Comparative Study and Analysis of Forensic Artifacts of WhatsApp and Telegram on Android Devices

Abstract

Numerous instant messaging are available for mobile devices as a cheaper alternative over operator-based text messaging via SMS. Furthermore, instant messaging allow the user to exchange textual messages, images, audio, and videos. However, the ease offered by instant messaging also had a negative impact including making instant messaging as a criminal land. This paper focuses on conducting forensic data analysis of two popular instant messaging applications on Android smartphones; WhatsApp and Telegram. In this analysis, we use open-source tools and software applied on non-rooted Android devices. By using the result, an analyst will be able to read, and reconstruct the chronology of the messages and the list of contact and also know the difference in data structures obtained from these two instant messaging applications.