Comparisons of forensic tools to recover ephemeral data from iOS apps used for cyberbullying

Ephemeral applications are growing increasingly popular on the digital mobile market. However, they are not always used with good intentions. Criminals may see a gateway into private communication with each other through this transient application data. This could negatively impact criminal court cases for evidence, or civil matters, such as cyberbullying where evidence could be useful. To find out if messages from such applications can indeed be recovered or not, a forensic examination of the device would be required by the law enforcement authority. This paper reports forensically sound recovery of evidential data, in relation to cyberbullying, from three popular ephemeral applications using an iOS mobile device. Examinations were performed to evaluate two popular mobile forensic tools, Oxygen and MOBILedit, using parameters from the National Institute of Standards and Technology’s (NIST) mobile tool test assertions and test plan. The results from the investigation recovered various artefacts from the mobile device as well as revealing some interesting forensic data related to cyberbullying.