# Browser Forensic Investigations of Instagram Utilizing IndexedDB Persistent Storage
## 2 Related Works  
Instagram web browser artifacts left on personal computers have been covered in a notable number of studies [9; 10; 11]. However, these studies were cut short of web persistent storage forensics, which is a relatively new area and has produced only a handful of papers in the last decade [7; 12; 13; 14; 15; 16; 17]. Additionally, Instagram forensics has been the subject of several research papers with a broader scope of social media forensics. These papers covered various aspects such as network traffic analysis [18], mobile application investigations [19; 20], user behavioral analysis [21], digital image/video analysis [22], and criminal impersonation [23]. [PERSON] and [PERSON] [9] conducted a study that analyzes the Instagram artifacts on Android and Windows 10 platforms. It further diversified the artifacts with the examination of different web browsers. A broad range of artifacts from pictures to user activities such as liking, commenting, and tagging was analyzed. The study pointed out that the artifacts available in different browsers show significant differences. This is attributed to the variant privacy mechanisms of web browsers. Despite covering valuable sources such as log files, history records, and temporary network file artifacts, the study does not provide considerable information on persistent Web Storage technologies such as IndexedDB. [PERSON] and [PERSON] [10] had a particular forensic focus on the artifacts of Facebook and Instagram obtained from Windows hibernation files. A detailed discussion is provided for social media forensics in the cases where it is not possible to obtain information from the suspect's hard drive. The paper shares detailed techniques for creating a connection between the suspect and the extracted artifacts. However, IndexedDB and similar persistent storage technologies are not covered in the study. [PERSON] et al. [11] scrutinized the forensic resistance of Tor browser in a Windows virtual environment. The experiment utilized a list of activities to populate data that included Instagram user activities such as following, visiting accounts, and liking pictures. The artifacts of visited links were successfully recovered, while artifacts from comments and liked pictures could not be recovered. The examined technologies are listed as the registry and main memory of the virtual drive, which did not include persistent storage technologies. [PERSON] et al. [12] gave a detailed examination of IndexedDB in Mozilla Firefox and Google Chrome browsers. The digital forensic tool Encase was utilized to create a forensic image and subsequently extract and examine the subject artifacts. Significant issues such as clear-text (unencrypted) data storage are presented with potential solutions. The paper examines IndexedDB within the context of IndexedDB API, which was later updated to further versions of IndexedDB API 2.0 in 2018 [13] and the working draft of Indexed Database API 3.0 in 2021 [14]. Additionally, the content under scrutinization is limited to generic artifacts that are now outdated. [PERSON] et al. [7] conducted research focused on IndexedDB forensics and security without targeting Instagram artifacts. The paper included a proof-of-concept tool called BrowStExPlus to demonstrate the findings. [PERSON] and [PERSON] [15] expanded this work to demonstrate the forensic investigation techniques of IndexedDB for WhatsApp web artifacts contained in the Google Chrome browser. A tool called BrowSwEx was developed to extract and present the artifacts. However, the SQLite implementation of IndexedDB was only partially covered in the first study. Additionally, the specifications of IndexedDB were changed with the new version of the API. [PERSON] et al. [16] acquired and analyzed artifacts from network packets and Android end devices utilizing content from twenty different applications including the Instagram Android application. The research aimed at a full or partial reconstruction of data artifacts.