WA Architecture

After the rapid and exponential development in communication technology and the Internet, also accelerated development in smartphones and their data connectivity like 3G and 4G. Social networking and instant messaging (IM) companies developed their mobile applications. The mobile forensic method divides the investigation process into four stages: seizure, acquisition, analysis, and reporting. Here, the mobile forensic process was used in an investigation over iOS and Android smartphones, where a digital crime was assumed to be committed through WA. First, during the seizure stage, the smartphones were identified, preserved, documented, secured, and disconnected from all types of networks. The acquisition stage was completed by the phone’s imaging process and the hash value (MD5) was calculated. The analysis stage was completed by accessing chat details and logs, call logs, and multimedia to determine the evidence. The investigation process was carried out according to a legal framework and approved procedures that regulate the process by monitoring its stages to ensure that evidence is protected from alteration or destruction, and to ensure that the witness’s report is admissible in court. Finally, the investigation process and evidence were reported. In conclusion, WA forensic artifacts could be analyzed and discovered successfully using the mobile forensic process.

WA is a popular IM application in smartphones. WA allows users to exchange text messages, images, video files, audio files, document files, pdf files, and many others. WA allows users to create user groups to send messages and files to all group members. WA also allows the user to control personal profile information such as name, profile photo, and information about the user [8]. WA messaging is done in end-to-end encryption, and therefore no man-in-the-middle can read messages between two WA users [9]. WA stores its data in the mobile phone’s internal memory. WA automatically connects to the phone contacts database, detects the contacts that use the WA application, and adds them to its database. The WA application also includes a procedure named “com.whatsapp”, which is a procedure for operating the external media management service and the messaging service that runs in the background, as this procedure works when turning on the smartphone [10]. WA used the SQLite database “ChatStorage.sqlit” to save messages that were exchanged between users and other information from the user activities on WA [11].

Among the many IM applications on smartphones, WA has become the most popular IM application [2]. According to a statistic made by Statista in October 2020 for the most popular and widespread IM application based on the number of active users per month [3], WA is the most used by 2 billion active users, followed by Facebook Messenger (1.3 billion), WeChat (1.206 billion), QQ (648 million), Snapchat (433 million), and Telegram (400 million active users).

Cybercrime is increasing exponentially and in various ways and for different purposes, including personal fund gain, commercial competition, theft of intellectual property, personal theft, bullying, harassment, money laundering, terrorism, and so on. It’s always necessary to legally deal with cybercrimes, investigate them, and prosecute cybercriminals [4]. As well, there must be specialized laws to define the tools and types of cybercrime. Therefore, specialized law enforcement agencies must be founded to investigate and present it to the judiciary. Additionally, the penal laws must be developed to address this type of crime [5].

Most countries around the world are issuing cybercrime laws. Specialized law enforcement agencies are also being founded to investigate this type of crime [6]. The state of Palestine, like many other countries, has issued a cybercrime law by Decree No. 10 of 2018. This law defines activities, tools, and terminology related to cybercrime, and determines the law enforcement agencies that are responsible for the investigation and prosecution of cybercrime and the penalties for these crimes [7].

There are many different tools that support acquisition data in the WA application, and the main goal of using these tools is to access the data stored in the protected logic of the mobile device to obtain WA data. The way these tools work depends on two methods—namely, rooting the Android device and going back to the previous version of the WA application—and the use of these two methods is completely related to obtaining the data from the WA application and understanding the method on which the structure of the WA application depends. This section will discuss the WA application, and then the main mechanisms used to obtain data and items from the WA application will be clarified. The WA application is an application that works on IM and is free of charge, as it allows users to receive and send messages—whether text, images, audio or video clips, and many other files—in a very easy way, as this application is available for all operating systems around the world such as Windows, Android, and iOS. Often, we think about how messages are transmitted from phones through the receiving servers, without thinking about the invisible mechanism that may take place in the phones. In fact, when the sender presses the send button and directly sends the message, it is stored inside a file and this file is stored in turn inside both devices: the sender and the receiver. Figure 9-1 explains the process of sending and encrypting the sent message and transferring it to the WA server and then sending it to the receiver, decoding it, and displaying it to the user.

