Content area
Full text
Abstract: Nowadays most smartphone users benefit from instant messaging applications, such as WhatsApp, Viber, Facebook Messenger, Snapchat or Telegram. The majority of them allow not only sending messages, but also sharing photos, videos, audio, making calls and video-calls. Analysing what digital artefacts these messaging applications leave behind is becoming a popular research topic for forensic specialists. The research in this paper looks into retrieving information from the social instant messaging application Telegram on a smartphone Sony-Ericsson LT26i running Android OS 4.1.2. The tools used are the XRY Physical analyser and the XRY Reader. The action performed for detecting any data and information that can be found on smartphones memory for Application "Telegram" e.g. messages, history, logs as well as comparing it to artefacts found from two most popular instant messaging applications Viber and WhatsApp. Extensive analysis has been performed using a physical acquisition type of extraction on an Android smartphone in order to find artefacts left by instant messaging application Telegram. It was found that artefacts left by Telegram can be easily found and decoded by XRY Extraction Wizard. Messages sent via Telegram were found in the chat section of the XRY reader. It was also important to conclude where those artifacts are located in the file system. It was found that Android uses SQLite databases which are used by Telegram to store messages. The database was found using the XACT image viewer and the relevant artifacts were retrieved.
Keywords: android, forensic analysis, digital artifacts, data retrieval, telegram
1. Introduction
The Telegram application is a tool for instant messaging mainly introduced to provide a higher of security compared to other popular Instant Messaging (IM) applications available. Telegram, similarly to SnapChat, has a capability of self-destructing messages and uses the Diffie-Hellman protocol for key generation.
It is important to consider how Telegram's features are applied by users in order to discover every available data artefact. This means that it is needed to complete a full investigation using both messaging types - normal chats and secret chats. This research must be performed while adhering to the ACPO Principles. ACPO is not only used as a guideline, but also as a standard approach in computer forensics (Williams, 2012). A simple and standardised method to retrieve data is...