Research Article
Forensic Investigations of Google Meet and Microsoft Teams – Two Popular Conferencing Tools in the Pandemic
@INPROCEEDINGS{10.1007/978-3-031-06365-7_2, author={M. A. Hannan Bin Azhar and Jake Timms and Benjamin Tilley}, title={Forensic Investigations of Google Meet and Microsoft Teams -- Two Popular Conferencing Tools in the Pandemic}, proceedings={Digital Forensics and Cyber Crime. 12th EAI International Conference, ICDF2C 2021, Virtual Event, Singapore, December 6-9, 2021, Proceedings}, proceedings_a={ICDF2C}, year={2022}, month={6}, keywords={Google Meet MS Teams Digital forensics Memory forensics Network forensics Video conferencing}, doi={10.1007/978-3-031-06365-7_2} }- M. A. Hannan Bin Azhar
Jake Timms
Benjamin Tilley
Year: 2022
Forensic Investigations of Google Meet and Microsoft Teams – Two Popular Conferencing Tools in the Pandemic
ICDF2C
Springer
DOI: 10.1007/978-3-031-06365-7_2
Abstract
The Covid-19 pandemic has created unprecedented challenges in the technology age. Previous infrequently used applications were pushed into the spotlight and had to be considered reliable by their users. Applications had to evolve to accommodate the shift in normality to an online world quickly, predominantly for businesses and educational purposes. Video conferencing tools like Zoom, Google Hangouts, Microsoft Teams, and WebEx Meetings can make communication easy, but ease of online communications could also make information easier for cybercriminals to access and to use these tools for malicious purposes. Forensic evaluation of these programs is important, as being able to easily collect evidences against the threat actors will aid investigations considerably. This paper reports how artefacts from two popular video conferencing tools, Microsoft Teams and Google Meet, could be collected and analysed in forensically sound manners. Industry standard cyber forensics tools have been reported to extract artefacts from range of sources, such as memory, network, browsers and registry. The results are intended to verify security and trustworthiness of both applications as an online conferencing tool.
