# Browser Forensic Investigations of WhatsApp Web Utilizing IndexedDB Persistent Storage
## 2 Related Works  
While several research studies have scrutinized the applicability of forensic techniques and tools on the WhatsApp mobile application [8; 9; 10; 11] and its network investigations [12], fewer studies have focused on WhatsApp Web forensics [13; 14]. Additionally, several of the research studies with a broader scope of instant messaging applications touched upon forensic analysis of WhatsApp [15; 16]. However, their focus was not on the forensic investigations of persistent storage of IndexedDB, which is a relatively new subject area for digital forensics [6; 17; 18]. [PERSON] [8] investigated the artifacts left on Android devices by the WhatsApp Messenger application. The author considered all the artifacts left by WhatsApp Messenger and demonstrated a correlation of information merged from various artifacts. The acquired data reflected the activities of adding/deleting a contact, sending messages, and the feedback on the delivery of the messages. The scope of this research was limited to WhatsApp Messenger on Android devices, while WhatsApp Web and iOS systems were not addressed. [PERSON] [9] provided an outline of a methodology for forensic investigations of WhatsApp on Android phones. The research covered volatile memory acquisition as an addition to static external storage acquisition. The research utilized the WhatsAppXtract tool on the SQLite database in the backed-up folder without rooting the android device for non-volatile memory acquisition. Whereas, a memory dump utility, Memfetch, was used for the extraction of information from the volatile memory. A tool called whatsappRamXtract was introduced for the analysis and the presentation of the extracted data. It was argued that the data analyzed was critical and forensically significant. [PERSON] and [PERSON] [10] inspected the WhatsApp mobile application for forensic investigations on iOS 8.3, Android Lollipop 5.0.1, and Windows Phone 8.1 utilizing the forensic investigation tools of EnCase, UFED (Universal Forensic Extraction Device), and Oxygen Forensic Suite. The authors explicated that contact information was recovered from iOS and Android with Universal Forensic Extraction Device and Oxygen Forensic Suite. However, nothing was recovered from Windows Phone 8.1. It is discussed in the paper that the security mechanisms employed by Windows Phone 8.1 made it very difficult to perform a traditional forensic acquisition. As a result, the paper suggested live data forensic investigations to recover WhatsApp artifacts from Windows Phone 8.1 operating systems that were not accessible with traditional techniques. [PERSON] et al. [11] used NIST (National Institute of Standards and Technology) measurement parameters to evaluate the forensic investigation tools specializing in Android phones to compare their performances on WhatsApp forensics. Nine core assertions, seven optional assertions along with six core requirements, and optional feature requirements of NIST measurement parameters were utilized in the scope of the work. The research identified Belkasoft Evidence as the tool that scored the best among other tools, whereas WhatsApp Key/DB Extractor came out as the most cost-efficient, and Oxygen Forensic as the best at obtaining the artifacts. [PERSON] et al. [12] conducted research on the decryption of the information transferred during WhatsApp calls. The procedure included decryption of network traffic, obtaining artifacts of the call, and the development of a Python tool to convert obtained Wireshark dump files to HTML format. The research stated the artifacts can be obtained from the WhatsApp calls, such as phone numbers, duration of the call, IP addresses of the server, and the time of call termination. [PERSON] and [PERSON] [13] gave a forensic investigation framework for the WhatsApp mobile application and the WhatsApp Web browser application. A mobile information extraction technique used for the framework involves extracting the encrypted message storage file of WhatsApp conversations.