Abstract

Disappearing messages is an optional feature available in popular applications for more privacy. The Telegram instant messenger application is a rival and alternative to the popular messaging application WhatsApp, with both applications citing end-to-end encryption for both messages and calls as a key offering. While Telegram doesn’t officially have a ‘disappearing message’ feature like WhatsApp it still is possible to send disappearing messages using the secret chat functionality. In this paper, we analyse and evaluate ‘disappearing messages’ across Telegram and Snapchat to see whether they can be forensically preserved and/or recovered across Apple and Android operating systems. As these messages could be vital to investigations, with potential evidence and intelligence stored on them, not to mention the limited timeframe in which they are ‘viewable’ to the user, it is a great opportunity for digital forensic analysts to understand how they are stored, managed, and ‘deleted’ compared to traditional messages on the same platforms/applications.

Download

Share

COinS