Forensics Acquisition and Analysis of instant messaging and VoIP applications

摘要

The advent of the Internet has significantly transformed the daily activitiesof millions of people, with one of them being the way people communicate whereInstant Messaging (IM) and Voice over IP (VoIP) communications have becomeprevalent. Although IM applications are ubiquitous communication toolsnowadays, it was observed that the relevant research on the topic of evidencecollection from IM services was limited. The reason is an IM can serve as avery useful yet very dangerous platform for the victim and the suspect tocommunicate. Indeed, the increased use of Instant Messengers on smart phoneshas turned to be the goldmine for mobile and computer forensic experts. Tracesand Evidence left by applications can be held on smart phones and retrievingthose potential evidences with right forensic technique is strongly required.Recently, most research on IM forensics focus on applications such as WhatsApp,Viber and Skype. However, in the literature, there are very few forensicanalysis and comparison related to IM applications such as WhatsApp, Viber andSkype and Tango on both iOS and Android platforms, even though the total usersof this application already exceeded 1 billion. Therefore, in this paper wepresent forensic acquisition and analysis of these four IMs and VoIPs for bothiOS and Android platforms. We try to answer on how evidence can be collectedwhen IM communications are used. We also define taxonomy of target artefacts inorder to guide and structure the subsequent forensic analysis. Finally, areview of the information that can become available via the IM vendor wasconducted. The achieved results of this research provided elaborative answerson the types of artifacts that can be identified by these IM and VoIPapplications. We compare moreover the forensics analysis of these popularapplications: WhatApp, Skype, Viber and Tango.