# Browser Forensic Investigations of WhatsApp Web Utilizing IndexedDB Persistent Storage
## 5 Results
### WhatsApp Web IndexedDB Artifacts
#### 5.2.2 Stream:rememberMe: True
For instance, 1598763047703.76 from Record 1 corresponds to \"Sun, 30 Aug 2020 04:50:47 GMT\". In the same record, the time is seen as \"2020-08-29 23:50:47.044\" because the subject computer is in the (GMT-5) time zone. The records are divided with numbering which makes it easier for parsing. It can be observed in Records 1 to 6 that the information repeats in different formats. The first set of records represents the information in brackets whereas the subsequent record separates the time, label, and line number into different lines. This is indicating a design that intends to support different methods of information collection. It is observed that the actions taken with the WhatsApp Messenger Application in the phone are recorded in WhatsApp Web IndexedDB storage during an active connection. If a user answers a video call or watches a video through the application from the phone, its information record will be found in the computer. As the actions taken by a user in the WhatsApp Messenger and Web Applications are stored in a LevelDB file that can easily be parsed and manipulated by the suspect, a concern for privacy can be raised. Even though there is no conversation saved directly into this file, the timeline of a person viewing media files and the information of the times they are spending with their computers can be calculated easily. #### IndexedDB Implementation Across Different Browser Technologies

This study focuses on Google Chrome storage of WhatsApp Web artifacts on IndexedDB, which is implemented in LevelDB. However, various implementations exist across different browsers. Table 2 summarizes the technologies behind IndexedDB for major browsers. Microsoft Edge and Opera use LevelDB for IndexedDB like Google Chrome. Therefore, the concepts detailed in the study applies for these browsers as well. Mozilla Firefox utilizes SQLite files for IndexedDB, which is easily accessible with SQLite browsers. Figure 2 shows a WhatsApp Web IndexedDB storage file displayed in the SQLite Browser [37]. It is important to highlight that there is no security mechanism blocking access to the IndexedDB SQLite file utilized for Mozilla Firefox. Internet Explorer utilizes.dat files for its entire browser storage. These files are specific to Internet Explorer and can be accessed by any text editor. \begin{table}
\begin{tabular}{c c} \hline \hline
**Browser** & **Technology** \\ \hline Google Chrome & LevelDB \\ Microsoft Edge & LevelDB \\ Opera & LevelDB \\ Mozilla Firefox & SQLite \\ Internet Explorer &.dat files \\ \hline \hline \end{tabular}
\end{table} 
Table 2: IndexedDB Technology Across Different Browsers. ## 7 BrowSwEx

IndexedDB can be operated through JavaScript code. However, the Same Origin Policy prevents a database established by localhost or any other origin to access the WhatsApp Web content stored in the browser. Therefore, the only way to reach the records is through direct access to the files kept in the Google Chrome IndexedDB file location. When the WhatsApp Web is initiated in the Chrome browser, an.ldb file is created to contain all information about the present and previous interactions with the application. Google Chrome uses LevelDB for IndexedDB storage. LevelDB is developed with C/C++ technology. Therefore, direct access to the.ldb files can only be achieved using C/C++ programs [38, 39]. However, as it is discussed in the background and results sections,.ldb files leave information in a.log file that is stored in the same file location as the.ldb file. Therefore, there are two ways to collect the WhatsApp Web IndexedDB records from Google Chrome. The first way is to utilize a C compiler with a LevelDB library [39]. The second way is to process the.log file by parsing the raw text log style information. For the proof of concept, BrowSwEx is developed using a PHP program that systematically parses.log file that is produced by.ldb file [40]. The pseudocode employed by BrowSwEx for processing the.log file can be seen in Pseudocode 1. Figure 2: SQLite Browser Displaying Mozilla Firefox IndexedDB SQLite File.