## 3 Experimental Setup  
To capture network traffic, network infrastructure was designed as depicted in Figure 2 inspired by [18]. The proposed experimental setup includes a firewall, an access point, and a PC to display the ongoing traffic of mobile devices passing through the network. The Signal app-based mobile device was connected to the internet through a wireless access point, and all the internet traffic of the wireless access point was routed through a PC-based pfSense firewall [34]. The role of the firewall was to monitor, sniff, and capture the entire network traffic. Thus, the firewall-generated trace files were saved for analysis. The configured firewall filtered out the Signal app-based internet traffic in a controlled environment. The access point aided to connect other devices such as mobiles and PCs with firewalls.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Article**} & \multicolumn{2}{c}{**Device Forensic**} & \multicolumn{2}{c}{**Network Forensic**} \\ \cline{2-5}  & \begin{tabular}{c} **Location of** \\ **Artifacts** \\ \end{tabular} & \begin{tabular}{c} **Database** \\ **Decoding** \\ \end{tabular} & \
\begin{tabular}{c} **Packet** \\ **Analysis** \\ \end{tabular} &
\begin{tabular}{c} **Extraction of IP** \\ **Addresses** \\ \end{tabular} \\ \hline [PERSON] et al. [10] & X & ✓ & X & X \\ \hline [PERSON] et al. [8] & ✓ & X & X & X \\ \hline [PERSON] et al. [19] & X & X & ✓ & ✓ \\ \hline [PERSON] et al. [18] & ✓ & ✓ & ✓ & ✓ \\ \hline [PERSON] et al. [9] & ✓ & ✓ & X & X \\ \hline [PERSON] et al. [12] & ✓ & ✓ & X & X \\ \hline [PERSON] et al. [29] & ✓ & ✓ & X & X \\ \hline [PERSON] et al. [11] & ✓ & ✓ & X & X \\ \hline [PERSON] et al. [14] & ✓ & ✓ & X & X \\ \hline [PERSON] et al. [13] & ✓ & ✓ & X & X \\ \hline \hline \end{tabular}
\end{table}
Table 1: A comparison of device and network forensic analysis for android apps.  
Figure 2: Experimental setup for capturing the network encrypted traffic of Signal app.  
For network traffic analysis, the Wireshark software [35] was installed to monitor the encrypted traffic by analyzing the trace files. It is noteworthy that the IP addresses and ports were in plaintext while the payload was encrypted for the sake of secrecy and privacy services. The IP addresses and ports created an opportunity to determine the behaviors of apps and its various activities performed during the communication. During experiments, we collected a large no. of trace files for analysis purposes, some of them are available on [36] for better understanding. Table 2 shows the detail of the devices and tools used during experiments.  
To analyze the Signal app's behavior, e.g., how client and server communication works, the proposed strategy sniffed the encrypted traffic between the client and its servers, where it showed a list of different servers with IP addresses and ports. Identification of ports and IP addresses aid in imposing new rules in the network. For example, during experiments we observed that different app servers provide separate services such as text, media, and calls (Section 5). The detail of user activities such as opening the Signal app, text indicators, text messages, and audio calls are discussed in the result and analysis section.