Forensic analysis of virtual phone applications: Artifact recovery, provider identification, and automated user attribution

Abstract

Virtual Phone Applications (VPAs) provide Internet-based phone numbers for calls and messaging without a physical SIM, but their multinational CPaaS/VoIP infrastructures complicate attribution and often require cross-border cooperation. Prior forensic research has not systematically examined VPA-specific number issuance, reissuance, provider mediation, and backend communication. We analyzed six Android VPAs—Text & Call, Talkatone, Dingtone, textPlus, My 2nd Line, and OnPhone—on rooted devices under controlled registration, number-issuance, reissuance, calling, and messaging scenarios. Device, APK, network, and API analyses recovered message histories, call histories, and virtual-number artifacts from all six applications, access-IP artifacts from five, and identified the CPaaS/VoIP provider for each service. Authenticated API analysis enabled historical-record retrieval for four applications, and number reissuance generally preserved prior communications while updating current-number metadata, allowing number-change history to be inferred. Based on these findings, we developed a Python tool for heuristic VPA identification and automated artifact extraction and analysis. Across 150 VPA installations, the tool achieved 99.33% precision, 98.67% recall, and a 99.00% F1-score; a rerun on the same population after threshold refinement eliminated the observed errors, while extraction and analysis succeeded for all six target applications. We also propose a provider-aware forensic workflow supporting evidence acquisition and provider-directed requests in cross-border investigations.