Windows instant messaging app forensics: Facebook and Skype as case studies

PLoS ONE

Volumn 11, Issue 3, 2016, Pages

  Yang, Teing Yee ^a   Dehghantanha, Ali ^b   Choo, Kim Kwang Raymond ^c   Muda, Zaiton ^a  

^a UNIVERSITY PUTRA MALAYSIA   (Malaysia)

^b UNIVERSITY OF SALFORD   (United Kingdom)

^c UNIVERSITY OF SOUTH AUSTRALIA   (Australia)

Author keywords

[No Author keywords available]

Indexed keywords

ARTICLE; ARTIFACT; CONVERSATION; FORENSIC SCIENCE; HUMAN; SOFTWARE; MOBILE APPLICATION; SOCIAL MEDIA;

FORENSIC SCIENCES; MOBILE APPLICATIONS; SOCIAL MEDIA; SOFTWARE;

EID: 84978640065     PISSN: None     EISSN: 19326203     Source Type: Journal    
DOI: 10.1371/journal.pone.0150300     Document Type: Article

References (77)

1. The Radicati Group Releases “Instant Messaging Statistics Report, 2015–2019. California: Radicati Group; 2015 March 16. Available: http://www.radicati.com/?p=13001. Accessed 18 June 2015.
2. Online dating fraud up by 33% last year. London: City of London Police; 2015 [2015 February 13] Available: https://www.cityoflondon.police.uk/advice-and-support/fraud-and-economic-crime/nfib/nfibnews/Pages/online-dating-fraud.aspx. Accessed 29 May 2015
3. Meyers SL. Special Report, Part 1: “Diploma mill” scams continue to plague Milwaukee’s adult students. Washington: Milwaukee Neighborhood News Service; 2014 May 21. Available: http:// milwaukeenns.org/2014/05/21/special-report-diploma-mill-scams-continue-to-plague-milwaukeesadult-students/. Accessed 24 May 2015
4. Timoney N. Consumer Contact: Job Advertising Fraud. Bangor: WABI TV5; 2014 May 12. Available: http://wabi.tv/2014/05/12/consumer-contact-job-advertising-fraud/. Accessed 24 May 2015
5. Instant messaging Trojan spreads through the UK. [Place unknown]: Help Net Security. 2014 May 27. Available: http://www.net-security.org/malware_news.php?id=2773. Accessed 24 May 2015
6. Barnes T. Margate pedophile jailed for five years. U.K: Thanet Gazette; 2014 April 7. Available: http://www.thanetgazette.co.uk/Margate-paedophile-jailed-years/story-20922860-detail/story.html. Accessed 24 May 2015
7. Godfrey M. Pedophiles coercing kids using phone app. Sydney: Sydney Morning Herald; 2014. Available: http://news.smh.com.au/breaking-news-national/pedophiles-coercing-kids-using-phone-app20130327-2gu3a.html. Accessed 24 May 2015
8. McCallum N. Pedophile posed as Bieber to lure victims. Australia: Mi9;2013. Available: http://www.9news.com.au/world/2013/09/17/10/30/pedophile-posed-as-bieber-to-lure-victims. Accessed 24 May 2015
9. Jacksonville Man Sentenced in Child Pornography Case. Raleigh: The Federation Bureau of Investigation (FBI); 2015. Available: http://www.fbi.gov/charlotte/press-releases/2015/jacksonville-mansentenced-in-child-pornography-case. Accessed 20 May 2015.
10. Norouzizadeh Dezfouli F, Dehghantanha A, Eterovic-Soric B, Choo K-KR. Investigating Social Networking applications on smartphones detecting Facebook, Twitter, LinkedIn and Google+ artefacts on Android and iOS platforms. Australian Journal of Forensic Sciences. 2015 Aug 7;1–20.
11. Ali D. Mining the Social Web: Data Mining Facebook, Twitter, LinkedIn, Google+, Github, and More. Journal of Information Privacy and Security. 2015 Apr 3; 11(2):137–8.
12. Investigative Uses of Technology: Devices, Tools, and Techniques. U.S: National Criminal Justice Reference Service (NCJRS); 2007 October 3. Available: https://www.ncjrs.gov/pdffiles1/nij/213030.pdf. Accessed 4 May 2015.
13. Barghuthi NBA, Said H. Social Networks IM Forensics: Encryption Analysis. Journal of Communications. 2013; 8: 708–715. doi: 10.12720/jcm.8.11.708–715
14. Golden TW, Skalak SL, Clayton MM. A Guide to Forensic Accounting Investigation. 2 edition. Hobo-ken, N.J: Wiley; 2011.
15. Procure Secure: A guide to monitoring of security service levels in cloud contracts—ENISA. Europe: European Union Agency for Network and Information Security (ENISA); 2012 April 2. Available: https://www.enisa.europa.eu/activities/Resilience-and-CIIP/cloud-computing/procure-secure-a-guide-tomonitoring-of-security-service-levels-in-cloud-contracts. Accessed 10 December 2015.
