A Post-Mortem Forensic Approach for the Kik Messenger on Android

Mobile devices have become an essential part of our life. These devices are a platform for social media and chat apps that are often designed to assist us retain our connection with old and new online friends. However, regardless of their valuable social influence, these apps are a medium in which criminals and perpetrators can exploit to attack innocent people. Nevertheless, these apps can provide a wealth of digital artifacts for law enforcement agencies. Often, well-established digital forensic techniques are used to determine criminal cases in the court of law. Therefore, this paper presents a post-mortem memory forensics and digital investigations for the popular instant messaging application named Kik Messenger. Kik is designed to assist users to connect quickly and easily with the world around them. Statistics such as the number of installations and active users underlines its importance. Moreover, the Android operating system and its internal memory, including RAM and NAND flash memory are examined. This paper presents our investigation methodology that employs memory dumps for both NAND flash memory as well as the heap memory. Our results of forensic analysis show promising existences for the sent and received messages and contacts in both types of memory dumps; these incidences are valuable to the digital investigator. Various scenarios are studied, experimentation results show that sent and received messages and contact artifacts can be found in both memories even after the chat session is deleted, messages are individually deleted, contacts are deleted, app is closed, and even after the phone is locked.