## 2 Related Work
Their primary objective was to determine whether data from these apps are stored within the device's internal storage. Utilizing forensic tools such as Autopsy, XRY, and Magnet AXIOM, they successfully extracted a substantial amount of critical data, aiding in future crime investigations. In [10], the authors investigated real case records obtained from the Dubai Police department to address the main issues encountered by digital forensics, including the huge amount of data and the level of case complexity. The research utilized a mixed-methods approach, encompassing both quantitative and qualitative analyses, along with the phenomenology model (interview confirmation). This approach was employed to assess the strategies employed in case allocation and participant selection. The study identified the main factors leading to delays in investigations, and the need for collaborative data processing and training among investigators. [PERSON] and [PERSON] [26] conducted a forensic examination of WhatsApp on Samsung C9 Pro handsets, emphasizing forensic techniques for analyzing WhatsApp-related artifacts. Their research scrutinized parameters like contact lists, chat messages, files, and logs. The study concluded that the combination of Magnet AXIOM and WA Key/DB Extractor yielded the best results for WhatsApp artifact recovery. Focusing on extracting digital evidence from Facebook Messenger, the study in [27] followed the NIST methodology and employed the Oxygen Forensics Suite and Magnet AXIOM. Researchers successfully obtained various pieces of digital evidence, including images, accounts, and conversation transcripts, with Magnet AXIOM outperforming Oxygen Forensics Suite. Researchers in [28] sought to address a knowledge gap by exploring the recovery of Facebook data after the app is uninstalled from a smartphone. Categorizing the retrieved data objects facilitated a clearer description of the user information and recoverable app data. This research paper's accomplishments lay in identifying the recovery and path of Facebook data, offering a foundation for future studies. [PERSON] [19] proposed a two-stage model for data acquisition from Android smartphones, combining manual techniques for initial data collection and logical techniques for processing using a developed tool. The research demonstrated promising results in retrieving data from social networking apps like WhatsApp and Facebook Messenger, highlighting the potential for future improvements. In [29], a similar conclusion was drawn after examining both the logical and the physical acquisition methods. The study recommended utilizing more than one mobile forensic tool for evidence extraction. In their work presented in [30], the investigators focused on WhatsApp, WeChat, Viber, and Telegram, all renowned as some of the most extensively employed encrypted instantaneousing applications. The research delved into the forensic implications surrounding encrypted instant-messaging systems. To scrutinize the artifacts generated by these applications, the researchers harnessed the Android Debugging Bridge (ADB) tool, complemented by several other open-source utilities. The study shed light on the challenges encountered by researchers when collecting forensically relevant artifacts. Furthermore, it provided investigators with valuable insights into where to locate crucial data within any of the applications under scrutiny during their investigative processes. In a study carried out by [PERSON] et al. in 2017 [14], a methodology was employed for the forensic analysis of Android applications, with a particular focus on investigating Telegram Messenger. The primary approach involved meticulously planned experiments conducted on virtual smartphones, as opposed to real devices. This approach aimedto ensure the generality and repeatability of research results, which were subsequently rigorously validated for their applicability to Telegram.