![]() Encrypting data is a powerful means of preventing data leakage, but it acts as an anti-forensic techniques in digital investigations. This personal information is often encrypted, in order to protect users' privacy. IMs store a variety of types of evidence, as they collect a wide range of personal information from users. ![]() In addition, We validated our approach by conducting an experiment to decrypt the encrypted databases of Telegram X and BBM-Enterprise. In order to decrypt these databases, we identified the parameters of SQLCipher, and derived a Passphrase, the main secret. ![]() Both applications encrypt their databases using an SQLite extension module called SQLCipher. In this paper, we propose methods for acquiring user data, including conversation history protected by encryption by analyzing the Telegram X and BBM-Enterprise apps that perform in various mobile and PC operating environments. It is therefore necessary to identify the relationships between the functions used for encryption, in order to decrypt IM data, so that it can be used as evidence, and to determine the secret values used for generating keys. Such IMs normally use a combination of key derivation functions and cryptographic algorithms to encrypt data. ![]() The use of encryption can effectively protect the user's data, but poses a significant challenge to digital forensics, in which data should be decrypted to be used as evidence. However, some IMs encrypt their data for protection against external threats. This allows for complementary interaction when extracting data generated by the use of IMs. Most messengers are cross-platform, supporting both mobile devices and PCs, and providing synchronization services, a situation which can overcome the constraints of data extraction for evidence acquisition. PC messenger data, on the other hand, can be collected relatively easily, but tend to be less informative than data from mobile messengers. Messenger apps on mobile devices store user-friendly data, but data collection can be difficult due to various constraints. Instant messenger (IM) apps, which store a variety of behavioral information about users, such as secret chats, group chats, and file sharing, are important tools for digital forensics investigation.
0 Comments
Leave a Reply. |