# Browser Forensic Investigations of WhatsApp Web Utilizing IndexedDB Persistent Storage
## 5 Results
### WhatsApp Web IndexedDB Artifacts
#### 5.2.2 Stream:rememberMe: True
After the.log file is processed, the obtained results are utilized in different functions for presentation of specified information. The tool utilizes the preg_match function and five specializing functions: EntireOutputList(), ChatOutputList(), PresenceOutputList(), MediaAccessOutputList() and VideoCallOutputList() to list the information and reach to the desired record formats listed in the previous section. An image of the tool presenting information in time frames can be seen in Figure 3.

### BrowSwEx Verification

The treatments from the Single Case Pretest-Posttest Quasi Experiment were detected successfully by BrowSwEx. However, an extensive number of entries and variety of similar log types indicated potential for error. Therefore, further verification appears to be necessary. BrowSwEx was tested with the Google Chrome Developer Tools [41]. Google Chrome Developer Tools lists every record of persistent storage for the active website. The information is displayed in a raw format with excruciating details and no option to search or sort. For Google Chrome Developer tools to operate on the website, the computer needs to be running and the website needs to be authenticated by the user's phone. Figure 3: BrowSwEx Listing WhatsApp Web Records. BrowSwEx parses the recorded.log file taken from the Chrome IndexedDB file storage folder. In other words, the analysis can be performed offline without user credentials present for authentication. The approach to the verification of the information displayed by BrowSwEx is folded in two parts:

* The existence of the records displayed were cross checked by Google Chrome Developer Tools. * The time of the treatment to create artifacts is checked against the time displayed in the tool user interface. ### BrowSwEx Restrictions

In order to access the <numberpattern > log file, the <userprofile> location (different for every username) in the \"WhatsAppWebIDB.php\" file has to be updated. Since every environment is different. In some cases, the user needs to manually obtain the <numberpattern > log file from the IndexedDB file storage location, rename it to input.log and place it in the web server directory. Additionally, some records seem to be repetitive, e.g., when the user starts a video call, \"Recv: s<Number> [Call,...]\" record is entered to IndexedDB file multiple times for the same time entry. After some consideration, these repetitive entries have not been eliminated. This is because the different logs contain different identifications which can be important in the recreation of the investigation results. Nonetheless, BrowSwEx is an open source tool and can be improved by the users according to their needs. Users need to have a functional server that parses PHP, and transfer the tool files to their www directory to get the tool working. We have used a WAMP (Windows, Apache, MySQL, and PHP) server [42] with built-in PHP and Apache Server during the development of BrowSwEx. ## 8 Conclusions

In this research, we scrutinized the artifacts stored by IndexedDB technology for the WhatsApp Web Application. Two hypotheses are created for scrutinization: IndexedDB storage carries forensically significant artifacts for the WhatsApp Web Application and WhatsApp Web Application artifacts in IndexedDB can be used to create time frame analyses in forensic investigations. A Single Case Pretest-Posttest Quasi Experiment was performed to evaluate the artifacts left in IndexedDB storage by the application. A proof-of-concept tool, BrowSwEx, was developed to demonstrate the value of the artifacts and introduce a technique of creating time frame analysis. The results show that IndexedDB storage is a valuable source of information for forensic investigations when analyzed specifically for the WhatsApp Web Application. Information based on the actions of the suspect is detected to be suitable for utilization in a time frame indexed forensic investigation evidence presentation. Therefore, the two hypotheses created for the research are proved to be true.