IMO forensics in Android and windows systems

Smartphone forensics is currently gaining more attention because of their widespread in the market. Smart devices are provisioned with wide range of applications that extend their capabilities and features. IMO Instant Messaging (IM) application is a mobile application that allows making audio and video calls, chat messages, share photos and videos, and group chatting. The increased usage of IM applications on Android phones has turned to be a source for mobile and computer forensic investigators. This paper aims to investigate the IMO App in Android and Windows systems from forensics perspective. We perform real chats and calls in different scenarios. We extract the artifacts from the NAND flash memory in Android and from the main memory (RAM) in Windows platform. Our results show that important data can still be recovered even after deleting chats and uninstalling the app.