Forensic analysis of social network applications on smartphones

Today, with the rapid development of technology and the spread of the internet, smartphones have gained various features and become functional for their users. The most important reason for this situation is that there are developed different operating systems and an unlimited number of applications for smartphones. Social network applications are communication applications that are popularly used among people for both personal and professional purposes. Such applications are used for the benefit of people due to the convenience they provide, as well as illegally used for various cyber crimes due to the risks they pose. Therefore, the examination of the rich data mine left by social network applications on smartphones is among the hot topic of mobile device forensics as it plays a critical role in the course of investigations. In this thesis, forensic analysis of WhatsApp Messenger, Facebook Messenger, Instagram, Telegram, and Skype, which are among the popular social network applications worldwide, on two different smartphones running Android and iOS, which are the most used operating systems in the global market, was performed. Cellebrite UFED and Magnet AXIOM, which are among the most competent tools in mobile forensics, were used in the examination carried out in accordance with the international investigation methods determined by the National Institute of Standards and Technology (NIST) for mobile devices and the global principles determined by the International Criminal Police Organization (INTERPOL) for digital forensics. In addition, rooting and jailbreaking operations were performed in order to obtain more data with the privilege escalation on mobile devices. Thus, physical and full file system images of the devices were acquired. As a result of forensic analysis, important user data and storage areas of social network applications were determined. Also, all or a certain part of the deleted data was recovered.