Identification of Whatsapp Digital Evidence on Android Smartphones using The Android Backup APK (Application Package Kit) Downgrade Method

Abstract

The use of WhatsApp for actions that lead to unlawful acts is a serious matter that needs to be proven in court. Android and the WhatsApp messaging application continue to update their features and security to provide maximum service and protection to its users, such as the WhatsApp database encryption using crypt14. With crypt14 encryption on the WhatsApp database, investigations of WhatsApp digital evidence against Electronic Evidence (BBE) require an acquisition and extraction method to identify artefacts relevant to digital evidence needs. The National Institute Standard Technology (NIST) reference methodology, from the collection, examination, and analysis to reporting stages, has become a widely used framework for digital forensics against BBE. The Android Backup Application Package Kit (APK) Downgrade method can decrypt the WhatsApp database crypt14 to become a solution that can be used in the framework of mobile forensics to answer the needs of investigations into certain criminal cases, including data that users have deleted. With the Cellebrite tools, the Android Backup Application Package Kit (APK) Downgrade method can identify approximately 651% more artefacts than the Android Backup and logical acquisition methods using the FinalData and MobilEdit tools.