Forensic WhatsApp based Android using National Institute of Standard Technology (NIST) Method

Abstract

WhatsApp Messenger is a popular Instant Messaging (IM) application that is widely used in the 2017-2019 range. A large number of WhatsApp Messenger users will certainly have a positive and negative impact, the negative effects that are usually found are cases of crimes such as fraud into cybercrime crimes. The way to prove the perpetrators of the crime is to find evidence through digital forensics. This case will be revealed by one branch of digital forensics, namely mobile forensics because the evidence obtained is a smartphone which is a mobile device. This research uses the method of the National Institute of Standard Technology (NIST). NIST is a method that conforms to standards in the forensic field and has 4 forensic stages namely Collection, Examination, Analysis, Reporting. The results of this study are a comparison of evidence between a smartphone in a smartphone and a smartphone without a smartphone. The rooted smartphone managed to get an 11 encrypted and 1 decrypted conversation database, 152 images received and 60 sent, 8 conversation times, 8 video notes, 3 folder voice notes, 1 document sent and 5 received. Smartphones not rooted only managed to get evidence in the form of text conversations and the time of sending messages.

Forensic Analysis of “WhatsApp” Artifacts in Android without Root

“…indicate that the evidence was obtained through backup without rooting the device, and it was stored in another storage unit, and the analysis was started by open-source forensic tools, and the results showed that part of the conversations was encrypted and there were challenges in showing the results. It is not encrypted and the deleted conversations did not appear in the results, and the results indicate that to recover the deleted conversation, the device must be rooted [23]. indicates that a backup copy of Android was obtained and saved on an external memory card and analyzed on the open-source forensic analysis tools and that the database of correspondence and conversations was obtained, and even if the results obtained from Android are encrypted, the elements are evidence of correspondence, and here this study indicates that the device has not been rooted [24].…”

Forensic Web Analysis on The Latest Version of Whatsapp Browser

“…This journal examines whether existing forensic tools can provide digital evidence to provide additional support and correlation to traditional investigative methods. This primarily focuses on artifacts from popular applications around the world (Iqbal & Riadi, 2019).…”