A Systematic Literature Review of Secure Instant Messaging Applications from a Digital Forensics Perspective

Abstract

The use of instant messengers in organized crime has made retrieving digital evidence from these platforms crucial in investigations. However, the wide implementation of end-to-end encryption (e2ee) has made forensic analysis challenging since all data and multimedia stored in these platforms are encrypted. To retrieve evidence, forensic examiners rely on artifacts produced by secure messaging applications. Therefore, identifying the artifacts that can be gathered from secure messaging applications is crucial during emergency analysis, as law enforcement agencies monitor these platforms. This literature review aims to provide a comprehensive understanding of artifact retrieval and forensic analysis trends by summarizing studies conducted since inception on popular secure messaging applications, including WhatsApp, Signal, Telegram, Wickr, and Threema. The review covers artifact retrieval, forensic methodologies, and tools. The review findings are significant to the cybersecurity and research communities, as well as the users of these applications. Forensic investigators can leverage the information during their investigations, cybersecurity practitioners can identify weaknesses in implementation to develop better security policies, and users can make informed decisions regarding their privacy.