An Evidence‐Based Forensic Taxonomy of Windows Phone Communication Apps

Abstract

Communication apps can be an important source of evidence in a forensic investigation (e.g., in the investigation of a drug trafficking or terrorism case where the communications apps were used by the accused persons during the transactions or planning activities). This study presents the first evidence-based forensic taxonomy of Windows Phone communication apps, using an existing two-dimensional Android forensic taxonomy as a baseline. Specifically, 30 Windows Phone communication apps, including Instant Messaging (IM) and Voice over IP (VoIP) apps, are examined. Artifacts extracted using physical acquisition are analyzed, and seven digital evidence objects of forensic interest are identified, namely: Call Log, Chats, Contacts, Locations, Installed Applications, SMSs and User Accounts. Findings from this study would help to facilitate timely and effective forensic investigations involving Windows Phone communication apps.

An Evidence‐based Forensic Taxonomy of Windows Phone Dating Apps

“…The first such taxonomy was a forensic taxonomy on Android social apps, presented by Azfar et al. , and the second taxonomy considered was our prior forensic taxonomy of Windows Phone communication apps . Other than these two forensic taxonomies, the design of the current taxonomy was based on the artifacts extracted from the case study.…”

“…The majority of existing forensic taxonomies are, however, based on analysis conducted on Android apps, with the exception of the Windows Phone communication app forensic taxonomy . The lack of research on Windows Phone 8 platform is understandable because of its decreasing market share .…”