We present the forensic analysis of the artifacts left on Android devices by WhatsApp Messenger, the client of the WhatsApp instant messaging system. We provide a complete description of all the artifacts generated by WhatsApp Messenger, we discuss the decoding and the interpretation of each one of them, and we show how they can be correlated together to infer various types of information that cannot be obtained by considering each one of them in isolation. By using the results discussed in this paper, an analyst will be able to reconstruct the list of contacts and the chronology of the messages that have been exchanged by users. Furthermore, thanks to the correlation of multiple artifacts, (s)he will be able to infer information like when a specific contact has been added, to recover deleted contacts and their time of deletion, to determine which messages have 1 arXiv:1507.07739v1 [cs.CR] 28 Jul 2015 been deleted, when these messages have been exchanged, and the users that exchanged them.
REF discusses the forensic analysis of WhatsApp Messenger.
Forensic Analysis of WhatsApp Messenger on Android Smartphones
Digital Investigation, Vol. 11, No. 3, pp. 201-213, September 2014
Computer Science