# Browser Forensic Investigations of Instagram Utilizing IndexedDB Persistent Storage
## 6 Discussion  
The artifacts encountered in the IndexedDB storage of Instagram Web are primarily created from the interactions on the home page. Posts, comments, and stories displayed on the home page populate the IndexedDB storage with data such as owner identification, account relationships, permissions, and direct links to post resources, e.g., direct links of profile pictures. The entire contents of comments and post descriptions, post locations, and user tags were able to be extracted from the storage. The number of artifacts belonging to an account also increases when more interactions with their profile page are provided. The additional artifacts that can be obtained with supplemental profile interactions exhibit full name, biography, saved website, status, and category of the accounts. It is also possible to obtain statistical information from the account profiles, such as the number of followers and the number of accounts followed. Furthermore, significant information pertinent to the accounts, e.g., whether they are new, private, professional, unpublished, and verified accounts, can be obtained through the profile page interactions in the case that their posts or comments are displayed on the home page. With scrutinization of IndexedDB storage for Instagram application, it is possible to create connections between the account owners. A dedicated record called relationships contains valuable information that can be utilized, along with the information from the users.users record, for the construction of maps that can indicate the place of suspects in their social networks. Furthermore, the level of the relationships can be estimated based on attributes such as viewerInPhotoOfYou attribute from posts.byId records and isCloseFriends attribute from stories.reels records. These connections and their strength are valuable to forensic investigations, as social media applications are often utilized for criminal activity of drug transactions, organized crime coordination, and cyberbullying [44]. It creates opportunities to detect the accomplices of a crime and to collect information on the posts, although comments of the accounts that are private to the public would require additional warrants. \begin{table}
\begin{tabular}{l l} \hline \hline \multicolumn{1}{c}{**Attribute**} & \multicolumn{1}{c}{**Value**} \\ \hline id: & \({}^{n}\)16009265888\({}^{n}\) \\ \hline length: & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 13: Artifacts Found in stories.reels Record. \begin{table}
\begin{tabular}{l l} \hline \hline \multicolumn{1}{c}{**Attribute**} & \multicolumn{1}{c}{**Value**} \\ \hline canReply: & TRUE \\ \hline canReshare: & TRUE \\ \hline expiringAt: & 1625683666 \\ \hline id: & \({}^{n}\)16009265888\({}^{n}\) \\ \hline isCloseFriends: & FALSE \\ \hline latestReelMedia: & 1625597266 \\ \hline locationId: & undefined \\ \hline muted: & FALSE \\ \hline rankedPosition: & 1 \\ \hline seen: & 1625597266 \\ \hline seenRankedPosition: & 1 \\ \hline tagName: & undefined \\ \hline title: & undefined \\ \hline userId: & \({}^{n}\)16009265888\({}^{n}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 12: Artifacts Found in stories.feedTray Record. Artifacts created by the usage of user stories contained an additional value for the establishment of user connections. Mainly, they contain an attribute called isCloseFriends. Additionally, it is possible to obtain information on when a story was displayed and in what order it was seen. Utilizing the artifacts extracted from users.users, users.usernameToId, stories.reels, and relationships records, we were able to create connection analysis between the accounts employed in the experiments. The techniques for establishing connections between Instagram accounts are discussed in the proof-of-concept tool section. By examining the IndexedDB artifacts of Instagram, examiners can also detect a suspect account's focus and interests on social networks.