1 Introduction

In recent years, we have witnessed a rapid increase in the use of Voice over Internet Protocol (VoIP) services as an online communication method on mobile devices. This is not surprising due to the increasing proliferation of smartphones: it has been predicted that by 2019 the number of smartphone users will be more than 2.6 billion [1]. These days people use their smartphone devices not only for making voice calls and exchanging SMS, but also for obtaining several services that are offered due to the ubiquitous access to Internet, such as mobile banking, and location-based services. Meantime, the use of VoIP applications, which could be delivered easily through mobile VoIP applications (mVoIP apps), would enable people to interact, share information, and become socialized at a very low cost compared to most of the traditional communication techniques. However, such applications could also be exploited by criminals or be targeted by cybercriminals (e.g., with malware infection to steal financial data) [2, 3]. For these reasons, mobile devices (including smartphones) attracted a lot of attention from the security research community [4], in particular from the perspective of malware [5–12], security enforcement [13–16], and authentication mechanisms [17–19].

Smartphones are a common source of evidence in both criminal investigations and civil litigations [20–25]. However, the constant evolution and nature (e.g., closed source operating system and diverse range of proprietary hardware) of mobile devices and mobile apps complicates forensic investigations [26]. Among the existing smartphone operating systems in the market, Android dominated the market with more than 80% of the total market share in 2015 Q2 [27, 28]. Therefore Android popularity attracted several researchers to focus on investigating several different security aspects of Android, ranging from user identification [29, 30], feasibility of encryption methods on Android [31], cloud storage apps forensics [32], and social networking apps forensics [3]. Due to the increasing use of mVoIP apps for malicious activities on different platforms including Android, forensic investigation of such apps needs an extensive coverage [33, 34], and therefore in this chapter, we provide an investigative study of the three popular VoIP apps for Android on Google Play (see Table 1), namely: Viber [35], Skype [36], and WhatsApp [37]. The features of these VoIP apps are summarized in Table 2. In particular, we aim to answer the following question: “What artifacts of forensic value can be recovered from the use of Viber, Skype, and WhatsApp Android apps?”

2 Related Work

These days, several trusted and untrusted providers launch various categories of applications for mobile devices. This has led to the ever increasing trend in using mobile devices in order to benefit from the services offered by these applications. This tendency motivated the forensic community to concentrate on forensic investigation of the mobile devices. In this regard Dezfoli et al. [26] perused the future trends in digital investigation and determined that mobile phone forensics is receiving more and more attention by the community and is one of the fastest growing fields. In [38], the authors provided a comprehensive discussion on the nature of digital evidence on mobile devices, along with a complete guide on forensic techniques to handle, preserve, extract, and analyze evidence from mobile devices. Moreover, they presented examples of commercial forensic tools that can be used to obtain data from mobile phones, such as Access Data Forensic Toolkit (FTK), Cellebrite Physical, XACT, along with the case example of the adopted Digital Forensic Framework (DDF) plug-in. In the same line of study, Mohtasebi and Dehghantanha [39] presented a unified framework for investigating different types of smartphone devices. Parvez et al. [40] proposed a forensics framework for investigating Samsung phones. Several researchers have proposed various frameworks for the investigation of Nokia mobile devices and Firefox OS [25, 41].

A comparison of forensic evidence recovery techniques for a Windows Mobile smartphone demonstrates that there are different techniques to acquire and decode information of potential forensic interest from a Windows Mobile smartphone [42]. Furthermore, forensic examination of the Windows Mobile device database (the pim.vol) file confirmed that pim.vol contains information related to contacts, call history, speed-dial settings, appointments, and tasks [43]. Moreover, in [44], the authors provided a number of possible methods of acquiring and examining data on Windows Mobile devices, as well as the locations of potentially useful data, such as text messages, multimedia, email, Web browsing artifacts, and Registry entries. They also used MobileSpy monitoring software as a case example to highlight the importance of forensic analysis. They showed that the existence of such a malicious monitoring software on a Windows phone could be detectable on the device being investigated by forensics analyst. In another recent study, Yang et al. [45] carried out an investigative study on two popular Windows instant messaging apps, i.e., Facebook and Skype. The authors showed that several artifacts are recoverable, such as contact lists, conversations, and transferred files.

