Extracting Artifact Data from Zoom

Magnet Forensics Axiom is a forensics tool which can be used to collect and analyze data from computers and smartphones. Chat messages and web browsing history can be pulled from iPhones and Androids, and data can be recovered from apps like SnapChat.

It also can collect artifact data from Zoom software installed on a Windows PC, or mobile phones. The artifact data differs from the actual user added content in that rather than being content the user intentionally creates and views, it is the data that is left behind from the use of the application.

With the login info for the system Zoom was installed on, Axiom can decrypt artifact data to thread chat messages together.

The artifact data can serve as a record showing who exchanged messages and when they were exchanged.

deleted iMessages aren’t gone

Make note of the fact that even after a text message is deleted on an iPhone it is still temporarily stored on the device. An iPhone uses a database to track texts. A text the user deletes will be checked off as such in the database. The message is removed from the device later. Deleted messages are purged as necessary to in order to free up space on the phone with older messages being removed first.

It is not unusual for a message deleted more than a year earlier to be recoverable.

Different service providers will retain messages on their servers for different periods, but usually no more than two weeks.

.

Apple Watch

The data on an Apple Watch should be automatically backed up on the same iPhone the user of the Apple Watch has. When the watch is first unpaired from the smartphone, it will initially back up its data to the iPhone. A back-up of the iPhone data to iCloud will include the Apple Watch data.

The Apple Watch back-up will include app specific data (including data from Maps); general system settings; and health and fitness data.

The Apple Watch synch will not include:

1. credit card information used for Apple Pay

2. text messages

3. the passcode for the device.