“…Depending on the IM app in use, the end user device is often a potential source for the recovery of IM artefacts (Carvey, 2004;Dickson 2006aDickson , 2006bDickson , 2006cDickson , 2007Reust, 2006;Van Dongen, 2007a, 2007bParvez et al, 2011;Mohtasebi et al, 2011a;Ibrahim et al, 2012;Yusoff et al, 2014aYusoff et al, , 2014bNorouzi, 2015;Azfar et al, 2015b;Do et al, 2015;Immanuel, 2015;Leom, 2015;Damshenas et al, 2015;Talebi et al, 2015). Such terrestrial artefacts can be useful in establishing whether a suspect has a direct connection to a crime (Mohtasebi and Dehghantanha, 2013).…”