e-space
Manchester Metropolitan University's Research Repository

    Forensic analysis of ephemeral messaging applications: disappearing messages or evidential data?

    Heath, Howard, MacDermott, Áine and Akinbi, Alex (2023) Forensic analysis of ephemeral messaging applications: disappearing messages or evidential data? Forensic Science International: Digital Investigation, 46. p. 301585. ISSN 2666-2817

    [img]
    Preview
    Published Version
    Available under License Creative Commons Attribution Non-commercial No Derivatives.

    Download (4MB) | Preview

    Abstract

    Ephemeral messaging or ‘disappearing messages’ is the mobile-to-mobile transmission of multimedia messages that automatically disappear from the recipient's screen after the message has been viewed. This new feature can be enabled by users for more privacy when using instant messaging apps. A user can set messages to disappear within a certain timeframe: 24 hours, 7 days, or 90 days, after the time they are sent. While disappearing messages provide additional privacy to users, its anti-forensics capability creates challenges for investigators in the recovery of evidential artefacts that could be crucial to an investigation. In this paper, we conduct a comprehensive forensic analysis of ‘disappearing messages’ across different digital platforms (mobile, desktop, and cloud) and instant messaging apps (WhatsApp, Snapchat, and Telegram) to determine whether they can be recovered within a limited timeframe. The results from this study provide valuable information to investigators dealing with instant messaging apps that have this feature enabled and provides detailed understanding of how disappearing messages are stored, managed, and deleted compared to messages sent without this feature enabled.

    Impact and Reach

    Statistics

    Activity Overview
    6 month trend
    207Downloads
    6 month trend
    69Hits

    Additional statistics for this dataset are available via IRStats2.

    Altmetric

    Repository staff only

    Edit record Edit record