A research project published at the DFRWS 2010 Annual Conference discussed technical issues that are in place when capturing Android physical memory [46]. A critical review of 7 years of mobile device forensics [47] demonstrated that there are several research studies in the area of Android device forensics in the literature. However, very few of them support the varying levels of Android memory investigation. Lessard and Kessler [48] showed that it is possible to acquire a logical image of Android-based smartphones, such as Samsung Galaxy, using either a logical method or a physical method. The logical acquisition technique consists of obtaining a binary image of the device’s memory, which requires root access to the device. More so, Vidas et al. [49] discussed an acquisition methodology based on overwriting the “Recovery” partition on the Android device’s SD card with specialized forensic acquisition software. Likewise, Canlar et al. [21] proposed LiveSD Forensics, which is an on-device live data acquisition approach for Windows Mobile devices. They proposed a method to obtain artifacts from both the Random-Access Memory (RAM) and the Electronically Erasable Programmable Read Only Memory (EEPROM). In [50], the authors proposed a methodology for the collection and analysis of evidential data on Android devices, which used the principles of Martini and Choo’s cloud forensics framework [51]. The steps within this methodology are as follows: the collection of the physical image of the device partitions with the aid of a live OS bootloader, and the examination of app files in private and external storage, app databases, and accounts data for all apps of interest, on the android device. Using this methodology, in [52], the authors carried out an analysis of seven popular Android apps within three categories: storage (Dropbox, OneDrive, Box and ownCloud), note-taking (Evernote and OneNote), and password syncing (Universal Password Manager, UPM). Such analysis proves the validity of their proposed methodology.

In order to facilitate the forensic investigation of mobile devices that are rapidly changing in their structure, Do et al. [53] proposed a forensically sound adversary model. Azfar et al. [54] considered this adversary model as a template to map a potential adversary’s capabilities and constraints, in order to evaluate the usefulness of such a model by carrying out a forensic analysis of five popular Android social apps (Twitter, POF Dating, Snapchat, Fling, and Pinterest). They showed that useful artifacts are recoverable using this model, including databases, user account information, contact lists, images, and profile pictures. They could also discover timestamps for notifications and tweets, as well as a Facebook authentication token string used by the apps.

There is also a vast interest of digital investigators in studying the instant messaging artifacts in the stream of research in this area of digital forensics. The first claimed work to carry out a forensic analysis of Skype on the Android platform [55] investigated both the NAND and RAM flash memories in different scenarios. Their obtained results showed that chat and call patterns can be found in both of NAND and RAM flash memories of mobile devices, regardless of whether the Skype account has been signed out, signed in, or even after deleting the call history. In [34, 56], the authors showed that, while conducting recoveries of digital evidences relating to VoIP applications in computer systems, the Skype information is recoverable from the physical memory. Moreover, [57] presents another forensic analysis of several instant messaging applications including Skype and WhatsApp focusing on encryption algorithms used by these applications. Similar work has also been conducted by forensically analyzing WhatsApp on Android platforms [58, 59]. In the same line of study, a forensic analysis of four popular social networking applications (Facebook, Twitter, LinkedIn, and Google+) have been carried out which showed that artifacts useful as evidence in a potential criminal investigation are recoverable from smartphone devices using such applications [3]. Moreover, Yang et al. suggested an approach for forensics investigation of instant messaging applications on Windows 8.1 and applied it to detecting remnants of Facebook Instant Messaging and Skype application. Another important research direction that has always been a concern for digital investigators in investigation of instant messaging applications is privacy [60–62]. Ntantogian et al. [63] evaluated 13 Android mobile applications focusing on privacy. They tried to recover artifacts that provide information relating to authentication credentials. They showed that the users’ credentials are recoverable in the majority of the applications. Moreover, they determined specific patterns for the location of such credentials within a memory dump. In another research study [64], Farden et al. explored the privacy of user data with regards to mobile apps usage by evaluating the privacy risks that are inherent when using popular mobile dating Apps. They showed that in almost half of the investigated applications, the chat messages are recoverable, and in some cases details of other nearby users could also be extracted. Likewise, Azfar et al. [65] provided a forensic taxonomy of Android mHealth apps, by examining 40 popular Android mHealth apps. Their findings could potentially help facilitate forensic analysis of those particular mobile health applications.