16. Dickson M. An examination into AOL Instant Messenger 5.5 contact identification. Digital Investigation. 2006; 3: 227–237. doi: 10.1016/j.diin.2006.10.004
17. Martini B, Choo K-KR. An integrated conceptual digital forensic framework for cloud computing. Digital Investigation. 2012; 9: 71–80. doi: 10.1016/j.diin.2012.07.001
18. Quick D, Martini B, Choo R. Cloud Storage Forensics. Syngress; 2013.
19. Kiley M, Dankner S, Rogers M. Forensic Analysis of Volatile Instant Messaging. In: Ray I, Shenoi S, editors. Advances in Digital Forensics IV. Springer US; 2008. p. 129–38. Available: http://link.springer.com/chapter/10.1007/978-0-387-84927-0_11. Accessed 11 June 2015.
20. Forensic Investigation of Instant Messenger Histories. [Place unknown]: Forensic Focus; [Date unknown]. Available: http://www.forensicfocus.com/forensic-investigation-of-instant-messengerhistories. Accessed 24 May 2015.
21. Reust J. Case study: AOL instant messenger trace evidence. Digital Investigation. 2006; 3: 238–243. doi: 10.1016/j.diin.2006.10.009
22. Carvey H. Instant messaging investigations on a live Windows XP system. Digital Investigation. 2004 Dec; 1(4):256–60.
23. Quick D, Choo K-KR. Dropbox analysis: Data remnants on user machines. Digital Investigation. 2013; 10: 3–18. doi: 10.1016/j.diin.2013.02.003
24. Quick D, Choo K-KR. Google Drive: Forensic Analysis of Data Remnants. Journal of Network Computing and Application. 2014; 40: 179–193. doi: 10.1016/j.jnca.2013.09.016
25. Quick D, Choo K-KR. Digital droplets: Microsoft SkyDrive forensic data remnants. Future Generation Computer Systems. 2013; 29: 1378–1394. doi: 10.1016/j.future.2013.02.001
26. Brockschmidt K. Programming Windows Store Apps with HTML, CSS, and JavaScript. Microsoft Press; 2014
27. Mehreen S, Aslam B. Windows 8 cloud storage analysis: Dropbox forensics. In IEEE; 2015. p. 312–7. Available: http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=7058522. Accessed 6 April 2015.
28. Fleming R. How many devices can you install a Windows 8 app on?. U.S: Microsoft Corporation; 2013 October 1. Available: http://blogs.msdn.com/b/education/archive/2013/10/01/how-many-devices-canyou-install-a-windows-8-app-on.aspx. Accessed 28 March 2015
29. How to store user credentials (XAML). U.S: Microsoft; [Date unknown]. Available: https://msdn.microsoft.com/en-us/library/windows/apps/xaml/Hh465069(v=win.10).aspx. Accessed 24 May 2015.
30. Sanna P, Wright A. Windows 8.1 Absolute Beginner’s Guide. Que Publishing; 2013.
31. Thomson A. Windows 8 Forensic Guide. Washington; The George Washington University; 2012. Available: http://propellerheadforensics.files.wordpress.com/2012/05/thomson_windows-8-forensicguide2.pdf. Accessed 13 May 2015.
32. Rasmussen B, High-Performance Windows Store Apps. Microsoft Press; 2014.
33. Iqbal A, Al Obaidli H, Marrington A, Jones A. Windows Surface RT tablet forensics. Digital Investigation. 2014 May; 11, Supplement 1: S87–S93.
34. Lee C, Chung M. Digital Forensic Analysis on Window8 Style UI Instant Messenger Applications. In: Park JJ (Jong H, Stojmenovic I, Jeong HY, Yi G, editors. Computer Science and its Applications. Springer Berlin Heidelberg; 2015. p. 1037–42. Available: http://link.springer.com/chapter/10.1007/978-3-662-45402-2_147. Accessed 22 March 2015.
35. Carvey H. Windows Forensic Analysis Toolkit: Advanced Analysis Techniques for Windows 8. Elsevier; 2014.
36. Dickson M. An examination into MSN Messenger 7.5 contact identification. Digital Investigation. 2006 Jun; 3(2):79–83.
37. Dickson M. An examination into Yahoo Messenger 7.0 contact identification. Digital Investigation. 2006 Sep; 3(3):159–65
38. Dickson M. An examination into Trillian basic 3.x contact identification. Digital Investigation. 2007 Mar; 4(1):36–45.
39. Yasin M, Abulaish M. DigLA–A Digsby log analysis tool to identify forensic artifacts. Digital Investigation. 2013 Feb; 9(3–4):222–34.
