Forensics Investigation on Social Media Apps and Web Apps Messaging in Android Smartphone

The widespread usage of smartphones in many domains such as education, finance, organizations, and gaming makes hackers covet them and raises the challenge of facing cybercrime and forensic investigation of these devices. The devices run apps that can be sophisticatedly linked to other devices or platforms, or Web Apps, which duplicate the forensic investigation problem. Each social media application has its feature to deal with various types of messages and has its method of receiving and storing the messages depending on their type, i.e., text, video, contact file, image, and record. This study works on two scenarios to track the recovered data by logical acquisition method in MOBILedit and FINALmobile forensic tools. The first scenario is social media massaging between two smartphone Apps, and the second one is between Web Apps and smartphone Apps. In the two scenarios, the acquired device is the receiver’s smartphone. This study finds that logical acquisition cannot recover any Facebook or Instagram data, but in WhatsApp and Telegram, logical acquisition can extract and analyze all data except text and contact files, without knowing which linked device or Web App sent the message. There is a need for more investigation on social media Apps and Web Apps in future works.