.
- A physical smartphone was required for geolocation-message experiments because YouWave lacked a GPS receiver and Android Location Services.
- The analysis correlates artifacts across contact information, exchanged messages, application settings, and user preferences.
4.1 Analysis of contact information
WhatsApp contact evidence spans the contacts database, avatar files, and log files. Their combined analysis can reconstruct contact lists and timing, identify blocking and deleted contacts, while several inferences remain conditional on artifact availability and logging behavior.
- Contact database: The wa contacts table stores one record per contact, while its other two tables contain housekeeping information without evidentiary value.
- Contact database: WhatsApp-derived fields in wa contacts may have evidentiary value, unlike phonebook fields set by the device user.
- Avatar evidence: Avatar files can link a WhatsApp account to a person's identity, while their timestamps indicate avatar setting and local download times.
- Contact additions: Contact-addition timing is absent from wa contacts but can be deduced from timestamped log events identifying the involved WhatsApp user.
- Contact additions: For a newly added contact, logs record database absence, central-system information queries, and avatar-download completion, enabling a precise addition time.
- Deleted contacts: Deleted contact records may be recovered before SQLite vacuuming; otherwise, comparing reconstructed additions with wa contacts identifies deleted contacts but not deletion times.
4.2 Analysis of exchanged messages
WhatsApp’s chat database and related artifacts support reconstruction of message chronology, content, delivery state, conversation partners, and some deleted-message information. Correlating records, backups, logs, and multimedia artifacts enables inferences unavailable from isolated artifacts.
- Chat database structure: The msgstore.db database stores sent and received messages, conversation records, and internal housekeeping data.Its messages, chat list, and sqlite sequence tables organize message records, conversations, and non-evidentiary internal data.
- Chat history reconstruction: Analysts can reconstruct when messages were exchanged, their contents, involved users, and whether and when recipients received them.The analysis extracts and decodes messages-table records, including fields describing message attributes and content metadata.
- Chat history reconstruction: Message identifiers link corresponding sender and recipient records, allowing the same exchanged message to be correlated across databases.Each identifier combines a sender-side WhatsApp start timestamp with a progressive number and is reused by the recipient.
- Message contents: Multimedia records encode file type, name, size, and thumbnail, while exchange involves local copying, server upload, URL transmission, and acknowledgment.The media wa type and related content fields distinguish non-text messages from textual data stored in the data field.
- Message state: Status values and timestamp fields distinguish undelivered, server-delivered, and destination-delivered messages and track their state changes over time.For sent messages, status=’0’ indicates not yet delivered to the central server, status=’4’ indicates server delivery without destination delivery, and status=’5’ indicates destination delivery.
- Conversation partners and deleted messages: Correlating group-message artifacts reveals whether a user belonged to a group when a specific message was sent.Log analysis can also track group evolution over time, while deleted-message analysis recovers metadata about deletion, exchange, state, and participants but not contents when record recovery fails.
4.3 Analysis of settings and preferences
WhatsApp stores evidentiary information across multiple artifacts, including the registered phone number and the user's avatar picture. These files can help associate a device with a WhatsApp identity and reveal contact history.
- The me file stores the phone number registered with WhatsApp and used to create the corresponding WhatsApp ID.
- Comparing the registered number in me with the SIM card number can reveal whether a different identity is being used on the device.
- The me.jpg file stores the user's current avatar picture, while WhatsApp downloads contacts' avatar pictures locally.
- The locally stored avatar can indicate prior contact even after the other user deletes the corresponding contacts-database record.
5 Conclusions
The paper interprets WhatsApp's Android artifacts to reconstruct contacts and message chronology, then correlates databases and logs to recover additional events. Its results also provide a benchmark for artifact-extraction tools, while remaining limited to Android.
- The contacts and chat databases can reconstruct the contact list and the chronology of exchanged messages.
- Correlating contacts data with log events can identify when contacts were added and recover deleted contacts with their deletion times.
- Correlating chat-database contents with logs can determine which messages were deleted, when they were exchanged, and who exchanged them.
- The complete decoding, interpretation, and correlation results provide a benchmark for assessing whether smartphone extraction tools retrieve all WhatsApp artifacts.
- The findings apply only to Android because WhatsApp artifacts differ across other platforms, including iOS, in stored information, format, or both.