Forensic analysis of open-source XMPP/Jabber multi-client instant messaging apps on Android smartphones - SN Applied Sciences
link.springer.com
In the quest for a panacea to ensure digital privacy, many users have switched to using decentralized open-source Extensible Messaging and Presence Protocol multi-client instant messaging (IM) apps for secure end-to-end communication. In this paper, we present a forensic analysis of the artefacts generated on Android smartphones by Conversations and Xabber apps. We identified databases maintained by each app and external Secure Digital card directories that store local copies of user metadata. We analysed each app’s storage locations for forensic artefacts and how they can be used in a forensic investigation. The results in this paper show a detailed analysis of forensic files of interest which can be correlated to identify the local user’s multiple IM accounts and contact list, contents of messages exchanged with contacts, deleted files, time, and dates in the order of their occurrence. The contributions of this research include a comprehensive description of artefacts, which are of forensic interest, for each app analysed.
  • poVoq@lemmy.ml
    3·
    3 years ago

    This is an forensic analysis, meaning this is research into what police etc. needs to do when they want to ex-filtrate data from confiscated or otherwise compromised devices.

    I am a bit torn on such kind of research. Obviously it isn’t done to improve security, but at least when it is openly published like this it can help app developers to look into potential security issues.

    At the very least it helps to make people aware that these days a compromised device is often the most dangerous data-leak (at least for activists) and Signal for example does not help against that type of tread at all, in fact due to it’s use of phone numbers as identifiers it is a huge risk factor.