Usually, forensic investigators are interested in locating the places where messages are stored, so they can obtain them and then run them according to WA policy, so all sent and received messages are stored in the servers of the WA application temporarily. WA servers contain a large amount of evidence usually stored in servers for a very short time. In addition, investigators need to refer to the owner company directly and adhere to the company’s privacy policy to retrieve any evidence in their servers, and that is a very difficult procedure. Here comes the importance of investigating the sender’s and receiver’s devices because the sent and received messages are kept in mobile devices, so that WA users store many artifacts of high value as proof for the investigation, as the files that are saved are the message log and the database. For all conversations and correspondences (sent and received), The WA database structure (Figure 9-2) describes the database structures stored in the internal memory of the mobile device in a hierarchical manner, which includes three levels: the first level contains the main WA data hall, the second level contains the subdatabases, and the third level, located at the bottom level of the hierarchy, shows the other subfiles.

This chapter aims to explore the artifacts in WA on iOS and Android platforms and the use of tools related to the digital investigation to access digital evidence in WA by extracting messages and calls, analyzing them, and linking them in a chronological sequence to reach the digital evidence of the case.

Old versions of WA used the SQLite database “msgstore.db” to save messages that were exchanged between users; this database was unencrypted. Because unencrypting the database led to easy access to the details of the messages stored in it, to bypass this problem and to achieve better protection for users’ privacy, an encryption mechanism was developed for the WA database on the Android platform using an advanced encryption algorithm (AES) with an encryption key (192-bit length). As a result, the database name has changed to msgstore.db.crypt, msgstore.db.crypt5, msgstore.db.crypt7, and msgstore.db.crypt8. In recent versions of WA, the AES algorithm was used with a 256-bit key and the database became msgstore.db.crypt12 [10].

Research studies mostly deal with forensic methodologies on various mobile applications, such as forensic analysis of contact lists, SMS messages, and social media. Some researchers have compared several analysis tools by applying them to the analysis of processes for obtaining WA messages and files on Android platforms. Other researchers determined different artifacts on Android platforms generated by WA such as contacts database, messages database, and the database encryption key (Shidek, Cahyani, and Wardana, 2020). Another study focused on the decryption of WA encrypted databases. The researcher used five different tools to achieve the study’s goals; these tools are WA key, db extractor, WA viewer, WA extract, SQLite spy, and Android backup extractor. Some of these tools are written in python code, so a python compiler is also needed in their experiment [12]. A comparison study between two forensic tools for examining iPhone devices was also done [13]. The study showed a comparison between Elcomsoft iOS forensic toolkit and Oxygen 2012 in terms of the ability of these tools to examine nonjailbreak and jailbreak iPhones [13]. This study focused on mobile forensic investigation in WA on iOS and Android platforms using a variety of digital forensic tools.

WA Experiment

To achieve the aim of our case, a forensic examination was conducted on Android and iOS smartphones. An assumed scenario was used to simulate the case to implement the mobile forensic stages, then analyze the evidence extracted from WA, and finally, write a mobile forensic analysis report.

The assumed scenario is that a public sector employee in the Public Services Office seeks to request a bribe from a citizen to complete the processing of the citizen’s documents via WA messages. While bribery is one of the corruption crimes in the public sector, the anticorruption commission is the specialized entity to address this type of crime according to local laws in your country. Furthermore, the mobile device is a digital tool used to facilitate this type of traditional crime [7].

The scenario depicts the suspect blackmailing the victim through text messages and voice calls via WA. The investigator shall follow the mobile forensic process in dealing with evidence to seize, secure, and preserve it from any changes. The evidence data is then extracted from the evidence image to explore the conversations, voice calls, and images that occurred between the suspect and the victim via WA. In this scenario, the smartphone is in an active state and can be powered on. In the simulation process, the mobile forensic process, which is explained in Chapter 1, is as shown in Figure 9-3. All steps were taken to obtain valid and admissible evidence to be presented in a witness report that can be submitted to the court to decide the case.

