Framework for the Retrieval of Social Media and Instant Messaging Evidence from Volatile Memory

The human society today has had to be confronted by the threat posed by criminals who are taking the advantages of social media and instant-messaging apps to conduct their criminal activities. In literature, there are many approaches for forensic acquisition and analysis of these apps. However, most of the approaches mainly focus on non-volatile storage media. Meanwhile, social media and instant-messaging platforms do not usually store information relating to social transactions in non-volatile bases. Hence, in this paper, we propose a framework for volatile memory forensics that is essential for the ready retrieval of evidence. Our approach is based on the retrieval of social media and instant-messaging evidence through the use of string search mechanism extended by the usage of regular expressions and the functionality of match groups. Our approach has been tested and proved to be effective with different social media apps on two popular operating systems: Windows and Mac.