Browser Forensic Investigations of Instagram Utilizing IndexedDB Persistent Storage

Abstract

Social media usage is increasing at a rapid rate. Everyday users are leaving a substantial amount of data as artifacts in these applications. As the size and velocity of data increase, innovative technologies such as Web Storage and IndexedDB are emerging. Consequently, forensic investigators are facing challenges to adapt to the emerging technologies to establish reliable techniques for extracting and analyzing suspect information. This paper investigates the convenience and efficacy of performing forensic investigations with a time frame and social network connection analysis on IndexedDB technology. It focuses on artifacts from prevalently used social networking site Instagram on the Mozilla Firefox browser. A single case pretest–posttest quasi-experiment is designed and executed over Instagram web application to produce artifacts that are later extracted, processed, characterized, and presented in forms of information suited to forensic investigation. The artifacts obtained from Mozilla Firefox are crossed-checked with artifacts of Google Chrome for verification. In the end, the efficacy of using these artifacts in forensic investigations is shown with a demonstration through a proof-of-concept tool. The results indicate that Instagram artifacts stored in IndexedDB technology can be utilized efficiently for forensic investigations, with a large variety of information ranging from fully constructed user data to time and location indicators.