Cybercrimes are rapidly increasing in parallel with the usage of digital tools. Criminals can use many methods to carry out their crimes such as mobile phones and instant messaging applications. Because of that, it is important to investigate the ability to retrieve evidence from mobiles that may be involved in cybercrime. This research aims to perform a mobile forensic analysis to retrieve evidence from specific instant messaging applications. To this end, an experiment was conducted to mimic the scene of illegal messages, delete them, and investigate the ability to retrieve deleted files. According to the result, this research successfully obtained text messages, multimedia data, and contact lists. The research's novelty can be derived from its ability to retrieve deleted data, demonstrating the feasibility of retrieving evidence from instant messaging applications that have not been investigated before. In future work, analyzing these applications under other operating system platforms may offer valuable artifacts for investigators.

Cybercrimes are rapidly increasing in parallel with the usage of digital tools. Criminals can use many methods to carry out their crimes such as mobile phones and instant messaging applications. Because of that, it is important to investigate the ability to retrieve evidence from mobiles that may be involved in cybercrime. This research aims to perform a mobile forensic analysis to retrieve evidence from specific instant messaging applications. To this end, an experiment was conducted to mimic the scene of illegal messages, delete them, and investigate the ability to retrieve deleted files. According to the result, this research successfully obtained text messages, multimedia data, and contact lists. The research's novelty can be derived from its ability to retrieve deleted data, demonstrating the feasibility of retrieving evidence from instant messaging applications that have not been investigated before. In future work, analyzing these applications under other operating system platforms may offer valuable artifacts for investigators.