## 2 Literature Review
### Forensically Relevant Artifacts  
Forensic investigations of cryptocurrency wallets' objectives consist of discovering evidence of cryptocurrency activity, such as transaction logs and addresses used to send funds. Researchers in [36] studied data pertaining to RAM to check for traces of cryptocurrency wallets from Windows OS. The data retrieved in this study demonstrate that the memory processes of the wallets of popular bitcoin clients (i.e., Bitcoin Core and Electrum) may serve as a good source of information. Similarly, the researchers in [37; 38] looked at what cryptocurrency relevant artifacts can be recovered from the RAM and hard disk image of the Windows OS.  
Moreover, researchers in [39] investigated the cryptocurrency wallets of Monero and Verge coins that were installed on the Linux operating system. They were able to extract critical information from the RAM analysis, as well as the image of the drive that was acquired in the study. Furthermore, the researchers in [39] examined multiple sources of evidence that can be recovered from a virtual machine running Ubuntu OS. They analyzed the computer's volatile memory, network traffic, and hard-disk images of the computer, where they found many forensic artifacts. Furthermore, Litecoin and Dark currencies have been investigated in iOS and Android forensic research [40]. The authors were able to recover information such as metadata, installation data, timestamps, and usage traces. Furthermore, when it comes to mobile devices, the authors of [41] detail how to extract forensic information from the Bitcoin and Dogecoin wallets on the Android smartphone. They were able to retrieve information such as wallet identifiers, transaction identifiers, timestamps, emails, cookies, and OAuth tokens.  
In the last few years, researchers have devoted a substantial amount of time and effort to advance the investigation of digital crimes. As a result, a significant number of researchers intend to assist law enforcement agencies when it comes to computer forensics [42; 43; 44], digital forensics [45; 46], mobile forensics [47; 48; 49], cyber forensics [50; 51; 52], IoT forensics [53; 54], and drone forensics [55; 56]. However, to the best of our knowledge, no research has been conducted on selected cryptocurrency Web3 wallet apps on iOS and Android operating systems in the academic literature on mobile and cyber forensics. A few researchers have conducted forensic investigations on Bitcoin wallets, such as [37; 38; 40; 57]; however, they are limited to outdated applications that are no longer used or are used in old versions of the OS. Furthermore, according to the findings of the researchers in [58], digital forensics is still relatively new for blockchain technologies. Table 2 provides a brief summary of the shortcomings identified in previous related studies. Therefore, with the dramatic increase in the use of Web3 wallets to store and manage cryptocurrencies and NFTs, there is a need to investigate what can be recovered and from where. Therefore, the purpose of this work is to contribute to filling the knowledge gap for Web3 wallets that can store cryptocurrencies and NFTs on iOS and Android devices.  
\begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**Article** & **Objective(s)** & **Methods and Techniques** & **Shortcomings** \\ \hline  & & In the paper, the authors focused on using vulnerabilities that enables a password exploit using offline brute force attempts, which can be used to steal for forensics. \\  & & & \\ \hline  & & The author used iFunBox for iOS, recover information, author was able to recover information, author failed to extract information from the logical extractions of the Android Device (i.e., Samsung Galaxy4), therefore, the study used an emulator to be able to recover information for Android. \\  & & & \\ \hline \hline  & & \\ \end{tabular}
\end{table}
Table 2: A summary of some shortcomings in related works.