WhatsApp Presents Special Challenges For Digital Forensic Services

Owned by Facebook, WhatsApp is a messaging app that provides encrypted ways of communicating via internet voice calls, multimedia file sharing, and unlimited messaging. The encrypted code aspect of this app is raising concern amongst computer forensics investigators because corrupt users are using this to their advantage to exploit or send private data/information. This has become a worldwide issue, especially since WhatsApp can translate and be used internationally.

Many people use translation tools to help them understand the content that was written in another language, and apps like WhatsApp make this especially easy to do. Perks such as this one are one of the reasons that this app is used internationally for business, travel, and simply communicating with friends and family. However, in recent months, this has been adding to the special challenges that digital forensic services run into when trying to uncover data from WhatsApp.

Legal Issues With WhatsApp

Court cases that require digital forensic assistance will often go to court and from there, the necessary data is typically able to be recovered in order to provide evidence during a trial. However, recent crimes that have gone to trial have been running into the obstacle of the accused party had used the WhatsApp; thus creating major challenges for investigators all over the world.

Why is this causing issues in the courtrooms? The answer is because smartphones run WhatsApp locally, meaning that voice messages, images, and videos may be stored on the device that is under investigation; however, the text content is encrypted and can not be recovered. This encrypted text obstacle remains whether or not the text was translated or not.

During a legal proceeding, evidence that has been recovered can be viewed on the device that is under investigation but doing this can potentially create inauthentic data for investigators. Similarly, multimedia images, messages, and videos that were not sent on a smartphone (the information is not sent locally on other devices) will be deleted from the server once they are sent to the recipient.

WhatsApp Is Crucial In The International Market

As briefly stated above, WhatsApp is used for all kinds of international communication. Businesses that deal with an international clientele and relations often gravitate towards this app because of the benefits and various ways to use it as a form of international communication.

Some common ways to communicate via WhatsApp for international businesses include:

• Onboarding support.
• To send newsletters.
• To collect employee feedback.
• Promote workshops and training opportunities.
• Digitalize HR.
• Share schedule changes.
• Plan business trips.

The reason that so many companies use WhatsApp in business is that the content can very easily be translated. However, some businesses that are making their money illegally or are committing acts of fraud use WhatsApp to translate the content they need, then get rid of it since it will not be recovered.

Accessing WhatsApp Data

During a legal proceeding, if the owner of the device that is under investigation is cooperative, recovering content can be expedited and doable. However, without the cooperation of the party under investigation, it becomes harder to access encrypted content on the WhatsApp.

The process of extracting data from the WhatsApp is incredibly complex and often takes a lot of time. When extracting information from a mobile phone, the process begins with removing the SIM card where data was sent from. If the investigator does not have the SIM card, he or she will then have to look for data in various cloud services. Searching for data in a cloud system is particularly challenging because there are often additional security challenges such as two-factor authentication/ verification.

If WhatsApp is used on a computer, retrieving data from a cloud system is also how digital forensic investigators will access and locate data.

Compatibility Issues

Digital forensic tools are constantly evolving for issues such as the ones that are presented with the use of the WhatsApp. A large issue that digital forensic investigators are also running into is the compatibility of digital forensic tools with iOS and Android operating systems. Attempting to create tools to access encrypted information from WhatsApp that is compatible with all devices and operating systems is one of the current goals of digital forensic investigators. This would create more productive and expedited investigations.

What’s Next For WhatsApp ?

Like any app, WhatsApp is constantly evolving with new versions, updates, and software security. With that being said, it’s up to digital forensic investigators to stay up to date with how to recover and manipulate the encrypted information; whether it has been translated or not.