However, the application could be blocked, preventing access and making recently viewed data inaccessible. To overcome this, the running IM application can be used to obtain evidence, as the encrypted data must be decrypted when the application needs to use it. Therefore, digital storage forensics fails to provide evidence.

Likewise, IM application communications are typically established using end-to-end encryption, which also ensures data confidentiality against network attacks. Some of these artifacts are securely stored in a database using encryption, which protects the confidentiality of data against attackers who have physical access to the devices. The digital artifacts of interest in IM applications are, among others, the sent/received messages or the contacts.

Therefore, the forensic analysis of IM applications can help provide essential clues to solve or clarify a possible crime. Unfortunately, the misuse of IM apps allow cybercriminals to utilize them for malicious purposes (such as harassment, extortion, or fraud, to name a few). Today, a large part of society makes use of these applications to have text, audio, or even video conversations on a daily basis. Instant messaging (IM) applications allow us to communicate quickly and easily. This post is a brief summary of our recently accepted paper in DFRWS EU 2022, “Extraction and analysis of retrievable memory artifacts from Windows Telegram Desktop application”.

As a case study, in this work we focus on the Telegram application for Windows systems called Telegram Desktop. Its source codes are released under the GNU/GPLv3 license and can be accessed at here and here, respectively. Both tools work together, but can be used independently. TL DR: Following a three-phase forensic analysis methodology, we have developed a forensic analysis environment for instant messaging applications made up of two tools: one of them is responsible for extracting the content of a process that runs on a Windows system, while the another focuses on studying the information present in the process memory of an instant messaging application.

Telegram windows