Introducing third-party messaging apps
Third-party messaging applications allow users to keep in touch with their contacts, and share photos, videos, and audio messages. Many of these apps also allow users to send likes, emojis, animations, and any kind of attachment.
Most forensic tools do an excellent job at analyzing and parsing through these apps; however, the examiner should have a basic understanding of how these applications work, how they store their data, where they store it, and how to extract it. In this section, we'll focus on three of the most popular messaging apps: WhatsApp, Telegram, and Signal:
- With over 2 billion worldwide users, WhatsApp is definitely one of the most popular IM apps. From a forensic perspective, the app stores its data on the device, in unencrypted form. Chats and messages are not stored on WhatsApp's servers; however, if this feature is enabled, an encrypted backup can be stored on iCloud. Artifacts related to WhatsApp can be...