Table 3.
Anti-forensic findings.
| Zoom Interface |
Chats Db |
Contact & Requests Dbs |
Cached Db |
Files in Directory |
|||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Affected Data - Device Belonging to the Contact that Got Deleted | |||||||||||||
|
Deleted Contacts |
Deleted Chats |
Chat Messages |
Emojis/ GIFs |
Exchanged Files |
Last Session |
Call History |
Contact History |
Contact History |
File History |
Chat History/ Segments |
Avatars |
Exchanged Media |
|
| bAndroid | ✓ | ✓ | ✓ | ✖/✖ | a✓/✖ | ✖ | ✖ | ✖ | ✖ | ✖ | ✓/✖ | ✖ | a✓ |
| bmacOS | ✓ | ✓ | ✖ | ✖/✖ | ✖ | ✖ | ✖ | ✖ | ✖ | ✖ | ✖/✖ | ✖ | ✖ |
| Windows | ✓ | ✖ | ✖ | ✖/✖ | ✖ | ✖ | ✖ | ✖ | ✖ | ✖ | ✖/✖ | ✖ | ✖ |
| biOS | ✓ | ✖ | ✖ | ✖/✖ | ✖ | ✖ | ✖ | ✖ | ✖ | ✖ | ✖/✖ | ✖ | ✖ |
| Affected Data - Device Belonging to the User Deleting the Contact | |||||||||||||
| Windows | ✓ | ✓ | ✓ | ✖ | a✓/✖ | ✓ | ✖ | ✖ | ✖ | ✖ | ✓/c✓ | ✖ | ✓ |
| iOS | ✓ | ✓ | ✓ | ✖ | a✓/✖ | ✓ | ✖ | ✖ | ✖ | ✖ | ✓/✖ | ✖ | ✓ |
Key: ✓: Yes Deleted ✖: Not Deleted.
a
Note: Files were deleted from one table or folder but remain in one or more tables/folder.
b
Note: The Windows VM was the one used to delete the contacts in these devices while the iOS was used to delete the Windows.
c
Note: The results in this field apply to Windows when interacting with the Android device.