Author:
Alberto Magno Muniz Soares
Affiliation:
Criminalistics Institute of the Civil Police, Federal District, Brasília, Brazil
Keyword(s):
WhatsApp, Live Forensics, Web Browser, Data Extraction.
Abstract:
At crime scenes or when participating in arrest warrants, forensic experts may come across situations where there is a WhatsApp Web service session available on an on-site computer, which can be a very important source of data for an investigation. Some justice systems may consider video recordings or printing of conversations screens from a computer illicit or questionable evidence. This article analyses WhatsApp Web in browsers, presents a live acquisition technique that allows automated extraction of messages, attachments, contacts, and account data, even if in a disconnected computer, from WhatsApp Web sessions opened in web browsers. The technique extracts, in line with forensics procedures, digital data that can be loaded in forensic tools for analysis.