Investigating America Online Instant Messaging Application: Data Remnants on Windows 8.1 Client Machine

Abstract

Instant messaging applications (apps) are one potential source of evidence in a criminal investigation or a civil litigation. To ensure the most effective collection of evidence, it is vital for forensic practitioners to possess up-to-date knowledge about artifacts of forensic interest from various instant messaging apps. Hence, in this chapter we study America Online Instant Messenger (version 7.14.5.8) with the aims of contributing to an in-depth understanding of the types of terrestrial artifacts that are likely to remain after the use of instant messaging services and apps on Windows 8.1 devices. Potential artifacts identified during the research include data relating to the installation or uninstallation, log-in and log-off information, contact lists, conversations, and transferred files.