In this paper we thoroughly analyze forensics remnants of three popular instant messaging applications, namely Viber, Skype, and WhatsApp on Android platform to provide a guideline for forensics practitioners in conducting similar investigations. Compared to previous studies, this research is delving into forensically valuable evidences in the context of Android platform and provides a comparative study of different VoIP applications remnants. Moreover, it is furthering forensics attention to lesser studied Viber and WhatsApp applications forensics.

3 Experimental Setup

Our investigative methodology is based on the digital forensic framework proposed by Martini and Choo [51]. In this study, we first identified the potential evidence sources and set up the experimental environment (Section 3.1). Thereafter, we carry out logical acquisition in order to collect evidential data (Section 3.2). Finally, by analyzing the collected data, we investigate possible remnant artifacts (Section 3.3). We further demonstrated and discussed the experimental results in Section 4, and presented the conclusions drawn from our investigation in Section 5; both of which exemplify the third and fourth steps of the framework methodology [51], i.e., “Examination and Analysis” and “Reporting and Presentation,” in which the results of the forensic study should be analyzed and presented appropriately.

Since without rooting the smartphone device, we would not be able to access that without a rooting the smartphone device, we would not be able to access some of the stored files (we will explain in Section 3.2), we utilized a rooted Android phone, i.e., Samsung Galaxy S3 GT-i9300, in order to conduct our experiments. We set up and configured necessary workstations and tools (including both software and hardware), as listed in Table 3. Moreover, Table 4 reports the authentication methods required for our considered mVoIP applications and their details.

Our examination and analysis process consist of three phases, which we explain in the following.

3.3 Phase III: Identification and Analysis—Second Iteration

This third phase of the experiment includes identification of folders and files on the logical image acquired in the previous phase. Examination and analysis of the files in order to check the existence of artifacts such as timestamps, location, GPS coordination, contact info, text-chat, SMS, file location, and any significant data that could be relevant to the research area. We conducted forensic examinations manually, with the aid of the tools listed in Table 3. After acquiring the logical image, as described in Phase II, we used “AccessData FTK Imager” to analyze the acquired dd image which resulted in the creation of the directory default path. This allows us to access all the files in each directory, and therefore navigating to each one of the files. Fig. 1 shows the three folders of our three under investigation applications, Viber, Skype, and WhatsApp Messenger. After identifying these folders, in the next step, we need to carry out a deep inspection on each application’s database to know whether we can find any potential evidentiary artifact.

4 Results and Discussion

This section describes the potential artifacts found in each mVoIP application’s directory. Furthermore, we discuss the evidentiary values of the artifacts found for each of the mVoIP applications.

5 Conclusion and Future Work

In this chapter, we carried out a forensic analysis of the most popular mVoIP applications, i.e., Viber, Skype, and WhatsApp Messenger when running on an Android smartphone. Artifacts listed in Table 6 can provide vital evidence that can open up a case or offer a wealth of information for further investigation when dealing with crime related to mobile devices and mobile applications.

This study successfully applies a methodology adapted from an existing digital forensics framework, which uses various techniques from the existing literature, in order to perform a forensic analysis of Viber, Skype, and WhatsApp Messenger applications on an Android platform. We showed that potential evidentiary artifacts can be found on Android devices, which have forensic value to be presented in the court of law by a forensic investigator when handling a case related to cyber terrorism or cybercrime conspiracies. A possible future research direction could be a comprehensive research on different mobile operating system platforms, considering another mVoIP apps. This would provide vital information for digital forensic specialists.