Related Experiment Video
Updated: Aug 11, 2025
07:10
Fluorescent Paper Strips for the Detection of Diesel Adulteration with Smartphone Read-out
Published on: November 9, 2018
9.5K
We are meeting on Microsoft Teams: Forensic analysis in Windows, Android, and iOS operating systems
Herschel Bowling1, Kathryn Seigfried-Spellar1, Umit Karabiyik1
1Computer and Information Technology, Purdue University, West Lafayette, Indiana, USA.
Journal of Forensic Sciences
|February 3, 2023
Summary
Digital forensic investigators can recover most Microsoft Teams data using manual methods on Windows, Android, and iOS. Automated forensic tools recover significantly less data from this popular communication platform.
Area of Science:
- Digital Forensics
- Computer Science
- Cybersecurity
Background:
- Microsoft Teams, a communication platform, saw increased usage due to COVID-19.
- Its growing user base necessitates understanding its forensic data on various operating systems.
- Limited research exists on mobile forensic data for Microsoft Teams.
Purpose of the Study:
- To analyze data stored at rest by Microsoft Teams across Windows, Android, and iOS.
- To identify and recover forensic artifacts from Microsoft Teams functionalities.
- To compare manual investigation results with automated forensic tool capabilities.
Main Methods:
- Performed basic Microsoft Teams functionalities (messaging, file sharing, video calls) in a controlled environment.
- Utilized Cellebrite UFED Physical Analyzer for mobile devices (Android, iOS).
- Employed Magnet AXIOM Examine for the Windows 10 operating system.
- Conducted both manual and automated forensic analysis.
Main Results:
- Manual investigation recovered a significant majority (77.6%) of artifacts, partially or fully.
- Automated forensic tools showed limited success, recovering only 13.8% of artifacts across all tested operating systems.
- A substantial difference was observed between manual and automated artifact recovery rates.
Conclusions:
- Manual forensic investigation is crucial for recovering Microsoft Teams artifacts across different platforms.
- Current automated tools are insufficient for comprehensive Microsoft Teams data extraction.
- Findings provide valuable insights for digital forensic investigators dealing with Microsoft Teams cases.
Related Concept Videos
01:21Sample Preparation for Analysis: Overview
286
Sample preparation is an essential step in the analytical process. It involves preparing a sample so that it can be analyzed accurately. The goal is to extract the analyte, the substance you want to measure, from the sample while removing any components that may interfere with the analysis. Sample preparation techniques vary depending on the physical state of the sample.
Bulk or large solid samples are typically reduced in size using grinding, crushing, or milling techniques to increase the...
Bulk or large solid samples are typically reduced in size using grinding, crushing, or milling techniques to increase the...
286
01:08Sample Preparation for Analysis: Advanced Techniques
410
Accurate analysis of complex samples often requires advanced preparation techniques to achieve reliable and reproducible results. Samples containing inorganic or organic materials can be challenging to dissolve or decompose effectively. Standard sample preparation methods include acid digestion, fusion, dry ashing, and wet digestion.
Acid digestion with strong acids is commonly used to dissolve inorganic materials that are insoluble (do not dissolve) in water. This method can be useful for...
Acid digestion with strong acids is commonly used to dissolve inorganic materials that are insoluble (do not dissolve) in water. This method can be useful for...
410
01:12Trial and Error and Algorithm
166
A problem-solving strategy is a plan of action used to find a solution. Different strategies have distinct action plans. Trial and error involves trying different solutions until one works. For instance, to fix a broken printer, you might check ink levels, ensure the paper tray isn't jammed, and verify the printer's connection to your laptop. This method can be time-consuming but is commonly used. Thomas Edison, for example, used trial and error to find a suitable filament for the light...
166
01:21Development of Analytical Methods
504
An analytical methodology can be divided into four sequential steps: technique, method, procedure, and protocol. A technique is a scientific principle that rationalizes a specific phenomenon through chemical measurements. Adapting a technique for analyzing a sample of interest is termed a method. The procedure outlines the directions for performing the analysis via an analytical method. The protocol is the detailed guidelines on the procedure, which should be strictly followed to obtain the...
504
01:13Mass Analyzers: Overview
765
The mass analyzer is a crucial component of the mass spectrometer. In the ionization chamber, the vaporized sample is bombarded with a high-energy electron beam to generate a radical cation and further fragment into neutral molecules, radicals, and cations. A series of negatively charged accelerator plates accelerate the cations into the mass analyzer. The mass analyzer separates ions according to their mass-to-charge (m/z) ratios and then directs them to the detector. The common types of mass...
765