Android Device Incident Response: Viber Analysis

In Mobile Forensics, one of the most crucial question is: Under which conditions, especially in an Incident Response Scenario, is it possible to preserve and retrieve deleted messages and media attachments from Instant Messaging Applications, such as Viber? In this Paper well known practices are thoroughly tested through experimental course, involving the exchange of a large number of messages among different user accounts and analyzing the SQLite databases in which they are stored.