Verification of Privacy Protection Reliability through Mobile Forensic Approach Regarding iOS-Based Instant Messenger

Abstract

With the diffusion of mobile devices and Internet hyperconnectivity technology, all daily living records of individuals are being recorded on mobile devices in real time. However, from the user's point of view, the reliability of privacy protection, that is, whether the user's data on the mobile device completely disappears when it is deleted, is critical. This is because, for the sustainability of social growth, it is necessary to control the digitalization and technology that heightens the risks of the future society. Therefore, this study aims to check the traces of the SQLite database to see if instant messenger messages deleted by the user can be recovered. When the SQLite database record is deleted, if the database shrink function or other application-level deletion does not work, it is possible to recover the deleted record. We chose two iOS-based instant messengers, WhatsApp and WeChat, and analyzed the SQLite DB file and Table Schema where messages are stored. As a result of the experiment in this study, it was verified that the area where the deleted message was stored in the SQLite DB file was overwritten with 0 x 00 or updated with a NULL value, making it impossible to recover the deleted message. This process operates at the app level, and user data is safely protected.