{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,16]],"date-time":"2026-01-16T04:18:36Z","timestamp":1768537116326,"version":"3.49.0"},"reference-count":42,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2020,10,28]],"date-time":"2020-10-28T00:00:00Z","timestamp":1603843200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Digital Evidence is becoming an indispensable factor in most legal cases. However, technological advancements that lead to artifact complexity, are forcing investigators to create sophisticated connections between the findings and the suspects for admissibility of evidence in court. This paper scrutinizes whether IndexedDB, an emerging browser technology, can be a source of digital evidence to provide additional and correlating support for traditional investigation methods. It particularly focuses on the artifacts of the worldwide popular application, WhatsApp. A single case pretest\u2013posttest quasi experiment is applied with WhatsApp Messenger and Web Application to populate and investigate artifacts in IndexedDB storage of Google Chrome. The findings are characterized and presented with their potential to be utilized in forensic investigation verifications. The storage locations of the artifacts are laid out and operations of extraction, conversion and presentation are systematized. Additionally, a proof of concept tool is developed for demonstration. The results show that WhatsApp Web IndexedDB storage can be employed for time frame analysis, demonstrating its value in evidence verification.<\/jats:p>","DOI":"10.3390\/fi12110184","type":"journal-article","created":{"date-parts":[[2020,10,28]],"date-time":"2020-10-28T11:43:06Z","timestamp":1603885386000},"page":"184","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":15,"title":["Browser Forensic Investigations of WhatsApp Web Utilizing IndexedDB Persistent Storage"],"prefix":"10.3390","volume":"12","author":[{"given":"Furkan","family":"Paligu","sequence":"first","affiliation":[{"name":"Computer Science Department, Sam Houston State University, Huntsville, TX 77340, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4940-6808","authenticated-orcid":false,"given":"Cihan","family":"Varol","sequence":"additional","affiliation":[{"name":"Computer Science Department, Sam Houston State University, Huntsville, TX 77340, USA"}]}],"member":"1968","published-online":{"date-parts":[[2020,10,28]]},"reference":[{"key":"ref_1","unstructured":"Goodison, S.E., Davis, R.C., and Jackson, B.A. (2020, August 29). Digital Evidence and U.S. Criminal Justice System, Available online: https:\/\/www.ncjrs.gov\/pdffiles1\/nij\/grants\/248770.pdf."},{"key":"ref_2","unstructured":"Alvarez, L. (New York Times, 2011). Software designer reports error in Anthony trial, New York Times."},{"key":"ref_3","unstructured":"Burch, A.D.S. (2020, August 29). Pedro Bravo Found Guilty of First-Degree Murder of Christian Aguilar. Miami Herald, Available online: https:\/\/www.miamiherald.com\/news\/local\/community\/miami-dade\/article1980000.html."},{"key":"ref_4","unstructured":"Carroll, O. (2020, August 29). Challenges in Modern Digital Investigative Analysis. Crime Scene Investigator Network. Available online: https:\/\/www.crime-scene-investigator.net\/challenges-in-modern-digital-investigative-analysis.html."},{"key":"ref_5","unstructured":"IndexedDB API (2020, September 29). MDN Web Docs. Available online: https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/IndexedDB_API."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"1370","DOI":"10.1111\/1556-4029.14043","article-title":"BrowStExPlus: A Tool to Aggregate Indexed DB Artifacts for Forensic Analysis","volume":"64","author":"Paligu","year":"2019","journal-title":"J. Forensic Sci."},{"key":"ref_7","unstructured":"(2020, September 29). Storage for the Web. Available online: https:\/\/web.dev\/storage-for-the-web."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"201","DOI":"10.1016\/j.diin.2014.04.003","article-title":"Forensic analysis of WhatsApp Messenger on Android smartphones","volume":"11","author":"Anglano","year":"2014","journal-title":"Digit. Investig."},{"key":"ref_9","unstructured":"Thakur, N.S. (2013). Forensic Analysis of WhatsApp on Android Smartphones. [Master\u2019s Thesis, University of New Orleans]."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Shortall, A., and Azhar, M.H.B. (2015, January 3\u20135). Forensic acquisitions of WhatsApp data on popular mobile platforms. Proceedings of the IEEE Sixth International Conference on Emerging Security Technologies, Braunschweig, Germany.","DOI":"10.1109\/EST.2015.16"},{"key":"ref_11","first-page":"69","article-title":"A comparative study of forensic tools for WhatsApp analysis using NIST measurements","volume":"8","author":"Umar","year":"2017","journal-title":"Int. J. Adv. Comput. Sci. Appl."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"110","DOI":"10.1016\/j.diin.2015.09.002","article-title":"WhatsApp network forensics: Decrypting and understanding the WhatsApp call signaling messages","volume":"15","author":"Karpisek","year":"2015","journal-title":"Digit. Investig."},{"key":"ref_13","first-page":"410","article-title":"Forensic Investigation on WhatsApp Web Using Framework Integrated Digital Forensic Investigation Framework Version 2","volume":"7","author":"Actoriano","year":"2018","journal-title":"Int. J. Cyber Secur. Digit. Forensics IJCSDF"},{"key":"ref_14","unstructured":"Vukadinovic, N.V. (2019). WhatsApp Forensics: Locating Artifacts in Web and Desktop Clients. [Master\u2019s Thesis, Purdue University Graduate School]."