Forensic Analysis of “WhatsApp” Artifacts in Android without Root

Abstract

WhatsApp application is considered the largest messaging application around the world and an important source of information, they just incorporated a new technique that operates on end-to-end encryption, which presents a significant problem for forensic investigators and analysts. This study describes how to recover the encryption key from WhatsApp to decrypt WhatsApp databases and retrieve important artifacts displayed and saved in the Android system without rooting the device. As a means of presenting and analyzing artifacts taken from the most recent version of WhatsApp to signs of fresh and important evidence and artifacts to assist investigators and forensic analysts in the investigation. As a result, various techniques, devices, and software may now be utilized for WhatsApp digital forensics. The findings of this study showed a variety of artifacts in the internal memory unit utilized by the Android system for the WhatsApp application, which might aid digital forensic examiners in their examination of WhatsApp on the Android system without the need to root the device.

Forensic Analysis of WhatsApp Disappearing Message on Unrooted Android Using Mobile Device Forensics Methodology NIST SP 800-101r1

“…Fayyad-Kazan et al extracted an unencrypted database and encryption key from WhatsApp SQLite Databases on unrooted Android devices using the APK downgrading method and WhatsApp Key Database Extractor tool, successfully reconstructing message history 26) . Shadeed et al conducted a study to analyze encrypted WhatsApp data on unrooted Android devices 27) . The data was acquired through ADB, utilizing APK downgrading to extract the encryption key, allowing for the decryption of the message.…”