Mobile Forensic Tools Validation and Evaluation for Instant Messaging

Abstract

Mobile technology is experiencing rapid development from year to year. Various types of models and operating systems are available on the market, followed by the development of applications for mobile devices. Behind the development of mobile technology, mobile devices are often used for crime. To handle a case related to a mobile device, an investigator needs to use forensic methodologies. Investigator also needs to know which tools are capable of handling mobile forensics of a specific artefact or mobile devices since each forensic tool has its limitation. The rapid development of mobile technology and the lack of understanding of forensic tools sometimes become an obstacle for an investigator in handling a case. This research conducted a forensic analysis of WhatsApp (WA) application on the Samsung Galaxy S4 and Samsung A3 using the logical acquisition of 3 forensic tools, namely: WA Key/DB Extractor, Oxygen Forensics, and Magnet AXIOM. National Institute of Standards and Technology (NIST) forensic tool parameters and additional parameters related to WA artefact s were used to evaluate forensic tools which will then be calculated to find acquisition capability index for each forensic tool. Acquisition capability index is expected to provide an overview and recommendations regarding forensic tools for conducting WA forensic analysis. Based on the acquisition capability index, Magnet AXIOM has advantages over Oxygen Forensics, and WA Key/DB Extractor in conducting forensic analysis of WA artefact s on Samsung Galaxy S4 and Samsung A3 with 77.77%. Thus it can be concluded that Magnet AXIOM is recommended to be used in handling WA artefacts.