Abstract
- Messenger services are not only a popular means of everyday communication but also provide criminals with opportunities to plan and execute illegal activities and exchange harmful content. As a result, the analysis of mobile communications is becoming increasingly important in criminal investigations. Most previous research has focused on analysing data stored locally on mobile devices. However, messenger service providers are increasingly storing data remotely on database servers. This work presents a forensic analysis model for remote-persistent messengers that integrates mobile and cloud forensics methods. The model’s practical application is illustrated by extracting forensically relevant artefacts from the chat platform Knuddels. This platform has gained particular importance under criminal law because, according to the Federal Criminal Police Office of Germany, sex offenders in German-speaking countries are increasingly using it to make contact with minors.