A Digital Forensic Analysis of WhatsApp Artifacts in Windows 11 Operating System Using Microsoft Edge

Digital forensics has made significant advancements in addressing the challenges posed by cybercriminals, particularly with the increasing use of instant messaging (IM) platforms as digital evidence sources. As one of the most popular IM platforms globally, WhatsApp has proven to be a valuable tool for effective communication and file transfer, particularly through its web and desktop application features. This study explores forensic artifacts with a focus on identifying various forms of evidence, including text files, images, audio files, and videos. The investigation analyzes these artifacts on a Windows 11 operating system, where the victim accessed them through the WhatsApp Web client using the Microsoft Edge browser. The evidence being examined was sent to the victim's WhatsApp account on a mobile device. However, instead of opening the evidence on the phone, the victim used the WhatsApp Web client in the Microsoft Edge browser to view and interact with the attacker. A detailed experimental design was employed, incorporating virtual environments to analyze how data is synchronized between devices and the host machine. In this research, three forensic tools-FTK Imager, Autopsy, and OS Forensics-were utilized to locate, examine, and retrieve artifacts, including cache, IndexedDB, and log files. The findings reveal that while traces of media synchronization and certain activity logs were discovered, critical data such as text messages, deleted messages, and media files were often not automatically saved on the computer.