Forensics tool nabs data from Signal, Telegram, WhatsApp
University researchers have developed a new method to help forensic investigators extract data information from memory.
The tool, dubbed Retroscope, recovered data from up to the previous 11 screens displayed from up to 15 apps, with an average of five screens pulled from each.
Apps included Signal, Skype, WeChat, Gmail, Facebook, WhatsApp, and Telegram running on a Samsung S4, LG G3, and HTC One. It is a "new paradigm in smartphone forensics", according to the team of Brendan Saltaformaggio, Rohit Bhatia, Xiangyu Zhang, and Dongyan Xu of Purdue University, and Golden G. Richard III of the University of New Orleans.