In the seizure stage, a reasonable and specific search warrant from a legal authority such as the Public Prosecution must be issued. The digital evidence must be determined in the search warrant. Seizures are done by law enforcement personnel trained in the digital evidence seizure process or experts in digital investigation accompanied by judicial officials to ensure that digital evidence is protected and preserved. At this stage, the adopted procedures in the seizure process must be adhered to, and the laws related to privacy and the rights of individuals must be observed. Judicial seizure officers work at this stage to secure the crime scene and document it in writing and photography. The seized devices are also documented in the seizure report, where the name of the owner, the make, the model, the serial number, IMEI, and any other information distinguishing the seized device are documented, in addition to photographing the seizures. Work is being done to preserve the seized devices in their original condition. In addition to disconnecting the communication signals from the devices, all wireless networks must be disconnected to prevent any alteration or destruction of the digital evidence.

The data processing and verification of the evidence are then carried out on backup and imaging data on the smartphone using forensic tools. In this study, the FINALMobile forensic tool was used to implement the data imaging process. This process is carried out in the acquisition stage.

In the data acquisition process, a logical acquisition from a seized smartphone was used, where a backup of the data was taken from the internal memory. The backup data image was saved in the storage media to protect it and perform an analysis process later. When this process is completed, the acquisition process information is saved and documented in a report. This information includes investigator information, acquiring time and information, and image information, which includes a file name, file size, and the MD5 hash value for the file.

The investigator used the image taken in the previous stage to perform the analysis process to obtain more evidence related to the crime. Evidence is collected and verified by exploring and reading the conversations stored in the WA database. Before beginning the analysis stage, the investigator checks the integrity of the evidence image by recalculating the image hash value (MD5) and comparing it with a hash value calculated in the acquisition process.

Acquisition Stage

The process of forensic investigation of mobile devices is not very different from that for laptops, but some of the tools that are used in mobile forensics are somewhat different, as most mobile operating systems are closed, so it becomes difficult to understand the file system and the structure of phones. Many open source Android tools used in digital forensics are available for users, both for purchase and for free, to allow you to begin data extraction, backup operations, and so on.

This stage takes place according to the direct access warrant from the anti-corruption prosecution based on article no. 32 (paragraph 4) in the law by decree no. 10 of 2018 on cybercrime. In the data acquisition process from the seized iPhone device, the iTunes backup tool and Belkasoft forensic tool will be used. While the mobile is unlocked, the iTunes backup acquisition will be used. An iPhone USB cable will be used for connecting the mobile device to the forensic workstation. Alsom in the acquisition for the Android seized device, the ADBs backup command-line tools, the Belkasoft forensic tool, the MOBILedit tool, and the FINALMobile forensic tool will be used. A Samsung mini-USB cable will be used for connecting the mobile device to the forensic workstation. Besides, storage media will be used to store the acquired evidence image. The goal of the examination and the data needed for the investigation must be identified beforehand, and the documentation information for this stage includes the following:

Due to the access warrant issued by the public prosecution (based on the law by decree no. 10 of 2018 on article no. 32 paragraph 4), the acquisition stage was conducted. When the device was unlocked, logical acquisition was used.

Tools Used in the Examination Process for iOS

This stage was conducted using different forensic tools: in the beginning, iTunes software for backing up the device, and then other tools were used for evidence acquisition from iTunes backup. Enigma Recovery Software, DB Browser for SQLite, and iBackup Viewer.

iTunes Backup for iOS

Obtaining data from devices (iOS) can be achieved either through a backup copy or by making a physical copy. Obtaining data and analysis from backup is done the same way, but it is possible that backup copies do not give us enough data required, specifically for deleted messages, pictures, and other things. Therefore, it is preferable to take data through the physical copy, but the seriousness of this case in Apple devices is that it needs a jailbreak, and this may sabotage many things in the mobile and take it out of the protection and security system. The iTunes software is used to make a backup for the iPhone device.

1. 1.

