A Forensic Analysis Visualization Tool for Mobile Instant Messaging Apps

Abstract

In this study, we demonstrate the role of visualization to facilitate forensic analysis goal in interpreting metadata of evidence of interest to answer who, what, why, when, where, and how an incident occurred. Two mobile Instant Messaging (IM) applications (i.e. WhatsApp and Line) were deployed as a case study. Subsequently, a tool – W*W Visualizer – was designed and developed with the aims to analyze and visualize the connection of evidence metadata, text frequency and word count, and display report of analysis activities. The tool is developed by adopting Object-Oriented Software Development Model with Visual Studio platform and C# language were used to develop the system. Our findings show that W*W Visualizer could transform the data of the chat database into a visual form, for example graph, chart and word cloud. The tool also allows the user to perform search feature such as searching based on keyword and timestamp from the IM chat history. It is expected that outcomes from this study would significantly influence digital forensics practitioners in analyzing and interpreting evidence data, and judicial authorities in understanding the presentation of evidence.

A Survey of Forensic Analysis and Information Visualization Approach for Instant Messaging Applications

“…Using WhatsApp and LINE as case studies, [51] proposed a tool that applied the information visualization approach to support forensic analysis activities. Using visualization techniques, the tool was able to visualize key information, such as total number of messages, number of contacts, top-most frequent contact, top-most frequent words, and location map.…”

“…Tool usability was evaluated through application functionality testing and user testing. In a similar study, [51] presented a tool to visualize WhatsApp and WeChat metadata. Examples of data visualization were chat history, timeline of chats, frequent contacts, and location maps.…”

“…The InfoVis data types were adopted from [53], while the list of visualization techniques was adopted from a survey conducted in [68]. [64], [72], [51], [59], [60], [65], [62] From Table II, we can see that forensic visualization was applied in various case studies, including recent computing trends, such as the Internet of Things. This finding accords with an earlier observation in [52], which showed various applications of InfoVis.…”

“…This is, therefore, not surprising because most smartphone apps comprise textual and geo-spatial data. For example, the three case studies of [5], [64], and [51] used the word cloud to visualize textual data from communication and IM apps. This indicates that the metadata from smartphones involved enormous text-based data.…”

“…Therefore, there is a need for benchmarking evaluation methods in this research area. References Technical simulations (e.g., case studies) to evaluate tool usability [56], [59], [60], [61], [63] User testing to evaluate tool functionality and performance [64], [51], [62], [66] Focus group to solve forensic challenges [57], [58], [65] In relation to the automated forensic tools metrics proposed by Ayers [32], speed (absolute and relative), reliability, accuracy, and completeness are the evaluation metrics used in existing studies. This is in line with our finding from automated IM forensic analysis tools, which show that performance and functionality are the most applied metrics.…”