40. Yasin M, Kausar F, Aleisa E, Kim J. Correlating messages from multiple IM networks to identify digital forensic artifacts. Electron Commer Res. 2014 Sep 18; 14(3):369–87
41. Yasin M, Abulaish M, Elmogy MNN. Forensic Analysis of Digsby Log Data to Trace Suspected User Activities. In: Park JH (James), Kim J, Zou D, Lee YS, editors. Information Technology Convergence, Secure and Trust Computing, and Data Management. Springer Netherlands; 2012. p. 119–26. Available: http://link.springer.com/chapter/10.1007/978-94-007-5083-8_16. Accessed 1 April 2015.
42. Van Dongen WS. Forensic artefacts left by Windows Live Messenger 8.0. Digital Investigation. 2007 Jun; 4(2):73–87.
43. Van Dongen WS. Forensic artefacts left by Pidgin Messenger 2.0. Digital Investigation. 2007 Sep; 4 (3–4):138–45.
44. Levendoski M, Datar T, Rogers M. Yahoo! Messenger Forensics on Windows Vista and Windows 7. In: Gladyshev P, Rogers MK, editors. Digital Forensics and Cyber Crime. Berlin, Heidelberg: Springer Berlin Heidelberg; 2012. p. 172–9. Available: http://link.springer.com/10.1007/978-3-642-35515-8_14. Accessed 6 April 2015.
45. Wong K, Lai ACT, Yeung JCK, Lee WL, Chan PH. Facebook Forensics. Singapore: Valkyrie-X Security Research Group; 2011 July. Available: www.fbiic.gov/public/2011/jul/Facebook_ForensicsFinalized.pdf. Accessed 12 May 2015.
46. Al Mutawa N, Al Awadhi I, Baggili I, Marrington A. Forensic artifacts of Facebook’s instant messaging service. Internet Technology and Secured Transactions (ICITST), 2011 International Conference for. 2011. pp. 771–776.
47. Al Mutawa N, Baggili I, Marrington A. Forensic analysis of social networking applications on mobile devices. Digital Investigation. 2012 Aug; 9, Supplement: S24–S33.
48. Said H, Yousif A, Humaid H. IPhone forensics techniques and crime investigation. In IEEE; 2011. p. 120–5. Available: http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6107946. Accessed 4 July 2015.
49. Walnycky D, Baggili I, Marrington A, Moore J, Breitinger F. Network and device forensic analysis of Android social-messaging applications. Digital Investigation. 2015 Aug; 14, Supplement 1: S77–84.
50. Levinson A, Stackpole B, Johnson D. Third Party Application Forensics on Apple Mobile Devices. In: 2011 44th Hawaii International Conference on System Sciences (HICSS). 2011. p. 1–9.
51. Tso Y-C, Wang S-J, Huang C-T, Wang W-J. iPhone Social Networking for Evidence Investigations Using iTunes Forensics. In: Proceedings of the 6th International Conference on Ubiquitous Information Management and Communication. New York, NY, USA: ACM; 2012. p. 62:1–62:7. Available: http://doi.acm.org/10.1145/2184751.2184827. Accessed 8 December 2015.
52. Chu H-C, Deng D-J, Park JH. Live Data Mining Concerning Social Networking Forensics Based on a Facebook Session Through Aggregation of Social Data. IEEE Journal on Selected Areas in Communications. 2011 Aug; 29(7):1368–76.).
53. Wongyai W, Charoenwatana L. Examining the network traffic of facebook homepage retrieval: An end user perspective. 2012 International Joint Conference on Computer Science and Software Engineering (JCSSE). 2012. pp. 77–81. 10.1109/JCSSE.2012.6261929.
54. Sgaras C, Kechadi M-T, Le-Khac N-A. Forensics Acquisition and Analysis of Instant Messaging and VoIP Applications. In: Garain U, Shafait F, editors. Computational Forensics. Springer International Publishing; 2015. p. 188–99. Available: http://link.springer.com/chapter/10.1007/978-3-319-20125-2_ 16. Accessed 11 October 2015
55. Simon M, Slay J. Recovery of Skype Application Activity Data from Physical Memory. ARES ‘10 International Conference on Availability, Reliability, and Security, 2010. 2010. pp. 283–288. 10.1109/ARES. 2010.73.
56. Teng S-Y, Lin Y-L. Skype Chat Data Forgery Detection. In: Kim T, Ko D, Vasilakos T, Stoica A, Abawajy J, editors. Computer Applications for Communication, Networking, and Digital Contents. Springer Berlin Heidelberg; 2012. pp. 108–114. Available: http://link.springer.com/chapter/10.1007/978-3-642-35594-3_15.
