FORENSIC ANALYSIS OF WHATSAPP ARTIFACTS ON ANDROID DEVICES

This project successfully created and validated a Digital Forensic Analysis System for WhatsApp artifacts on non-rooted Android devices. The NexForensics platform offers forensic investigators a complete investigation workflow, starting from initial case creation to evidence acquisition, decryption, analysis, and report generation, all within an easy-to-use web interface.  The system fills a significant gap in digital forensic tools by providing features previously found only in expensive commercial options. Key achievements include the successful implementation of automated ADB-based extraction, support for major WhatsApp encryption formats (crypt5 through crypt15), structured message extraction from decrypted databases, bulk EXIF metadata analysis with GPS coordinate recovery, and the generation of legally structured forensic reports with full chain-of-custody documentation.    Testing on real Android devices confirmed the system reliably extracts WhatsApp evidence while maintaining forensic integrity through SHA-256 hashing, read-only file handling, and thorough audit logging. The non-root acquisition method retrieves significant amounts of WhatsApp evidence while keeping device integrity and evidence admissibility intact.  This project shows that modern Python web frameworks, combined with established forensic methods, can create production-quality digital forensic tools accessible to investigators without special programming skills. The modular service design allows for updates to individual components as WhatsApp changes its data storage format without needing a complete system redesign.  The chain-of-custody documentation system creates a legally defensible audit trail of all examiner actions, which is crucial for evidence admissibility. The use of cryptographic hashing at every stage of the evidence lifecycle ensures any tampering with evidence files is quickly detectable. 

1.      Android Developers. (2024). ADB (Android Debug Bridge) documentation. Google. https://developer.android.com/studio/command-line/adb 2.      Flask Documentation. (2024). Flask: The Pallets Projects. https://flask.palletsprojects.com/ 3.      Geus, J., Ottmann, J., & Freiling, F. (2024). Systematic evaluation of forensic data acquisition using smartphone local backup. arXiv. https://arxiv.org/abs/2404.12808 4.      Kang, S., Kim, G., Hur, U., & Kim, J. (2024). Forensic analysis of wxSQLite3-encrypted databases and its application. Electronics, 13(7), 1325. https://doi.org/10.3390/electronics13071325 5.      Pirzada, S., Ab Rahman, N. H., Cahyani, N. D. W., & Othman, M. F. (2024). A framework of forensic analysis and visualization: Using WhatsApp chat data as a case study. International Journal on Informatics Visualization, 8(3). http://dx.doi.org/10.62527/joiv.8.3-2.2868 6.      PyCryptodome Documentation. (2024). PyCryptodome: A self-contained Python package of low-level cryptographic primitives. https://pycryptodome.readthedocs.io/ 7.      ReportLab. (2024). ReportLab PDF library user guide. https://www.reportlab.com/docs/reportlab-userguide.pdf 8.      Soni, N. (2024). Forensic analysis of WhatsApp: A review of techniques, challenges, and future directions. Journal of Forensic Science and Research, 8(1), 19–24. https://doi.org/10.29328/journal.jfsr.1001059 9.      University of the Bundeswehr Munich. (2024). Data synthesis is going mobile: On community-driven dataset generation for Android devices. International Conference on IT Security Incident Management & IT Forensics (IMF 2024). 10.   Alharbi, M., Alotaibi, R., & Alqahtani, S. (2024). Digital forensic acquisition techniques for Android smartphones: Challenges and opportunities. Journal of Digital Forensics, Security and Law, 19(2), 45–61.