# Browser Forensic Investigations of WhatsApp Web Utilizing IndexedDB Persistent Storage
## 5 Results
### WhatsApp Web IndexedDB Artifacts
#### 5.2.2 Stream:rememberMe: True
However, more information can be obtained through inspection of the network traffic generated by the devices during the connection. In this study our subject is the IndexedDB storage of suspect's computer and the artifacts created in it with the given treatment of the experiment. The beginning of the time when the user is walking away from the computer is recorded with the timestamp of the record label. Although, its timing is not very precise as the records are created after eight to eleven seconds. It should be noted that when the connection between the phone and the computer is problematic, the presence unavailable record is occasionally added with a short duration of ten to twenty seconds before the \"action, presence, available\" record is added again. During the treatments, one such record has been observed. It is also notable that when the durationfor the user's absence is long, multiple records are added. Similarly, the user available record is occasionally added without the user being offline or stepping away from the computer. Record 5 shows an instance of this record type. ```
_(line: 2406, log: \"\({}^{\star}\)O=? 2020-08-29 23:55:10.199:sending: 1598763310.-44, action, presence, unavailable), timestamp: 1598763310592.405] Line: 2406 log: \"\({}^{\star}\)O=? 2020-08-29 23:55:10.199:sending: 1598763310.-44, action, presence, unavailable\" timestamp: 1598763310592.405
```

**Record 5. ** Action Presence Unavailable

In cases involving digital evidence, one of the very common defenses is the claim that the suspect was not the person using the computer at the time of the offense [36]. Personal devices such as mobile phones are more likely to be used by a single individual. While computers can be used by more than one user, it is a more likely case in businesses with printing, database, and common purpose computers. A record displaying when the suspect walks away from the computer is potentially significant information to support or be against the defense of not being present during the time offense taking place. #### 5.2.6 Send Action Message Chat and Recv Action Message Relay Chat

The \"send\(<\)code\(>\), action, message, chat\" and \"recv\(<\)code\(>\) action, msg, relay, chat\" records are created when a text message is sent from one account to another. The application keeps more detailed information on the handshake of the device to send the message and further details on its delivery. However, these messages vary in means of network delays and server states. A Plain Send--Receive record is observed to be sufficient to pinpoint a messaging activity for the time frame analysis. The Send--Receive records contain timestamps and record labels. Additionally, an identifier code such as 3 EB0A2F3697... 6B3365 is present in the record. This code seems to contain information on the account the message is sent to, or the account the message is originated from. Therefore, it can be used for separating the conversations into different accounts. However, there is no identifiable way to determine what account the code belongs to. ```
_(line: 2267, log: \"\({}^{\star}\)O=? 2020-08-29 23:51:41.554: send: 3 EB00698747... 00B6 AB, action, message, chat\({}_{\_}\)3 EB0069874767200B6 AB\", timestamp: 1598763101996.04
```

**Record 6. ** Send Action Message

In digital investigations where the examiner does not have access to the suspect's WhatsApp credentials, the information of when the suspect sent a message and received a message can be useful for determining his actions at the given time. ## 6 Discussion

The artifacts created in the IndexedDB storage by the WhatsApp Web Application appear to provide extensive information on the actions of a user. This information is recorded in a format including the time of the action in the UNIX epoch time format, additional to the human-readable format. UNIX epoch time is the number of seconds since 1 January 1970 (midnight UTC/GMT). Therefore, it is in a different time zone than the human-readable time in the records.