57. Baset SA, Schulzrinne HG. An Analysis of the Skype Peer-to-Peer Internet Telephony Protocol. INFOCOM 2006 25th IEEE International Conference on Computer Communications Proceedings. 2006. pp. 1–11. 10.1109/INFOCOM.2006.312.
58. Azab A, Watters P, Layton R. Characterising Network Traffic for Skype Forensics. Cybercrime and Trustworthy Computing Workshop (CTC), 2012 Third. 2012. pp. 19–27. 10.1109/CTC.2012.14.
59. McKemmish R. What is forensic computing? Canberra: Australian Institute of Criminology;1999 June. Available: http://www.aic.gov.au/media_library/publications/tandi_pdf/tandi118.pdf. Accessed 20 May 2015
60. Company Info. U.S: Facebook. [Date unknown]. Available: https://newsroom.fb.com/company-info/. Accessed 24 May 2015
61. Reisinger D. Windows 8.1 app updates: Facebook, Netfix, and more. U.S: CNET;2013 October 17. Available: http://www.cnet.com/news/windows-8-1-app-updates-facebook-netflix-and-more/. Accessed 4 May 2015
62. About URL Security Zones (Windows). U.S: Microsoft; [Date unknown]. Available: https://msdn.microsoft.com/en-us/library/ms537183.aspx#internet. Accessed 24 May 2015
63. Microsoft to Acquire Skype. U.S: Microsoft; 2011. Available: http://news.microsoft.com/2011/05/10/microsoft-to-acquire-skype/. Accessed 24 May 2015
64. Wurm K. Skype and a New Audio Codec. U.S: Skype; 2012 September 12. Available: http://blogs.skype.com/2012/09/12/skype-and-a-new-audio-codec/. Accessed 24 May 2015
65. Skype Forensics. U.S: InfoSec Institute; [Date unknown]. Available: http://resources.infosecinstitute.com/skype-forensics-2/.Accessed 24 May 2015.
66. Kuhlee L, Völzow V. Computer-Forensik Hacks. O’Reilly Germany; 2012.
67. McQuaid J. Skype Forensics: Analyzing Call and Chat Data From Computers and Mobile U.S: Magnet Forensics; 2012. Available: http://www.magnetforensics.com/wp-content/uploads/2014/04/SkypeForensics-Analyzing-Call-and-Chat-Data-From-Computers-and-Mobile-Magnet-Forensics.pdf. Accessed 12 May 2015.
68. Azfar A, Choo K-KR, Liu L. Android mobile VoIP apps: A survey and examination of their security and privacy. Electronic Commerce Research. 2016. doi: 10.1007/s10660-015-9208-1
69. Azfar A, Choo K-KR, Liu L. An Android Social App Forensics Adversary Model. In Proceedings of Annual Hawaii International Conference on System Sciences (HICSS 2016). 2016. [In press].
70. Azfar A, Choo K-KR, Liu L. An Android Communication App Forensic Taxonomy. Journal of Forensic Sciences. 2016 [In press].
71. Azfar A, Choo K-KR, Liu L. Forensic Taxonomy of Popular Android mHealth Apps. In Proceedings of Americas Conference on Information Systems (AMCIS 2015). 2015. http://aisel.aisnet.org/cgi/viewcontent.cgi?article=1217&context=amcis2015.
72. Do Q, Martini B, Choo K-KR 2015. A Forensically Sound Adversary Model for Mobile Devices. PLOS ONE 10(9): e0138449. doi: 10.1371/journal.pone.0138449 PMID: 26393812
73. Farnden J, Martini B, Choo K-KR. Privacy Risks in Mobile Dating Apps. In Proceedings of Americas Conference on Information Systems (AMCIS 2015). 2015. http://aisel.aisnet.org/cgi/viewcontent.cgi?article=1427&context=amcis2015.
74. Immanuel F, Martini B, Choo K-KR. Android cache taxonomy and forensic process. In Proceedings of IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom 2015). 2015: 1094–1101. 10.1109/Trustcom-BigDataSe-ISPA.2015.488.
75. Leom MD, D'Orazio C, Deegan G, Choo K-KR. Forensic Collection and Analysis of Thumbnails in Android. In Proceedings of IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom 2015). 2015: 1059–1066. 10.1109/Trustcom-BigDataSe-ISPA.2015. 483.
76. Ganji M, Dehghantanha A, Udzir NI, Damshenas M. Cyber warfare trends and future. Advances in Information Sciences and Service Sciences. 2013 Aug; 5(13): 1–10.
77. Mohtasebi S, Dehghantanha A, Broujerdi HG. Smartphone Forensics: A Case Study with Nokia E5-00 Mobile Phone. International Journal of Digital Information and Wireless Communications (IJDIWC). 2011; 1(3): 651–5.