An Evidence-Based Forensic Taxonomy of Windows Phone Communication Apps

Niken Dwi Wahyu Cahyani; Ben Martini; Kim-Kwang Raymond Choo; Nurul Hidayah Ab Rahman; Helen Ashman

doi:10.1111/1556-4029.13624

An Evidence-Based Forensic Taxonomy of Windows Phone Communication Apps

J Forensic Sci. 2018 May;63(3):868-881. doi: 10.1111/1556-4029.13624. Epub 2017 Aug 17.

Authors

Niken Dwi Wahyu Cahyani^{1

2}, Ben Martini¹, Kim-Kwang Raymond Choo^{1

3}, Nurul Hidayah Ab Rahman^{1

4}, Helen Ashman¹

Affiliations

¹ School of Information Technology & Mathematical Sciences, University of South Australia, Adelaide, SA, 5095, Australia.
² Department of Informatics, Telkom University, Bandung, Indonesia.
³ Department of Information Systems and Cyber Security, The University of Texas at San Antonio, San Antonio, TX, 78249-0631, USA.
⁴ Information Security interest group (ISIG), Faculty of Computer Science and Information Technology, Universiti Tun Hussein Onn Malaysia, Batu Pahat, Johor, Malaysia.

PMID: 28833117
DOI: 10.1111/1556-4029.13624

Abstract

Communication apps can be an important source of evidence in a forensic investigation (e.g., in the investigation of a drug trafficking or terrorism case where the communications apps were used by the accused persons during the transactions or planning activities). This study presents the first evidence-based forensic taxonomy of Windows Phone communication apps, using an existing two-dimensional Android forensic taxonomy as a baseline. Specifically, 30 Windows Phone communication apps, including Instant Messaging (IM) and Voice over IP (VoIP) apps, are examined. Artifacts extracted using physical acquisition are analyzed, and seven digital evidence objects of forensic interest are identified, namely: Call Log, Chats, Contacts, Locations, Installed Applications, SMSs and User Accounts. Findings from this study would help to facilitate timely and effective forensic investigations involving Windows Phone communication apps.

Keywords: Windows Phone platform; communication apps; digital evidence; digital forensics; forensic science; forensic taxonomy; mobile forensics.