Forensic analysis of ephemeral messaging applications: Disappearing messages or evidential data?

Abstract

Ephemeral messaging or ‘disappearing messages’ is the mobile-to-mobile transmission of multimedia messages that automatically disappear from the recipient's screen after the message has been viewed. This new feature can be enabled by users for more privacy when using instant messaging apps. A user can set messages to disappear within a certain timeframe: 24 hours, 7 days, or 90 days, after the time they are sent. While disappearing messages provide additional privacy to users, its anti-forensics capability creates challenges for investigators in the recovery of evidential artefacts that could be crucial to an investigation. In this paper, we conduct a comprehensive forensic analysis of ‘disappearing messages’ across different digital platforms (mobile, desktop, and cloud) and instant messaging apps (WhatsApp, Snapchat, and Telegram) to determine whether they can be recovered within a limited timeframe. The results from this study provide valuable information to investigators dealing with instant messaging apps that have this feature enabled and provides detailed understanding of how disappearing messages are stored, managed, and deleted compared to messages sent without this feature enabled.