## 1 Introduction  
End-to-end encryption based instant messaging (IM) apps have captured the attention of users due to increasing security and privacy concerns. Owing to this, organizations and individuals have adopted various types of IM platforms for their regular communication. Further, the salient features of IM apps such as convenience, speed, immediate receipt, acknowledgment, and reply to messages attract people of all ages. Similarly, organizations enjoy inexpensive and effortless marketing/advertising opportunities by using these platforms [1]. According to Juniper research [2], IM users substantially reach 4.3 billion in 2020 which is a yearly increase of approximately 9%. The COVID-19 pandemic has also increased the use of IM applications due to work from home policies in most organizations [3]. Hence, it is noteworthy that IM-based apps are performing a vital role in today's communications. Common IM apps such as Signal, WhatsApp, Facebook Messenger, WeChat, and many more, employ end-to-end encryption techniques during transmission to provide security and privacy to user data. The Signal app claims to use the secure protocol during communication, i.e., Signal Protocol. Malicious actors are also taking advantage of the end-to-end encryption feature of IM apps. Thus, the provision of security features (end-to-end encryption) in these apps provide an attractive communication medium for digital crime or fraudulent activities. Therefore, forensic investigation of digital crimes may increase effort and high possibility of failure scenarios due to end-to-end encryption services in IM apps [4]. For investigation purposes, device and network forensics strategies need to be followed. Device forensics helps to determine the file structure and extraction of useful information stored on the devices. In literature, numerous strategies of device forensics based on social media apps have already been proposed and are also useful, and have their merits and demerits [5; 6; 7; 8; 9; 10; 11]. Some of them also investigated encrypted databases and file structures to identify the evidence [12; 13]. However, device forensic strategies cannot be fully utilized in the case of end-to-end encryption on the user's or the app's data [5; 7; 10; 11; 13; 14; 15]. It was also observed during the literature review phase that IM applications are extensively analyzed but limited to the device's internal structure of databases. On the other hand, network forensics is a type of forensic analysis where the reconstruction of events is performed after an incident or cybercrime. In other words, a major concern is tracing communications through the network (live/backup) packets, i.e., to identify the traces of the apps' or users' behavior, data breaches, and other illicit activities. Thus, encrypted network traffic analysis uncovers the network-related artifacts which can be beneficial to the forensic investigator and are shown great interest [16; 17]. However, the provision of end-to-end encryption protects the data during transmission. This becomes a challenge for the forensic investigator while identifying the behaviors of apps' or user's data from encrypted traffic. In literature, there are limited encrypted network forensics strategies proposed, especially on an IM-based app [8; 18; 19; 20; 21] that can be used to find some important events such as connection establishment, an encryption protocol, and payload sizes for analysis [21]. Moreover, these can also identify the basic user's or app's behavior, i.e., calling, texting, etc. [8; 18; 19]. However, there is still room to explore the characteristics of encrypted IM app-based packets to identify the apps' or user's behavior and employed clients' and servers' IPs to support forensic investigation. In this research, we studied the popular IM Signal app. In the case of the Signal app, the communication data are (end-to-end) encrypted, owing to which it becomes difficult to investigate or often impossible to obtain the corresponding plain text as the keys are unknown.