Forensic Analysis of Social Media Apps in Windows 10


  • Asma Majeed
  • Shahzad Saleem



Digital Forensics, Investigation, Window Registry, Process Monitoring, Social Media Apps, Facebook, Skype, Twitter, Artifacts


The rapid revolution in technology has made the interaction among people easier through social media Apps and has given the business people novel ways to promote their business products and services. Therefore, now social media usage is not limited to only personal matters or fun but is also used for business advertising and selling purposes. The increased usage and need of social media has raised the risks associated with it which if exploited contribute to major losses. On the other hand, the increase in storage space with advancement in technology has made the digital forensic investigation a time consuming and difficult task. Therefore, it is necessary to have knowledge of the artifact locations of different frequently used applications so that the pre-hand information may be helpful in resolving any criminal cases faster. In this paper we have examined the behavior of Facebook, Skype and Twitter in Window 10 and has also highlighted some of the differences found with windows’ previous versions i.e. Window 8.1. In our research we have put effort to find remnants of above mentioned social media Apps’ usage in both the relevant databases and the registry entries.


Khawla A and Alghafli and Andrew Jones and Thomas Anthony Martini,”Forensic Analysis of the Windows 7 Registry ”,Proceedings of the 8th Australian Digital Forensics Conference, Edith Cowan University , Perth Western Australia, November 2010

Al Mutawa, N., Al Awadhi, I., Baggili, I., and Marrington, A. (2011, December). Forensic artifacts of Facebook’s instant messaging service. In Internet Technology and Secured Transactions (ICITST), 2011 International Conference for (pp. 771-776). IEEE.

Asma Majeed, Haleema Zia, Rabeea Imran, Shahzad Saleem, ”Forensic Analysis of three social media Apps in window 10”, HONET IEEE December 2015

Facebook Statistics July 2016, Retrieved 8th Aug 2016 from number-of-monthly-active-facebook-users-worldwide/

Top 20 Valuable Facebook Statistics, Retrieved 14th Sep 2016 from

Twitter Usage Statistics, Retreived 10th Aug 2016 from http://www.

Facebook Statistics Retrieved 20th Aug 2016 from http://thenextweb. com/facebook/2014/02/03/facebook-estimates-5-5-11-2-accounts-fake/ #gref

NDTV news June 2016, Retrieved 20th June 2016 from http://www.

Man held for uploading a video, Retrieved 20 Aug 2016 from man-held-for-uploading-girlfriends-intimate-video-1430997


Fraud case june 2016, Retrieved 20th Aug 2016 from mumbai-lured-by-us-soldier-on-facebook-72-yearold-conned-of-rs-2-crore-1417086

Raihana Md Saidi and Siti Arpah Ahmad and Noorhayati Mohamed Noor and Rozita Yunos, ”Wndow Registry Analysis for Forensic Investigation”,2013 IEEE, isbn 978-4673-5613-8.

Operating System Market Shares, Retrieved 5th Aug 2016 from qprid=10&qpcustomd=0

Shuhui Zhang and Lianhai Wang and Lei Zhang, ”Extracting windows registry information from physical memory” , 2011 IEEE.

Milind G. Meshram and Prof. Deepak Kapgate, ”A review on forensic Investigation Using Window Registry and Event Log files ”, IJCSMC, volume 4 June 2015, pages 620 to 624

Kisik Chang and Gibum Kim and Kwonyoup Kim and Woosuk Kim, ”Initial Case analysis using window registry in computer forensics” 2005.

Al Mutawa, N., Baggili, I., & Marrington, A. (2012). Forensic analysis of social networking applications on mobile devices. Digital Investigation, 9, S24-S33.

Daniel Walnycky, Ibrahim Baggili, Andrew Marrington, Jason Moore, & Frank Breitinger, (2015, August). Network and device forensic analysis of Android social-messaging applications. Published in DIGITAL INVESTIGATION Impact Factor: 0.99 DOI: 10.1016/j.diin.2015.05.009

Thakur, N. S. (2013). Forensic analysis of WhatsApp on Android smartphones.

Mahajan, A., Dahiya, M. S., & Sanghvi, H. P. (2013). ”Forensic analysis of instant messenger applications on android devices”. arXiv preprint arXiv:1304.4915.

Al-Saleh, Mohammed I., and Yahya A. Forihat. “Skype forensics in android devices.” International Journal of Computer Applications 78.7 (2013): 38-44.

Appiah Kwame Kubi , Shahzad Saleem, Oliver Popov, ”Evaluation of some tools for extracting e-evidence from mobile devices ”, Application of Information and Communication Technologies (AICT), 2011 5th International Conference 2011 IEEE, ISBN 978-1-61284-832-7

Shahzad Saleem, Oliver Popov, Ibrahim Baggili, ”A method and a case study for the selection of the best available tool for mobile device forensics using decision analysis”, Mar 2016, Digital Investigation Volume 16

Jeremy M. Stormo, ”Analysis of Windows 8 Registry Artifacts”, University of New Orleans Theses and Dissertations Dec 2013.

Kaveesh Dashora and Deepak Singh Tomar and J.L. Rana, ”A practical Approachforevidencegatheringinwindowsenvironment”,International Journal od Computer Applications 2010, Volume 5.

LCDI, ”Window 10 Forensics”, Leahy Center for Digital Investigation 2010

Shahzad Saleem and Ibrahim Baggili and Oliver Popov, ”Quantifying relevance of mobile digital evidence as they relate to case types: A survey and a guide for best practice”, JDFSLVolume 9 2014.

Shavers, B., ”Virtual Forensics (A Discussion of Virtual Machine Related to Forensic Analysis)”, 2008.

Facebook For Windows 10, Retrieved 10th Aug 2016 from 27755-facebook-beta-app-for-windows-10-uses-osmeta-instead-of-islandwood/

Pakistan Criminal Record Retrieved 10th Aug 2016 from http://






Engineering Sciences