   When iTunes connected to the suspected device and the iPhone information was viewed, the automatic synchronization was disabled, the backup was determined to be on this computer, and the encrypted local backup was disabled to get an unencrypted backup as shown in Figure 9-4.

    

1. 2.
   In the final process, the backup started and created in the default folder in Windows 10 as follows:

   • Backup folder path:

     (C:UsersExamplePathAppDataRoamingApple ComputerMobileSyncBackup).

   • The folder name was 00008030-000338D2149A802E. Because the suspected device is a new device, the backup folder name length was 24 ASCII characters.

   • Backup size: 36.03 GB.

    

The full backup is the stored name of the archive chosen, which can be redesigned so that the file system is from a complete copy to a new volume, where it can be returned in many cases in case of data loss or other problems. One of the disadvantages of this copy technique is that it is very slow in the copying process and requires a large amount of memory, as its strategy is to repeat and update files all the time, so the other copy will have less and smaller space, but the recovery process may need longer than normal.

iOS Acquisition Using Enigma Recovery Software

This software is used to make a backup from the iPhone device or explore the iTunes backup, and from Enigma Recovery by selecting “view my saved scan,” the examiner can select the saved backup and explore the evidence as shown in Figure 9-5.

iOS Acquisition Using DB Browser for SQLite

SQLite is now used in a wide range of applications and products. It’s included in Apple’s Mac OS X operating system as part of the CoreData application framework. It’s also found in Apple’s Aperture holography software, as well as the Safari web browser, Mail.app email client, and RSS manager. SQLite is a database that serves Sun’s Solaris platform’s service management facility, which debuted with Solaris 10, and is a key component of its self-healing predictive technology. The Mozilla Project’s mozStorage contains SQLite. For Firefox, Thunderbird, and Sunbird, the API C++/JavaScript layer will serve as the backbone for storing personal information. SQLite was included in the PHP 5 library. It’s also included in the Trolltech Qt C++ application framework, which is the foundation for the popular KDE window manager and a slew of other products. On embedded platforms, SQLite is extremely common. Richard Heep had a lot to do with SQLite. This tool is used to explore SQLite databases recovered from mobile devices. By this tool, the manifest.db database from iTunes backup was explored. The operations in it are very easy and simple and there are no additional consequences. It is are customized and designed in an easy and fast way in transportation and its use is open source, as shown in Figure 9-6.

Next, we introduce the Android WA artifacts in the permanent storage memory without expanding to the volatile random memory, since in this chapter experiments were conducted on a Xiaomi mobile. An application stores the data of the user in a database (SQLite) called msgstore.db. After making the backup, we will find the following files:

• / sdcard/WhatsApp/Databases

• / sdcard/WhatsApp/media

• / sdcard/WhatsApp/Backups

After we were able to get WA database files from the Android backup without rooting the device as shown in Figure 9-7, in this section of the study we will start the decryption procedures (msgtore.db) so that we can get the artifacts.

We used WA Key/DB Extractor from GitHub for extracting and retrieving msgstore and to decrypt and display WA databases (see Figure 9-8). After we were able to get the key of the database (msgstore.db) we needed to decrypt the database with the same key through the WA viewer tool, and then we opened it to be able to view the contents through the same tool as shown in Figure 9-9.

From the preceding, we can summarize our findings and results of the artifacts by making a direct comparison between the methods as described in Table 9-3.

Table 9-3

Comparison of Artifacts of WA Discovered by Different Tools

	iOS		Android
	Internal storage & no rooting	SDcard & No rooting & WhatCrypt	Internal storage & no rooting	SDcard & No rooting & WhatCrypt
Msgstore.db	Found encrypted	Found encrypted	Found encrypted	Found encrypted
Wa.db	Not found	Not found	Found	Found
Phone number	Found	Found	Found	Found
Messages	Found	Found	Found	Found
Media files	Found	Found	Found	FOUND
Contact card	Found	Found	Found	Found
Deleted messages	Not found	Not found	Not found	Not found
Deleted media	Not found	Not found	Not found	Not found

iOS Acquisition Using iBackup Viewer Pro

This tool can explore iTunes local backup and explore and view the backup data as shown in Figure 9-10.

iOS Acquisition Using Belkasoft Evidence Center

In this forensic tool, the acquisition can be directly conducted by making a backup for the smartphone using logical or physical acquisition. The acquisition here was conducted by opening a mobile image that was created by iTunes software in the local computer.

