Abstract
This study investigates the forensic analysis of WhatsApp’s Msgstore.db.crypt14 file, focusing on rooted and non-rooted devices, which pose unique challenges in data extraction and decryption. This research leverages forensic tools such as WhatsApp-Key-Database Extractor, Binwalk, and Mobile Edit to demonstrate a systematic approach for retrieving and analyzing encrypted data, uncovering hidden content, and extracting valuable metadata. The findings highlight the consistency of WhatsApp’s encryption mechanisms across rooted and non-rooted devices, emphasizing the importance of using multiple forensic tools for comprehensive analysis. Key contributions include insights into WhatsApp’s metadata, encryption keys, and the implications of phone number or device changes on data security. This study advances the field of digital forensics by offering practical methodologies for analyzing encrypted mobile messaging data, providing a foundation for future research into improving forensic tools and addressing privacy and ethical considerations.
References
J. M. Katy Jordan, RAPID EVIDENCE REVIEW: Messaging apps, SMS & social media. GlobalEdTechHub, 2020.
C. M. Tang and A. Bradshaw, “Instant messaging or face-to-face? How choice of communication medium affects team collaboration environments,” E-Learning and Digital Media, vol. 17, no. 2, 2020. https://doi.org/10.1177/2042753019899724doi:10.1177/2042753019899724.
Statista, “Most popular global mobile messenger apps as of April 2024, based on number of monthly active users,” Statista, 2024. Available at: https://www.statista.com/statistics/258749/most-popular-global-mobile-messenger-apps/https://www.statista.com/statistics/258749/most-popular-global-mobile-messenger-apps/. Accessed: November 9, 2024.
C. L. Wang, “New frontiers and future directions in interactive marketing: Inaugural Editorial,” Journal of Research in Interactive Marketing, vol. 15, no. 1, 2021. https://doi.org/10.1108/JRIM-03-2021-270doi:10.1108/JRIM-03-2021-270.
A. Seufert, F. Poignée, T. Hoßfeld, and M. Seufert, “Pandemic in the digital age: analyzing WhatsApp communication behavior before, during, and after the COVID-19 lockdown,” Humanities and Social Sciences Communications, vol. 9, no. 1, 2022. https://doi.org/10.1057/s41599-022-01161-0doi:10.1057/s41599-022-01161-0.
B. Suárez-Lantarón, Y. Deocano-Ruíz, N. García-Perales, and I. S. Castillo-Reche, “The Educational Use of WhatsApp,” Sustainability, 2022. https://doi.org/10.3390/su141710510doi:10.3390/su141710510.
B. Hagedoorn, E. Costa, and M. Esteve-del-Valle, “Photographs, Visual Memes, and Viral Videos: Visual Phatic News Sharing on WhatsApp during the COVID-19 Pandemic in Spain, Italy, and The Netherlands,” Digital Journalism, 2023. https://doi.org/10.1080/21670811.2023.2250395doi:10.1080/21670811.2023.2250395.
H. Verma, J. Mlynář, C. Pellaton, M. Theler, A. Widmer, and F. Evéquoz, “WhatsApp in Politics?!: Collaborative Tools Shifting Boundaries,” in Lecture Notes in Computer Science, 2021. https://doi.org/10.1007/978-3-030-85623-6_37doi:10.1007/978-3-030-85623-6_37.
I. Mashiah, “The relationship between public-relations and journalists in WhatsApp technology,” Public Relations Review, vol. 47, no. 5, 2021. https://doi.org/10.1016/j.pubrev.2021.102117doi:10.1016/j.pubrev.2021.102117.
I. F. Rahmadi, “WhatsApp group for teaching and learning in Indonesian higher education what’s up?,” International Journal of Interactive Mobile Technologies, vol. 14, no. 13, 2020. https://doi.org/10.3991/ijim.v14i13.14121doi:10.3991/ijim.v14i13.14121.
D. Sudiana, C. H. Nuruddin, M. Rizkinia, and D. Husna, “Forensic Analysis of WhatsApp Disappearing Message on Unrooted Android Using Mobile Device Forensics Methodology NIST SP 800-101r1,” Evergreen, vol. 11, no. 1, pp. 516–524, 2024. https://doi.org/10.5109/7172316doi:10.5109/7172316.
