[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-659508-105":59,"doc-detail-659508-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","a-digital-forensic-analysis-of-whatsapp-artifacts-in-windows-11-operating-system-using-microsoft-edge-659508","A Digital Forensic Analysis of WhatsApp Artifacts in Windows 11 Operating System using Microsoft Edge","","Digital forensics addresses the evidentiary challenges created by cybercriminal activity and the growing use of instant messaging platforms as digital evidence sources. This study examines forensic artifacts from WhatsApp on a Windows 11 system through WhatsApp Web accessed using Microsoft Edge. It evaluates synchronization and host-side traces after evidence was handled via the web client rather than the mobile device. Using FTK Imager, Autopsy, and OSForensics, the work analyzes cache, IndexedDB, and log files, finding media-synchronization traces and some activity logs, while text, deleted items, and media are often not saved automatically.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/a-digital-forensic-analysis-of-whatsapp-artifacts-in-windows-11-operating-system-using-microsoft-edge-659508/659508/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/a-digital-forensic-analysis-of-whatsapp-artifacts-in-windows-11-operating-system-using-microsoft-edge-659508/659508.png","ImageObject",300,407,{"name":92,"@type":93},"Jiven","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-30","2026-10-27",true,{"@type":102,"interactionType":103,"userInteractionCount":19},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What forensic artifacts does the study focus on for WhatsApp evidence?","Question",{"text":112,"@type":113},"The study focuses on forensic artifacts such as text files, images, audio files, and videos. It also examines host-side traces including cache, IndexedDB, and log files.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"How was the Windows 11 investigation scenario set up?",{"text":117,"@type":113},"The victim’s WhatsApp account evidence was accessed through WhatsApp Web on Windows 11 using the Microsoft Edge browser. The experiment used controlled virtual environments to analyze how data synchronizes between devices and the host machine.",{"name":119,"@type":110,"acceptedAnswer":120},"Which forensic tools were used, and what did the findings indicate?",{"text":121,"@type":113},"FTK Imager, Autopsy, and OSForensics were used to locate, examine, and retrieve artifacts. Results show traces of media synchronization and certain activity logs, but critical data such as text messages, deleted messages, and media files were often not automatically saved on the computer.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},659508,1793134814,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":19,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":29,"language":139,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":67,"update_tm":129,"read_time":143},1099513958607,"https://ap-avatar.wpscdn.com/avatar/100002390cf8733938c?x-image-process=image/resize,m_fixed,w_180,h_180&k=1778829742770036399","2025 13th International Symposium on Digital Forensics and Security (ISDFS) ©2025 IEEE DOI: 10.1109/ISDFS65363.2025.11011954| 979-8-3315-0993-4/25/$31.00 |   \nA Digital Forensic Analysis of WhatsApp Artifacts in Windows 11 Operating System using Microsoft  \nEdge  \nTimothy Laryea School of Computer Sciences Western Illinois University  \nMacomb, USA Email: [t-laryea@wiu.edu](t-laryea@wiu.edu)  \nAnwah Pascal School of Computer Sciences Western Illinois University  \nMacomb, USA Email: [at-pascal@wiu.edu](at-pascal@wiu.edu)  \nTahir M. Khan School of Computer Sciences Western Illinois University  \nMacomb, USA Email: [tm-khan@wiu.edu](tm-khan@wiu.edu)  \nAbstract—Digital forensics has made significant advancementsin addressing the challenges posed by cybercriminals, particularly with the increasing use of instant messaging (IM) platforms as digital evidence sources. As one of the most popular IM platforms globally, WhatsApp has proven to be a valuable tool for effective communication and file transfer, particularly through its weband desktop application features.  \nThis study explores forensic artifacts with a focus on identifying various forms of evidence, including text files, images, audio files, and videos. The investigation analyzes these artifacts on a Windows 11 operating system, where the victim accessed them through the WhatsApp Web client using the Microsoft Edge browser. The evidence being examined was sent to the victim’s WhatsApp account on a mobile device. However, instead of opening the evidence on the phone, the victim used the WhatsApp Web client in the Microsoft Edge browser to view and interact with the attacker. A detailed experimental design was employed, incorporating virtual environments to analyze how data is synchronized between devices and the host machine.  \nIn this research, three forensic tools—FTK Imager, Autopsy, and OSForensics—were utilized to locate, examine, and retrieve artifacts, including cache, IndexedDB, and log files. The findings reveal that while traces of media synchronization and certain activity logs were discovered, critical data such as text messages, deleted messages, and media files were often not automatically saved on the computer.  \nIndex Terms—Digital Forensics, WhatsApp Web, Windows 11, Microsoft Edge, Artifact Analysis, FTK Imager, Autopsy, OSForensics.  \nI. INTRODUCTION  \nIn recent years, digital forensics has emerged as an important field for combating the wide spread of cybercrime. The ever-growing usage of instant messaging (IM) platforms has not only transformed the way individuals communicate, but has also created new avenues for illicit cyber activities [1] . Among these IM applications, WhatsApp has emerged as the most popular (IM) application, with about 2 billion monthly active users worldwide [2], presenting crucial opportunities for forensic analysis and investigations. It has also become essential for uncovering evidence, particularly evidence from instant messaging (IM) platforms such as WhatsApp.  \nAlthough mobile devices have originally been the area of concern, the rapid growing use of WhatsApp Web warrants  \na distinct direction of investigation and research of artifacts stored on the devices with WhatsApp Web [3] .  \nThis research analyses and investigates WhatsApp Web artifacts on Windows 11 OS, accessed via the Microsoft Edge browser. This study was conducted in a controlled virtual environment to identify and analyze artifacts when the victim opted to access the evidence through the WhatsApp Web interface, a feature that enables users to connect to a device other than their mobile device using Microsoft Edge, rather than directly accessing it on the mobile device. The research explores the extent of uncovering media traces, data synchronization, and logs while highlighting the challenges and limitations. The findings provide insights into the strengths and limitations of WhatsApp Web as a source of digital evidence. This represents a mainstream configuration","cbCaicV1qUOVSARQ","https://ap.wps.com/l/cbCaicV1qUOVSARQ","pdf",288172,"English","# Introduction\n## Literature Review\n# Digital Forensics\n## Artifact Scope and Evidence Types\n# Experimental Design\n## Tools and Data Sources\n# Findings\n## Limitations and Challenges\n# Future Work","[{\"question\":\"What forensic artifacts does the study focus on for WhatsApp evidence?\",\"answer\":\"The study focuses on forensic artifacts such as text files, images, audio files, and videos. It also examines host-side traces including cache, IndexedDB, and log files.\"},{\"question\":\"How was the Windows 11 investigation scenario set up?\",\"answer\":\"The victim’s WhatsApp account evidence was accessed through WhatsApp Web on Windows 11 using the Microsoft Edge browser. The experiment used controlled virtual environments to analyze how data synchronizes between devices and the host machine.\"},{\"question\":\"Which forensic tools were used, and what did the findings indicate?\",\"answer\":\"FTK Imager, Autopsy, and OSForensics were used to locate, examine, and retrieve artifacts. Results show traces of media synchronization and certain activity logs, but critical data such as text messages, deleted messages, and media files were often not automatically saved on the computer.\"}]","A Digital Forensic Analysis of WhatsApp Artifacts in Windows 11 Operating System using Microsoft Edge | PDF",15]