|
AUTHOR(S): Ekbal Rashid, Nikos E. Mastorakis
|
TITLE Elimination and Analysis of Ephemeral Messages in Android Social Media Apps: A Forensic Perspective |
 PDF |
ABSTRACT As ephemeral messaging grows on the Android ecosystem involving different social platforms like Snap chat, WhatsApp, and Instagram, there is a growing need for effective forensic techniques. Most times, the messages are encrypted and automatically deleted, yet within legal settings, these messages can contain valuable evidence. This paper, from the technical and legal perspective, gives an overview of forensic extraction methods of ephemeral messages for Android devices, with specific consideration to the constraints from the application of encryption, deletion policy, and memory scrubbing. Due to Android's ever-changing security settings and app-by-app privacy rules, message retrieval has become increasingly complex. Forensic investigators are challenged by the decentralized nature of the Android ecosystem, in which data resides at multiple locations, e.g., internal storage and backup databases. Our proposed framework overcomes the aforementioned limitations through root access, live memory acquisition, and network traffic analysis, enabling the content of the messages to be extracted while maintaining the integrity of the evidence and its admissibility in court. A case study is presented in the paper that applies the framework to a reasonably controlled experiment with a typical Android app, pointing to the real difficulties in data extraction. As privacy laws change, forensic practices will need to change too to accommodate both privacy requirements and forensic needs. This framework is a basis for developing forensic techniques to efficiently capture ephemeral data in digital investigations. |
KEYWORDS Ephemeral Messaging, Digital Forensics, Android Social Media, Data Extraction, Encryption, Memory Acquisition |
|
Cite this paper Ekbal Rashid, Nikos E. Mastorakis. (2025) Elimination and Analysis of Ephemeral Messages in Android Social Media Apps: A Forensic Perspective. International Journal of Computers, 10, 94-102 |
|