F. Yudha, A. Luthfi, and Y. Prayudi, “A proposed model for investigating on web WhatsApp application,” Advanced Science Letters, vol. 23, no. 5, 2017. https://doi.org/10.1166/asl.2017.8308doi:10.1166/asl.2017.8308.
D. Wijnberg and N. A. Le-Khac, “Identifying interception possibilities for WhatsApp communication,” Forensic Science International: Digital Investigation, vol. 38, 2021. https://doi.org/10.1016/j.fsidi.2021.301132doi:10.1016/j.fsidi.2021.301132.
F. Yudha, E. Ramadhani, D. Sudyana, and W. N. Hamzah, “A custom recovery approach for physical forensic imaging of android device,” in AIP Conference Proceedings, 2023. https://doi.org/10.1063/5.0114894doi:10.1063/5.0114894.
R. Umar, I. Riadi, and G. Maulana, “A Comparative Study of Forensic Tools for WhatsApp Analysis using NIST Measurements,” International Journal of Advanced Computer Science and Applications, vol. 8, no. 12, 2017. https://doi.org/10.14569/ijacsa.2017.081210doi:10.14569/ijacsa.2017.081210.
C. Morris, R. E. Scott, and M. Mars, “WhatsApp in clinical practice—The challenges of record keeping and storage. A scoping review,” International Journal of Environmental Research and Public Health, 2021. https://doi.org/10.3390/ijerph182413426doi:10.3390/ijerph182413426.
R. Cents and N. A. Le-Khac, “Towards a new approach to identify WhatsApp messages,” in Proceedings of the 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom 2020), 2020. https://doi.org/10.1109/TrustCom50675.2020.00259doi:10.1109/TrustCom50675. 2020.00259.
M. Iqbal and I. Riadi, “Forensic WhatsApp based Android using National Institute of Standard Technology (NIST) Method,” International Journal of Computer Applications, vol. 177, no. 8, 2019. https://doi.org/10.5120/ijca2019919443doi:10.5120/ijca2019919443.
T. Almehmadi and O. Batarfi, “Impact of android phone rooting on user data integrity in mobile forensics,” International Journal of Advanced Computer Science and Applications, vol. 9, no. 12, 2018. https://doi.org/10.14569/IJACSA.2018.091279doi:10.14569/IJACSA.2018.091279.
M. Hassan and L. Pantaleon, “An investigation into the impact of rooting android device on user data integrity,” in Proceedings of the 2017 7th International Conference on Emerging Security Technologies (EST 2017), 2017. https://doi.org/10.1109/EST.2017.8090395doi:10.1109/EST.2017.8090395.
M. Moreb, “Mobile Forensic Investigation for WhatsApp,” in Practical Forensic Analysis of Artifacts on iOS and Android Devices, 2022. https://doi.org/10.1007/978-1-4842-8026-3_9doi:10.1007/978-1-4842-8026-3_9.
R. Khweiled, M. Jazzar, A. Eleyan, and T. Bejaoui, “Using SQLite Structure Analysis To Retrieve Unsent Messages On WhatsApp Messaging Application,” in 2022 International Conference on Smart Applications, Communications and Networking (SmartNets 2022), 2022. https://doi.org/10.1109/SmartNets55823.2022.9993988doi:10.1109/SmartNets55823.2022.9993988.
M. Mirza, F. E. Salamh, and U. Karabiyik, “An Android Case Study on Technical Anti-Forensic Challenges of WhatsApp Application,” in 8th International Symposium on Digital Forensics and Security (ISDFS 2020), 2020. https://doi.org/10.1109/ISDFS49300.2020.9116192doi:10.1109/ISDFS49300.2020.9116192.
K. Alissa et al., “A comparative study of WhatsApp forensics tools,” SN Applied Sciences, vol. 1, no. 11, 2019. https://doi.org/10.1007/s42452-019-1312-8doi:10.1007/s42452-019-1312-8.
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
Copyright (c) 2025 Journal of Cyber Security and Mobility