Forensic Analysis of Microsoft Teams: Investigating Memory, Disk and Network
7th EAI International Conference on Science and Technologies for Smart Cities, SmartCity360° 2021
; 442 LNICST:583-601, 2022.
Article
in English
| Scopus | ID: covidwho-1930338
ABSTRACT
Videoconferencing applications have seen a jump in their userbase owing to the COVID-19 pandemic. The security of these applications has certainly been a hot topic since millions of VoIP users’ data is involved. However, research pertaining to VoIP forensics is still limited to Skype and Zoom. This paper presents a detailed forensic analysis of Microsoft Teams, one of the top 3 videoconferencing applications, in the areas of memory, disk-space and network forensics. Extracted artifacts include critical user data, such as emails, user account information, profile photos, exchanged (including deleted) messages, exchanged text/media files, timestamps and Advanced Encryption Standard encryption keys. The encrypted network traffic is investigated to reconstruct client-server connections involved in a Microsoft Teams meeting with IP addresses, timestamps and digital certificates. The conducted analysis demonstrates that, with strong security mechanisms in place, user data can still be extracted from a client’s desktop. The artifacts also serve as digital evidence in the court of Law, in addition to providing forensic analysts a reference for cases involving Microsoft Teams. © 2022, ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering.
Artifacts; Digital forensics; Memory forensics; Microsoft Teams; Network forensics; Videoconferencing; VoIP; Cryptography; Data mining; Internet telephony; Video conferencing; Voice/data communication systems; Artifact; Forensic analysis; MicroSoft; Microsoft team; Time-stamp; User data; Videoconferencing applications
Full text:
Available
Collection:
Databases of international organizations
Database:
Scopus
Language:
English
Journal:
7th EAI International Conference on Science and Technologies for Smart Cities, SmartCity360° 2021
Year:
2022
Document Type:
Article
Similar
MEDLINE
...
LILACS
LIS