Forensic analysis of instagram and path on an iPhone 5s mobile device

Social networking applications are a treasure trove for forensic examiners. The amount of potential evidence that they hold could sway the course of any investigation. However, the large number of mobile operating systems, their continuous updates, and the constant emergence of new social networking applications in the market, create challenges for forensic practitioners today. This paper hopes to alleviate some of those challenges by conducting a forensic analysis on two popular social networking applications; Instagram and Path on an iPhone 5s mobile device. The analysis process consisted of installing both applications on the device, performing common user activities via these applications, obtaining a forensically sound logical image of the device, and finally conducting manual- and automatic (for result verification)-forensic analysis on the acquired image. The ultimate goal of the analysis was to determine whether the activities conducted through these applications are stored on the mobile device's internal memory or not. The test results show that a portion of the activities is indeed stored in the internal memory. Therefore, the significance, extent, and locations of the stored information were all determined and documented in this paper.