1. 1.

   In the Belkasoft evidence center, the new case was created, and then the mobile image was chosen to load the iTunes backup folder. The data and applications that need to be searched are selected as the result of reading and acquiring the image is shown in Figure 9-11.

    

Tools Used in the Acquisition Process for Android

Before the logical acquisition, the developer options and USB debugging were enabled.

Android Acquisition Using ADB Command-Line Tools

The acquisition process started from the backup of the mobile using ADB command-line tools. Then opening and acquiring the backup files was performed using the Belkasoft evidence center and FINALMobile forensic. The following steps will describe the acquisition process in detail:

1. 1.

   The examiner identified the suspect’s device and reviewed the details with the details recorded during the seizure stage.

    
2. 2.

   ADB command-line tool was used to back up the device as shown in Figure 9-12.

    

1. 3.

   After the backup process is completed, the resulting backup.ab file is converted to a backup.tar file to be used with forensic software tools as shown in Figure 9-13.

    

Android Acquisition Using Belkasoft

The acquisition process started from the backup of the mobile using the Belkasoft evidence center after the case was created. The following steps will describe the acquisition process in detail:

1. 1.

   The data source was added to the created case by selecting the mobile data source and Android mobile type as shown in Figure 9-21.

    
2. 2.

   Then Belkasoft connected to the device and presented the device type, manufacturer, and model as shown in Figure 9-14.

    

1. 3.

   Then ADB backup was created; after the backup process was completed, the investigator selected the data type to be analyzed. Now the acquired data is ready for the analysis stage.

    

Android Acquisition Using FINALMobile Forensic Software

The acquisition process was started for the Android mobile by using FINALMobile forensic after the category of the device as a smartphone and the type of the operating system, which is Android. The following steps will describe the acquisition process in detail:

1. 1.

   The model of the mobile device is selected.

    
2. 2.

   The logical acquisition method using Samsung backup protocol is selected as shown in Figure 9-15.

    

1. 3.

   In the preparation for ADB backup, the FINALMobile forensic selects the apps to downgrade due to database encryption in order to decrypt the SQLite database as shown in Figure 9-16.

    

1. 4.

   During the acquisition process, the FINALMobile forensic downgraded WA from version 2.21.12.21 to version 2.11.414 to decrypt the WA SQLite database and back it up as shown in Figure 9-17.

    

1. 5.

   When the acquisition process is completed, the FINALMobile forensic restores the original WA to the mobile as shown in Figure 9-18.

    

Android Acquisition Using MOBILedit

The acquisition process started after connecting the mobile to the forensic workstation, then MOBILedit software connected to the mobile and discovered information such as manufacturer, model number, phone time, and software version, as shown in Figure 9-19.

WA Analysis Tools for iOS

The analysis process succeeded as the evidence was found by reviewing WA chats and calls, as well as reviewing audio files, video files, and photos exchanged through the WA application. Using the iBackup Viewer, the applications list in the manifest.plist files was explored. By this tool, the WA version was determined to be 2.21.72.1 as shown in Figure 9-20.

iOS Analysis Using Belkasoft

Using Belkasoft evidence center, the acquired case opened and the dashboard information for the case was viewed as shown in Figure 9-11. By exploring the files and folder using the file system viewer in Belkasoft, under the WA folder (“AppDomainGroup-group.net.whatsapp.WhatsApp.shared”) there were files and folders for WA as shown in Figure 9-21.

The non-empty folders inside the WA folder are described in detail in Table 9-4.

