ARTICLE IN PRESS JID: COSE [mNS; October 24, 2018;11:47 ] computers & security xxx (xxxx) xxx Available online at www.sciencedirect.com j o u r n a l h o m e p a g e : w w w . e l s e v i e r . c o m / l o c a t e / c o s e Forensic analysis of communication records of messaging applications from physical memory ∗ Diogo Barradas , Tiago Brito, David Duarte, Nuno Santos, Luís Rodrigues INESC-ID, Instituto Superior Técnico, Universidade de Lisboa, Portugal a r t i c l e i n f o a b s t r a c t Article history: Inspection of physical memory allows digital investigators to retrieve evidence otherwise Received 2 May 2018 inaccessible when analyzing other storage media. In this paper, we analyze in-memory com- Accepted 23 August 2018 munication records produced by instant messaging and email applications, both in desktop Available online xxx web-based applications and native applications running in mobile devices. Our results show that, in spite of the heterogeneity of data formats specific to each application, communica- Keywords: tion records can be represented in a common application-independent format. This format Digital forensics can then be used as a common representation to allow for general analysis of digital ar- Instant-messaging tifacts across various applications. Then, we introduce RAMAS, an extensible forensic tool Memory forensics which aims to ease the process of analysing communication records left behind in physical Mobile applications memory by instant-messaging and email clients. Web-applications © 2018 Elsevier Ltd. All rights reserved. communication records exchanged in web-applications are 1. Introduction not stored in desktops’ persistent storage. This fact compli- cates the task of forensic analysts in acquiring digital ev- Instant-messaging (IM) and email applications such as Face- idence. In contrast, while native applications (e.g. in mo- book’s chat and Gmail clients, respectively, are widely used bile devices) may leverage persistent storage, such appli- communication services that allow individuals to exchange cations’ persistent state can be tampered with or inten- messages over the Internet. Given the nature of the exchanged tionally deleted. By focusing on physical memory analy- data, digital artifacts left by such applications may hold highly sis, our goal is to complement the functionality of exist- relevant forensic value. This is particularly true if, from such ing forensic tools which focus on the analysis of persistent artifacts, it is possible to recover communication records of state, e.g., local logs ( Al Mutawa et al., 2011; Yang et al., past conversations providing information about the content 2016 ) or databases ( Anglano, 2014; Anglano et al., 2017 ), of exchanged messages, identity of communicating parties, or and to address a latent need for the analysis of high-level time-related information. data found lingering in memory dumps ( Simon and Slay, To assist analysts in recovering such artifacts, we aim 2009 ). to develop a forensic tool for the extraction of conversa- Although prior work has employed memory forensic tech- tion records left by messaging applications in physical mem- niques on web-messaging applications, existing tools tend to ory dumps . Web-based messaging applications run inside a be highly application-dependent. For example, Wong et al. browser and are becoming increasingly popular since users do present techniques that allow for the recovery of digital ar- not need to install them on their computers. Unfortunately, tifacts for the Facebook messaging service ( Wong et al., 2011 ). However, the proposed techniques cannot directly be applied ∗ Corresponding author. E-mail addresses: [email protected] (D. Barradas), [email protected] (T. Brito), [email protected] (D. Duarte), [email protected] (N. Santos), [email protected] (L. Rodrigues). https://doi.org/10.1016/j.cose.2018.08.013 0167-4048/© 2018 Elsevier Ltd. All rights reserved. Please cite this article as: Diogo Barradas et al., Forensic analysis of communication records of messaging applications from physical memory, Computers & Security (2018), https://doi.org/10.1016/j.cose.2018.08.013 ARTICLE IN PRESS JID: COSE [mNS; October 24, 2018;11:47 ] 2 computers & security xxx (xxxx) xxx to multiple other applications due to the heterogeneity of evidence from several applications or across memory images data formats implemented by each application. Furthermore, ( Section 4 ). the fact that web-based applications run inside a browser may interfere with the durability of applications’ artifacts in memory, for example due to the memory management pol- 2. Digital forensics study icy implemented by the browser. Existing works on browser forensics concentrate only on the extraction of browser- This section presents the digital forensics study that we car- specific artifacts (e.g., browsing history, web cache) leav- ried out in order to assess the existence of communication ing aside the recovery of application-specific artifacts which records in physical memory produced by messaging applica- may provide evidence (Ohana and Shashidhar, 2013). tions. This study lays the ground for the subsequent develop- Past developments in the use of memory forensic tech- ment of a forensic tool which enables the automatic extrac- niques have also been successful in the identification of ar- tion of such records. tifacts produced by a small range of native mobile applica- tions ( Nisioti et al., 2017 ) such as Facebook Messenger. While 2.1. Goals of the forensics study the extraction of communication records holds in the writing of complex regular expressions, it is unknown whether this More concretely, the goal of this study is to check whether and technique can be effectively applied in recovering communi- in which conditions communication records can be obtained cation records from several other popular messaging applica- from memory dumps. In particular, our research is driven by tions in the wild. two key questions: In this paper we make three key contributions. First, we present a digital forensics study aimed to systematically an- alyze the digital artifacts left in memory by several popu- How are messages represented in memory? The program- lar IM and email applications. Our study covers the analy- mers of web-based messaging applications are free to im- sis of artifacts produced by web-applications, when executed plement them using a range of different technologies. Some on various browsers, and also the analysis of artifacts pro- design decisions comprise the choice of front-end and back- duced by mobile applications. We successfully identified and end programming languages (e.g. Javascript, PHP), others in- retrieved IM communication records from web-applications volve selecting the data representation format of communi- such as Facebook, Twitter and Skype, as well as email records cation records (e.g. JSON, XML, binary). In a similar way, the from Outlook and a generic Roundcube email web-client. Our developers of mobile applications have a multitude of tech- study helps to characterize how the communication records of nologies available when programming such applications (e.g. web-based messaging applications are typically represented native app development, HTML5-based apps). This hetero- and to identify how browser-specific mechanisms may affect geneity in data representation and platforms may impact the the durability of such records in memory. Our study also al- way communication records are loaded into memory and con- low us to identify and assess the durability of communication tribute for the absence of a common model of the structure of records produced by mobile applications such as WhatsApp, communication records among different implementations of Viber or Hangouts ( Section 2 ). browsers, applications, and/or operating systems. Thus, this Second, we introduce the design and implementation of fact implies that a tool developed for analysing this kind of a forensic tool called RAMAS, which consists of a collabora- evidence would exhibit the additional complexity of having to tive and extensible framework for analysis of communica- take into account such differences between record structures, tion records from volatile memory. RAMAS is able to extract even when analysing a single application. We aim to assess such records from multiple messaging applications and dis- whether there is a common model which allows for the inter- play the extracted records on a user-friendly timeline. RA- pretation of textual application data lingering in memory. MAS is designed in a modular fashion so as to accommodate an ever-growing number of applications and allow collabora- How long do messages persist in memory? The persistence tive development and maintenance of the system by indepen- of in-memory data structures pertaining to a given web- dent forensic analysts. This goal is achieved through the im- application may be affected by the browser where the applica- plementation of extraction modules: each module contains a tion runs. First, we must ascertain whether the browser runtime set of (simple) rules that allow RAMAS to extract the records environment imposes limitations on the ability to recover com- of a specific application and represent them on a common munication records from physical memory. In particular, to application-independent format ( Section 3 ). provide the interaction with web-applications, web-browsers Lastly, we present an experimental