ACQUISIZIONE FORENSE DI CONVERSAZIONI DA APPLICAZIONI DI MESSAGGISTICA ISTANTANEA ATTRAVERSO TECNICHE DI WEB CRAWLING

This document describes the Wace Forensics software feature. This is a software developed by me in order to acquire data from smarphones and tablets to validate both the tecniques and legal aspect during the process of forensics acquisition. Sometimes it is impossibile to acquire instant messagging data into a device, like Whatsapp, Telegram and Facebook Messenger chat, with standard hard- ware/software instruments. Wace Forensics can acquire all the data of the most important instant messagging application, using the web interfaces provided by the same applications. All the acquisition are certified with checksum (md5 and sha 256) and timestamps. The acquisition is repeatable and there is the chance to verify the every data with the checksum comparison. All the acquistions can be used for law enforcement purposes. Wace Forensics it's a new way, an unicum, for mobile forensics acquisitions and it is capable of overcoming many obstacles about the compatibility and the state of the device. The software is made up from a Chrome add on that opens each conversation and reads all the messages, after the authentication and the positioning into the correct page. All the acquired data must be sent to the local server. When th acquisition is finished it is possibile to show all the conversations using a web interface built by the server. It is possibile to do keyword searches and save a report of some or all the conversations. The ease of use of the software and the high compatibility make Wace Forensics an innovative tool, useful for computer forensics experts and analysts.