Table 9-4

Subfolder Descriptions under the WA Folder

Folder Name	Details
Biz	This includes SQLite database “Biz.sqlite”; this database includes information and business account profiles.
Librarypreferences	This folder includes a plist file with the name “group.net.whatsapp.WhatsApp.shared.plist”; this file includes information about the WA account such as full user name, user current status, own device ID, and own jabber ID, which is the same as account ID shown in Figure 9-34.
Mediaprofile	This folder contains images and thumb files for the profile pictures for the friends of this account.
Messagemedia	This folder contains subfolders with the names of the ID accounts of the friend’s users; under these subfolders the multimedia is exchanged between the user and the friends such as images, videos, and audio messages.
Stickers	Contains sticker images.
WAIPC	Includes extensions for notification service and other services.

The files contained in the WA folder include the WA SQLite databases as follows:

1. 1.

   Emoji.sqlite: contains WA emoji information.

    
2. 2.

   Stickers.sqlite: contains WA sticker information.

    
3. 3.

   ChateStorage.sqlite: contains tables for information and contents of chats between the user and friends in the table “ZWAMESSAGE” and all information about groups and group members in the tables “ZWAGROUPINFO”, “ZWAGROUPMEMBER”, and “ZWAGROUPMEMBERCHANGE” as shown in Figure 9-22.

    

1. 4.

   ContactsV2.sqlite: contains information about the friend’s users like the WA account and their status text as shown in Figure 9-23.

    

1. 5.

   Callhistory.sqlite: contains the WA call logs as shown in Figure 9-24.

    

Another way to view WA chats is by using the Belkasoft evidence center, in the case explorer and under the instant messengers, and the investigator can browse WA messages from the case explorer.

iOS Analysis Using Magnet AXIOM Examine

Using Magnet AXIOM Examine, the acquired case is opened, along with the dashboard information for the case; then investigators can start exploring the artifacts, which are classified into various categories. While the examination in this study related to the investigation on WA, WA chats can be examined from the chat category in the artifacts as shown in Figure 9-25.

In the artifacts module in Magnet AXIOM Examine, the software explores WA chat logs, WA contacts, WA groups, and WA messages as shown in Figure 9-25. The investigator can browse WA chat logs, which show individuals’ names, group names, the chat ID, the last message sent or received, and the last message date and time as shown in Figure 9-26.

By exploring the WA contacts in the artifacts, the investigator can show the account ID, phone number, full name, given name, and WA user IDs, and by exploring the WA groups from the artifacts, the investigator can show a lot of information about the WA groups where the user joined such as the group chat ID, group name, creator ID, creator name, admin IDs, admin names, and created date/time as shown in Figure 9-27.

By exploring the WA messages from the artifacts, the investigator can view the list of the chats, and by selecting any row of these logs as shown in Figure 9-27, the investigator can show the details of the chat in the preview pane as shown in Figure 9-28.

You can also use the file system for the investigation and exploring the WA folder, using WA SQLite databases as shown in Figure 9-29.

As in the Belkasoft evidence center, the investigator can explore the files and folders under the WA folder and show and export the media files that are exchanged between the user and their friends. But for SQLite databases, the investigator needs a third-party tool to explore the contents.

Using Magnet AXIOM Examine, in the artifacts module, the message lists on WA were reviewed, the details of the existing messages were read, and in addition, WA contacts were reviewed in the WA groups list. The exchanged media was also reviewed, including images, files, and audio messages from the messagemedia folder under the WA folder using the examination on a file system. These media can be reviewed when exploring the details of the chat messages.

iOS Analysis Using FINALMobile Forensic

The FINALMobile forensic was used in acquiring the connected mobile phone, and also in acquiring the iTunes backup on the local storage. By using the two methods, the results were insufficient to conduct an investigation regarding WA, as using this tool the files for WA did not appear, as shown in Figure 9-30.

iOS Analysis Using Enigma Recovery Tool

While the Enigma Recovery tool has the ability to back up data from the iPhone device directly or from the iTunes backup, the tool used here performed the backup of the data from the connected device directly. With the selected option, the investigator must choose what to recover from the connected device. After the backup process is completed, the investigator can open the backup by selecting the saved scan. The investigator can browse the WA chats by selecting WA and then select an account from the list to view the chat message details as shown in Figure 9-31.

