|
Analyzing TikTok
from a Digital Forensics Perspective 1ESTG/Polytechnic
of Leiria, Leiria, Portugal patricio.domingues@ipleiria.pt, {2171569, 2202274}@my.ipleiria.pt,
miguel.frade@ipleiria.pt 2Instituto
de Telecomunicações, Leiria, Portugal 3CIIC
Research Centre, Leiria, Portugal Abstract TikTok is a major hit in the digital mobile world, quickly reaching the top 10 installed applications for the two main mobile OS, iOS and Android. This paper studies Android's TikTok application from a digital forensic perspective, analyzing the digital forensic artifacts that can be retrieved on a post mortem analysis and their associations with operations performed by the user. The paper also presents FAMA (Forensic Analysis for Mobile Apps), an extensible framework for the forensic software Autopsy, and FAMA's TikTok module that collects, analyzes, and reports on the main digital forensic artifacts of TikTok's Android application. The most relevant digital artifacts of TikTok include messages exchanged between TikTok so-called ``friends'', parts of the email/phone number of registered users, data about devices, and transactions with TikTok's virtual currency. One of the results of this research is the set of forensic traces left by users' transactions with TikTok's in-app virtual currency. Another result is the detection of patterns that exist in TikTok's integer IDs, allowing to quickly link any 64-bit TikTok's integer ID to the type of resources -- user, device, video, etc. -- that it represents. Keywords: TikTok,
Android, Digital Forensics, In-app Virtual Currency +: Corresponding author: Patricio Domingues Journal
of Wireless Mobile Networks, Ubiquitous Computing, and Dependable
Applications (JoWUA), Vol. 12, No. 3, pp. 87-115,
Sept. 2021 [pdf] Received: January 4, 2021; Accepted: May
3, 2021; Published: September 30, 2021 DOI: 10.22667/JOWUA.2021.09.30.087 |