Mobile Forensic Tools Validation and Evaluation for Instant Messaging

Abstract

Mobile technology is experiencing rapid development from year to year. Various types of models and operating systems are available on the market, followed by the development of applications for mobile devices. Behind the development of mobile technology, mobile devices are often used for crime. To handle a case related to a mobile device, an investigator needs to use forensic methodologies. Investigator also needs to know which tools are capable of handling mobile forensics of a specific artefact or mobile devices since each forensic tool has its limitation. The rapid development of mobile technology and the lack of understanding of forensic tools sometimes become an obstacle for an investigator in handling a case. This research conducted a forensic analysis of WhatsApp (WA) application on the Samsung Galaxy S4 and Samsung A3 using the logical acquisition of 3 forensic tools, namely: WA Key/DB Extractor, Oxygen Forensics, and Magnet AXIOM. National Institute of Standards and Technology (NIST) forensic tool parameters and additional parameters related to WA artefact s were used to evaluate forensic tools which will then be calculated to find acquisition capability index for each forensic tool. Acquisition capability index is expected to provide an overview and recommendations regarding forensic tools for conducting WA forensic analysis. Based on the acquisition capability index, Magnet AXIOM has advantages over Oxygen Forensics, and WA Key/DB Extractor in conducting forensic analysis of WA artefact s on Samsung Galaxy S4 and Samsung A3 with 77.77%. Thus it can be concluded that Magnet AXIOM is recommended to be used in handling WA artefacts.

Mobile Forensic Tools for Digital Crime Investigation: Comparison and Evaluation

“…Along with the development of smartphone use followed by increasingly varied social media, the choice of using instant messengers is also increasing. Examples include Whatsapp, LINE, Telegram, and Signal [5][6][7]. However, more and more activities conducted using instant messenger features have the potential to be exploited by users who are not responsible for cybercrime crimes [8][9][10].…”

Forensic Mobile Analysis on Social Media Using National Institute Standard of Technology Method

“…Table 1 shows some personal information that may be utilized as a resource for social media attacks and the many types of attacks that can be employed. Digital forensics is very challenging because of security vulnerabilities in the data to be searched [8]. Digital forensics is a forensic science that aims to find evidence of crimes in the digital world [9].…”