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Mahajan, A., Dahiya, M.S., and Sanghvi, H.P. (2013). Forensic analysis of instant messenger applications on android devices. arXiv.","DOI":"10.5120\/11602-6965"},{"key":"ref_16","unstructured":"Sgaras, C., Kechadi, M.T., and Le-Khac, N.A. (2012). Forensics Acquisition and Analysis of Instant Messaging and VoIP Applications, Springer."},{"key":"ref_17","unstructured":"Kimak, S., Ellman, J., and Laing, C. (2012, January 25\u201326). An investigation into possible attacks on HTML5 indexedDB and their prevention. Proceedings of the 13th Annual Postgraduate Symposium on the Convergence of Telecommunications, Networking & Broadcasting, Liverpool, UK."},{"key":"ref_18","unstructured":"Arefipour, S., and Mozahhebi, M. (2015). Comparison of IndexedDB and SQLite Based on Developers\u2019 Concerns, Gothenburg University. Student Essay."},{"key":"ref_19","unstructured":"W3C (2020, September 30). Indexed Database Specification API 2.0. Available online: https:\/\/www.w3.org\/TR\/IndexedDB-2."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"236","DOI":"10.1145\/301970.301973","article-title":"The string B-tree: A new data structure for string search in external memory and its applications","volume":"46","author":"Ferragina","year":"1999","journal-title":"J. ACM"},{"key":"ref_21","unstructured":"(2020, September 30). IndexedDB. Available online: https:\/\/caniuse.com\/#search=indexedDB."},{"key":"ref_22","unstructured":"(2020, September 30). Alexa Top Sites in United States. Available online: https:\/\/www.alexa.com\/topsites\/countries\/US."},{"key":"ref_23","unstructured":"(2020, September 30). Performance\/Avoid SQLite in Your Next Firefox Feature. Available online: https:\/\/wiki.mozilla.org\/Performance\/Avoid_SQLite_In_Your_Next_Firefox_Feature."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Lin, J. (2015, January 27). Building a self-contained search engine in the browser. Proceedings of the 2015 International Conference on the Theory of Information Retrieval, Northampton, MA, USA.","DOI":"10.1145\/2808194.2809478"},{"key":"ref_25","unstructured":"Dean, J., and Ghemawat, S. (2020, September 30). LevelDB: A Fast Persistent Key-Value Store. 27 July 2011. Available online: https:\/\/opensource.googleblog.com\/2011\/07\/leveldb-fast-persistent-key-value-store.html."},{"key":"ref_26","unstructured":"(2020, September 30). LevelDB Benchmarks. Available online: http:\/\/www.lmdb.tech\/bench\/microbench\/benchmark.html."},{"key":"ref_27","unstructured":"Using IndexedDB (2020, September 30). MDN Web Docs. Available online: https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/IndexedDB_API\/Using_IndexedDB."},{"key":"ref_28","unstructured":"Same Origin Policy (2020, September 30). W3. Available online: https:\/\/www.w3.org\/Security\/wiki\/Same_Origin_Policy."},{"key":"ref_29","unstructured":"Cook, T.D., and Campbell, D.T. (1979). The design and conduct of true experiments and quasi-experiments in field settings. Reproduced in Part in Research in Organizations: Issues and Controversies, Goodyear Publishing Company."},{"key":"ref_30","unstructured":"(2020, August 29). Wildlife Windows 7 Sample Video. Available online: https:\/\/www.youtube.com\/watch?v=a3ICNMQW7Ok."},{"key":"ref_31","first-page":"118","article-title":"Systematic digital forensic investigation model","volume":"5","author":"Agarwal","year":"2011","journal-title":"Int. J. Comput. Sci. Secur."},{"key":"ref_32","unstructured":"Carrier, B., and Spafford, E. (2020, October 10). An event-based digital forensic investigation framework. Available online: http:\/\/www.digital-evidence.org\/papers\/dfrws_event.pdf."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Pollitt, M. (2010). A history of digital forensics. Springer IFIP International Conference on Digital Forensics, Springer.","DOI":"10.1007\/978-3-642-15506-2_1"},{"key":"ref_34","unstructured":"(2020, August 29). What Is Nonconsensual Pornography? NCJFCJ. Available online: https:\/\/www.ncjfcj.org\/news\/what-is-nonconsensual-pornography\/."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"141","DOI":"10.1007\/s11227-015-1516-7","article-title":"Cybercrime investigation countermeasure using created-accessed-modified model in cloud computing environments","volume":"72","author":"Kao","year":"2016","journal-title":"J. Supercomput."},{"key":"ref_36","unstructured":"Find Local Investigators (2020, August 29). Computer Forensics\/Cyber Crime. Available online: https:\/\/www.pinow.com\/investigations\/computer-forensics."},{"key":"ref_37","unstructured":"Sqlitebrowser (2020, October 24). DB Browser for SQLite. Available online: https:\/\/sqlitebrowser.org."},{"key":"ref_38","unstructured":"Ideawu (2020, August 29). PHP Working with LevelDB. Available online: http:\/\/www.ideawu.com\/blog\/post\/40.html."},{"key":"ref_39","unstructured":"Dean, J., and Ghemawat, S. (2020, August 29). Leveldb. Available online: https:\/\/github.com\/google\/leveldb\/."},{"key":"ref_40","unstructured":"Paligu, F., and Varol, C. (2020). BrowSwEx. Zenodo."},{"key":"ref_41","unstructured":"Developers Google (2020, August 29). Chrome DevTools. Available online: https:\/\/developers.google.com\/web\/tools\/chrome-devtools."},{"key":"ref_42","unstructured":"(2020, August 29). WAMP Server. Available online: https:\/\/www.wampserver.com\/en\/."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/12\/11\/184\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T10:29:44Z","timestamp":1760178584000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/12\/11\/184"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,10,28]]},"references-count":42,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2020,11]]}},"alternative-id":["fi12110184"],"URL":"https:\/\/doi.org\/10.3390\/fi12110184","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,10,28]]}}}