Using the Enigma Recovery tool, the message lists on WA were reviewed; the details of the existing messages were read.

iOS Analysis Using iBackup Viewer Tool

By using iBackup Viewer, the investigator can open the iTunes backup as shown in Figure 9-32 and explore the artifacts using this tool. The investigator can open the WA icon to view the WA messages as shown in Figure 9-32.

WA Analysis Tools for Android

The analysis stage was conducted with the different acquisition methods and using different forensic tools such as Belkasoft evidence center, MOBILedit forensic, and FINALMobile forensic tools. The analysis of the backup file taken by the ADB command-line tool didn’t have any files or data related to WA because the acquired device is unrooted. This was clarified by analyzing the backup file on the Belkasoft evidence center, as well as in the FINALMobile forensic as shown previously.

Analysis using the Belkasoft evidence center stage was conducted on data acquired using the Belkasoft evidence center. While the investigation aims to search for the digital evidence in the WA application, there are no files related to WA through the analysis and exploring of the file system collected through the Belkasoft software in the acquisition stage as shown in Figure 9-33.

We tried to analyze using the image acquired by MOBILedit forensic; the WA folders and database files can be viewed. The SQLite DB for WA is encrypted by the AES encryption algorithm, as shown in Figure 9-34, so the content data cannot be viewed and presented.

Using FINALMobile forensic on the analysis stage to acquire the image, the digital evidence was collected, analyzed, and documented, and the WA account information was retrieved. The message lists on WA were reviewed, and the details of the existing messages were viewed, along with deleted messages, including both texts and attachments, as shown in Figure 9-35.

Forensic Tools Comparison on iOS Platform

Different tools were used for the acquisition and analysis of iPhone 11 for investigating WA messages. A backup using iTunes was taken and used for the examination and analysis using Belkasoft evidence center, Magnet AXIOM Examine, FINALMobile forensic, Enigma Recovery, and iBackup Viewer. In the acquisition phase, not all of these tools support the acquisition from the connected device directly. The other tool supports the acquisition from the connected device using iTunes backup or logical backup, while the logical backup needs to jailbreak the device to conduct the process. The assumed case in this study is about a cybercrime committed via WA application, and the analysis using these tools focuses on WA data and files. It was clear that there are differences between all of these tools in the examination process and in the way to view and present the evidence from WA.

Forensic Tools Comparison on Android Platform

Different tools were used for the acquisition and analysis of Samsung Galaxy J6 with Android 10 and Knox security features for investigating WA messages. The acquisition stage was conducted using ADB command-line tools, and the analysis on the resulting backup file was conducted using Belkasoft evidence center and FINALMobile forensic. Another acquisition process was conducted using forensic tools such as Belkasoft evidence center, MOBILedit, and FINALMobile forensic. The acquired backup using ADB command-line tool was not useful for the assumed case study as the investigation on WA, because during the analysis stage the investigator found there is no data or files related to WA in the backup file due to the inaccessible storage location for WA on the unrooted device.

Summary

WA is the most popular application for IM, where people can exchange text messages, audio files, video files, and documents. This research has focused on forensic investigation of WA on the iOS and Android platforms. The NIST digital forensic method is used in the research. The Belkasoft evidence center, FINALMobile forensic, MOBILedit, Magnet AXIOM, and other tools are used in the examination and analysis stages. The iTunes software was used to back up the seized iPhone and ADB logical backup was used to back up the seized Android mobile. In the analysis stage, the messages, photos, audio files, videos, and contacts are viewed and analyzed to determine the evidence related to the assumed crime. Another tool used for the acquisition and the examination is to show the differences and capabilities between these tools in the examination process and the results of extracting the digital evidence from WA on iOS and Android platforms. While jailbreak is needed for iOS or root for Android to conduct the file system acquisition, not all iOS versions can jailbreak, and not all Android versions can be rooted. Due to the comparison between the forensic tools used on iOS and Android platforms, FINALMobile forensic can downgrade the WA version to an older one with an unencrypted database, so all the data viewed and the deleted chats are recovered. To protect users, the operating system must enable features to prevent downgrading WA to keep and protect user privacy.

References