iOS Digital Evidence Comparison of Instant Messaging Apps

The presence of IM (Instant Messaging) applications can have a negative impact, one of which is cybercrime. Its development is also accompanied by the development of operating systems on mobile devices used, one of which is iOS. The research conducted not only analyzed digital evidence but also compared the findings of digital evidence in WhatsApp, Telegram, and Messenger IM applications based on iOS version 13.3 on two conditions (jailed and jailbreak). The NIST 800-101 Revision 1 method is used as a guide in conducting the forensic process. Data acquisition was carried out using the Cellebrite UFED 4PC tool, data examination and data analysis were carried out using Oxygen Forensic Detective, FTK Imager and Autopsy. The results of the analysis obtained are then compared to the condition of the iPhone and the scenarios that have been executed. The results of this study indicate that the condition of the iPhone that has been jailbroken greatly affects the findings of digital evidence. WhatsApp digital evidence found on jailed iPhone devices has the same amount as the jailbroken iPhone condition with a digital evidence finding value of 71.42%. Telegram obtains more digital evidence with a digital evidence finding value of 71.42% on a jailbroken iPhone. The Messenger application shows its significance to the digital found in a jailbroken iPhone which has a percentage value of 85.71% digital discovery which is the largest value between WhatsApp and Telegram.