Instagram Forensic Analysis Revisited: Does anything really vanish?

Instagram has become one of the most popular and sought-after social media to be on. People of varying ages from various backgrounds use Instagram and in order to keep things exciting for their users, Instagram frequently rolls out new and exciting updates to their applications. One such feature is the “vanish mode”, that aids people to have secure and private chats. By enabling the vanish mode, people can send messages which would disappear once the vanish mode is disabled. This feature might be of interest to criminals who find ways to clear their activity trace. Disappearing messages might provide people a sense of comfort about the privacy of their chats, but poses a challenge to the investigators to track messages and obtain digital evidence to catch criminals such as child predators, drug dealers, and cyberbullies. This research focuses on analyzing this aspect of the app to identify any artifacts that could be useful in a forensic investigation. The results presented in this paper indicate the presence of vanished messages in the application database. The research also identified inconsistencies in the databases regarding the visibility of the vanished messages. Furthermore, the manner in which user-uploaded media is stored in the database was investigated, and the findings on user searches on the explore page and the shopping tab are presented. The research work adds to the existing knowledge of work done in the digital forensics field by detecting the presence of disappearing messages to aid investigations where Instagram is being analyzed.