关键词: 电子数据鉴定, 即时通讯记录鉴定, 真实性分析

Abstract: Objective Instant messaging applications provide convenient services, such as WeChat, QQ, and DingTalk, but their nature also made them a potential target by cyber criminals to conduct malicious activities. As a result, instant messaging records have become an important source of evidence in cyber investigation cases. However, research on the authenticity of instant messaging applications records is relatively scarce, which may make them lose credibility. Therefore, a method for the analysis of the authenticity of android instant messaging applications records is quite essential. Methods In combined with forensic practice, we performed a more in-depth analysis of the storage structure of instant communication records, such as the storage paths and formats of text messages, images, videos, and other data types in the device, to reveal their internal data management and storage mechanisms. Meanwhile, the authenticity of instant communication records was further explored in terms of data characteristics such as timestamps, contents of sent/received messages, and logical rationality. Results Through the study of authenticity forensics cases of Android instant messaging records, the method explored in this paper can effectively identify the tampering traces that exist in instant messaging records. Conclusion The research of related authentication techniques has theoretical research significance and practical application value. The research can provide important references for researchers engaged in digital forensics.

Key words: digital forensics, instant messaging records examination, authenticity analysis