BrowStExPlus: A Tool to Aggregate IndexedDB Artifacts for Forensic Analysis

Abstract

As the Internet and World Wide Web have rapidly evolved and revolutionized the applications in everyday life, it is a demanding challenge for investigators to keep up with the emerging technologies for forensic analyses. Investigating web browser usages for criminal activities, also known as web browser forensics, is a significant part of digital forensics as crucial browsing information of the suspect can be discovered. Particularly, in this study, an emerging web storage technology, called IndexedDB, is examined. Characteristics of IndexedDB technology in five major web browsers under three major operating systems are scrutinized. Also, top 15 US websites ranked by Alexa are investigated for their data storage in IndexedDB. User screen names, ids, and records of conversations, permissions, and image locations are some of the data found in IndexedDB. Furthermore, BrowStEx, a proof‐of‐concept tool previously developed, is extended and cultivated into BrowStExPlus, with which aggregating IndexedDB artifacts is demonstrated.

Browser Forensic Investigations of Instagram Utilizing IndexedDB Persistent Storage

“…Instagram web browser artifacts left on personal computers have been covered in a notable number of studies [9][10][11]. However, these studies were cut short of web persistent storage forensics, which is a relatively new area and has produced only a handful of papers in the last decade [7,[12][13][14][15][16][17]. Additionally, Instagram forensics has been the subject of several research papers with a broader scope of social media forensics.…”

“…Paligu et al [7] conducted research focused on IndexedDB forensics and security without targeting Instagram artifacts. The paper included a proof-of-concept tool called BrowStExPlus to demonstrate the findings.…”

“…This is over a minimum of 45 MB of increased data storage compared to previous Web Storage technology [5]. Due to advantageous storage capability and fast access to persistent data with the utilization of JavaScript and JSON (JavaScript Object Notation) objects [6], the utilization of IndexedDB is increasing rapidly [7]. One of the websites that recently joined this trend is the popular social media site Instagram, which has over 1074 billion users worldwide [8].…”

Microsoft Teams desktop application forensic investigations utilizing IndexedDB storage

“…IndexedDB is a fast‐growing client‐side storage technology that browsers have been fully supporting since 2012 [7]. A previously performed study on IndexedDB artifacts in web browsers showed that the most frequently used websites in the United States growingly use IndexedDB for client data storage [8]. Even though Microsoft Teams is a desktop application, it appears to save data with utilization of IndexedDB technology as well.…”

Forensic analysis of Twitch video streaming activities on Android

“…Worse, streamed content can be recorded and later distributed, as what happened in the case of a child sexual abuse on Periscope [7]. Unfortunately, these crimes are still being committed and are expected to rise with more technological advances [8,9]. Consequently, law enforcement agencies pin their hope on digital forensic investigators to extract evidences of use and abuse of streaming services from the user's devices such as smartphones and PCs.…”