# Browser Forensic Investigations of WhatsApp Web Utilizing IndexedDB Persistent Storage
## 1 Introduction  
Digital evidence has been a major contributor to the decision making of many important cases over the past few decades [1]. Signature cases such as the murder trials of [PERSON] [2] and [PERSON] [3], further indicate the strong dependency on digital evidence as the cases' final decisions were made based on digital evidence. As technology keeps developing, more cases will be dependent on digital evidence.  
Unfortunately, the defense against digital evidence today is very sophisticated and its admissibility is becoming a concerning issue [4]. Today, the presence of hard evidence on a suspect's computer is not accepted as a sufficient determinant for a verdict. As the volume and complexity of digital technology increases, so does the responsibility of digital investigators to connect evidence to suspects.  
A strong method to support the link of the evidence to the suspect is to back up the claim with matching information from independent sources. For instance, a suspect's access to a particular file, and extensive search records indicative of the same file's scrutinization on the internet can create correlating evidence chains. The timelines of creation, alteration, and last access of a sensitive file can indicate inconsistencies in the Windows Registry and browser's downloaded files information repository. Additionally, information from supplementary sources can be used to verify abnormalities in time frames indicating possible tampering of evidence.  
Newly emerging technologies are good opportunities to support traditional evidence with additional information. As new technologies rely on different storage and processing techniques, tempering with their origins requires extra effort on the suspect's part. Therefore, a cross confirmationwith additional sources serves as an extra layer of credibility for the findings. An obfuscation or change in the traditional sources is likely to create an inconsistency of information with alternative sources.  
IndexedDB is a newly developed NoSQL (Not Only SQL) transactional database system that enables fast access to persistent data through JSON (JavaScript Object Notation) objects [5]. It can be operated through JavaScript code which makes it highly usable for web browsers. A profound advantage of IndexedDB lies in its storage capacity. IndexedDB offers a large storage area starting from 50 MB of data for each origin while its competitor Web Storage technology can store maximum 5 MB of data [6; 7]. This advantage enabled IndexedDB to increase its utilization drastically in popular websites in the last few years. As many websites begin to use IndexedDB, increasingly it appears as a candidate to be a supporting source to traditional digital investigations.  
This paper scrutinizes the prospect of IndexedDB storage for the digital forensic investigations of the WhatsApp Web Application. In this scope, it raises two research questions:  
* Is it possible that the artifacts from the information stored by IndexedDB technology for the WhatsApp Web Application carry significant value for forensic investigations?
* Is the stored information suited to be utilized for effective time frame analysis during forensic investigations?  
By answering these questions, this research investigates the hypothesis that IndexedDB storage carries forensically significant artifacts for the WhatsApp Web Application. These artifacts can be used to create time frame analyses in forensic investigations. The following sections share the previous work on IndexedDB forensics and security, provide a background of IndexedDB and LevelDB technologies, explain the methodology for this research, present the findings with a proof-of-concept tool BrowSwEx, and put forward a conclusion and possible future work.