Digital Forensic Investigation of Web-Based Virtual Reality Worlds: Decentraland as a Case Study

The last decade witnessed increased usage of web browsers to access virtual reality (VR) worlds such as Decentraland, Somnium Space and Cryptovoxels. As these VR worlds become more popular, it is no surprise for them to be used as avenues for adverse and criminal purposes, where unknowing users could be targets for malicious activities. To the best of our knowledge, there is no literature providing insight into the kinds of artefacts that could be left behind on users' systems after the use of such web-based VR worlds. To close this gap, we provide foundations for digital forensic investigations on web-based VR worlds using Decentraland as a case study. We performed experiments on Google Chrome and Microsoft Edge web browsers. Findings revealed that details of the real-world user as well as their avatar activities within the VR world could be recovered from the web browser data files on disk, in memory, and in network traffic which could be used to reconstruct the chain of activities.