Forensics Analysis of Android Social Networking Application: Tencent QQ Revisited
Yufeng Gong, Ümit Karabiyik · 2024
Tencent QQ, founded in 1999, is a widely used instant messaging application globally. At its peak, it had 900 million users. Although numerous similar applications have emerged, such as WeChat, QQ continues to maintain its competitiveness in business and interest-based communities, particularly among young adults. There have been many forensic studies on QQ since 2009, focusing mainly on its memory function, instant messaging function, and computer version. However, many useful functions of mobile QQ have not been thoroughly researched. Additionally, online fraudsters, particularly scam syndicates in Southeast Asia, have exploited these opportunities. The application allows scammers to contact victims and extort property. To address this gap, this research conducted a forensic analysis of QQ's new functions on Android devices. It focused on new features including device detection, file editing and transferring, the built-in camera, shared documents, payment and service functions, message withdrawal, real-time location sharing, phone numbers, contacts, QQ group activities, chat history and its backup, QQ zone, payment, and private information preservation and protection. This research aims to assist investigators in effectively utilizing forensic techniques for QQ and its new features, to understand what evidence can be obtained and what can be recovered, thereby addressing the existing knowledge gap.