Digital Forensic Analysis of a Case of Pornographic Content Dissemination on WhatsApp Using the National Institute of Standards and Technology (NIST) Method

Abstract

The dissemination of pornographic content through instant messaging applications such as WhatsApp is becoming increasingly widespread. A major obstacle to establishing legal proof in these cases is that perpetrators frequently use the "Delete for Everyone" feature to eliminate digital evidence. This study aims to apply the National Institute of Standards and Technology (NIST) method to obtain digital artifacts from messages deleted on the perpetrator's device. A simulated scenario was conducted between the victim's device (Xiaomi Redmi 10C) and the perpetrator's device (a rooted Xiaomi Redmi S2). The investigation used MOBILedit Forensic Express for physical acquisition and Belkasoft Evidence Center for data analysis. The results show that the NIST framework successfully overcame anti-forensic obstacles. The recovered digital evidence included metadata from 3 deleted text messages with logical deletion status, 3 image files containing pornographic content (.tmp/.jpeg), and 2 video files (.mp4). Cross-validation between fragments from the perpetrator's msgstore.db database and the victim's screenshots demonstrates that this method can produce legally valid and compelling electronic evidence for court proceedings.