# Browser Forensic Investigations of WhatsApp Web Utilizing IndexedDB Persistent Storage
## 3 Background for IndexedDB and LevelDB  
IndexedDB is a relatively new object-oriented NoSQL transactional database. It makes use of JavaScript code to handle data on the client side. Its implementation details are shared by W3C (World Wide Web Consortium) which makes its structure constant through different platforms [19]. According to W3C specifications, IndexedDB utilizes B-tree structures for efficient database operations. B-trees are data structures that enable efficient manipulation of data in particularly large databases [20]. Google Chrome started its partial support for IndexedDB in 2012 with Chrome 11 and fully supported it since 2017 [21]. Similarly, major web browsers such as Firefox and Opera have provided full support for IndexedDB since 2017. In our previous study in 2019 [6], we discovered that top websites of the US listed by Alexa [22] have been highly utilizing IndexedDB technology since its full adoption. SQLite is commonly used for most common browser storage technologies like history and bookmarks through all major web browsers. Similarly, Mozilla Firefox utilizes SQLite for supporting IndexedDB [23]. However, Google Chrome announced that it implemented IndexedDB over LevelDB, a technology Google has been developing since 2003 [24]. LevelDB implementation brings advantages to Chrome as it is implemented for fast operations of key-value pairs [25]. A benchmark study of 2011 looking at the advantages of LevelDB over SQLite v3 shows that LevelDB is better suited for batch updates of web browsers [26]. Since IndexedDB operation standards are established by W3C, Google Chrome LevelDB technology adopts similar use of IndexedDB through JavaScript commands. The LevelDB storage keeps its contents in an Idb file. This file is kept locked, protecting its contents in accordance with the Same Origin Policy. Additionally.log and MANIFEST files are kept in the same location. When the database is opened, the information in the.log file is converted to datapoints and the MANIFEST file is updated with the information about the known datapoints. Datapoints are readable for the.ldb file whereas the.log file contains UTF (Unicode Transformation Format-16) encoded information as well as binary entries. The highest level in the IndexedDB is a database. Therefore, the first step for creating IndexedDB storage is to establish a database schema. Databases are established with a given version. These databases in turn contain object stores that are similar to tables of traditional databases. If a new version of the database is defined with the indication that there are upgrades to the database, the onupgradeneeded function is called to recreate the object stores. Otherwise, the onsuccess function is called, where the object store is retrieved from the existing storage. Similarly, in the first attempt, the onupgradeneeded function creates the object store [27]. Code 1 shows an example of the initiation of a database in JavaScript code. In order to add information to the object store, we need to define a transaction on the database and its object store. This transaction is used call add function and can be handled with the onsuccess and onerror functions. A similar read function can be called on transactions to retrieve the data. Code 2 shows an example of data creation, its insertion and retrieval from the object store defined in Code 1. ```
// Insertions successful request.onsuccess = function(event) { // handle the successful insertion } // Insertions error request.onerror = function(event) { // handling the insertion error } // var request = db.transaction[\"studyObjectStore\"], \"readwrite\") objectStore(\"studyObjectStore\") get(\"01\") // Retrieval successful request.onsuccess = function(event) { // do something with retrieved data such as'request.result.recordname' } // Retrieval error request.onerror = function(event) { // handling the retrieval error }
```  
**Code 2**. Data Insertion and Retrieval  
Browsers secure the contents of an origin from other origins by enforcing the Same Origin Policy [28].