# Browser Forensic Investigations of WhatsApp Web Utilizing IndexedDB Persistent Storage
## 5 Results
### WhatsApp Web IndexedDB Artifacts
#### 5.2.2 Stream:rememberMe: True  
\"Stream:rememberMe\" record is created when a user establishes the connection between the computer browser embodying the WhatsApp Web Application and the phone with WhatsApp Messenger. The record includes information on the record label and timestamp on its body. Record 2 shows an instance of this record. ``` {line: 2057, log: \"\({}^{\sim}\)O=? 2020-08-29 23:50:47.059:Stream:rememberMe: true\", timestamp: 1598763047704.23]  line: 2057 ```
{log: \"\({}^{\sim}\)O=? 2020-08-29 23:50:47.059:Stream:rememberMe: true\" timestamp: 1598763047704.23
```

**Record 1. ** Network Status Online

\"Stream:rememberMe\" is used when the suspect wants WhatsApp Messenger to remember the computer. This preference may signal recurrent usage of the computer by the suspect. Digital forensic investigation reports include information on the behavior of the suspect [32]. This information is presented to the court to make better sense of the suspect's motives. A suspect's frequent interaction with the evidence computer is important as it gives an inside on the behavioral characteristics of the suspect. #### 5.2.3 Media Load on Loaded Data

A \"MediaLoad:video.onloadeddata\" record is created, when a media file such as a video file is opened on either messenger or web application. Timestamps indicating the opening time of the media is placed in the record with the record label. Record 3 shows an instance of media load records. Many cases involving digital evidence are related to illegal images and videos of minors [33]. There are also cases of privacy issues between couples involving the distribution and exposition of private media [34]. In these cases, the information on when the media is accessed and how frequently it is accessed is crucial to the investigation [35]. #### 5.2.4 Recv: s<Number> [Call,...]

\"Recv: s<Number> [Call,...]\" record is created when a video or voice call is active using either messenger or the web application. Timestamp information of when the calls are active is included in the data with the record label. The application puts this log to the file multiple times during the call is active. It is also observed that a missed call can produce the \"Recv: s<Number> [Call,...]\" record. An unanswered voice call that rings for 1 min is seen to generate over nine instances of the record. Record 4 demonstrates this record type with an instance. ```
[line: 2345, log: \"O=? 2020-08-29 23:53:51.325: recv: s29 [Call,...]\", timestamp: 1598763231721.61]  Line: 2345 log: \"O=? 2020-08-29 23:53:51.325: recv: s29 [Call,...]\" timestamp: 1598763231721.61
```

**Record 3. ** Media Load on Loaded Data

The time frame of a video or voice call being active can provide information on when important calls are made. It can be further useful particularly with the cases where the investigation is taking place with both parties of the call. #### 5.2.5 Action Presence Available--Unavailable

An \"action, presence, unavailable\" record is created with the application client sending its presence information to the WhatsApp server. This record is indicative of a user being online or, in other words, actively using the application. However, we have observed that when the user walks away from the computer with the phone connected through WhatsApp Messenger, both devices become inactive in their use of the application and add the \"action, presence, unavailable\" record. This is the case even when the web application tab stays open. The connection of the devices is not dependent on the distance. This is evident from the connection not being lost when a distance is introduced between the devices. Additionally, a connection can be established when the computer is connected through WIFI and the Android device is connected through a service provider. The preliminary evidence indicates a timeout mechanism for the record to be created. This is supported by the fact that it takes eight to eleven seconds for the record to be created.