Conspiracy communication reconstitution from distributed instant messages timeline

In a cyber attack, several kinds of evidence must be verified to find the responsible. Seizing cell phones became a usual procedure in investigations and digital forensics may be demanded to verify conspiracies about the committed crime. The accelerated growth of cell phones as an indispensable accessory nowadays, followed by a massive adherence to Instant Messaging (IM) applications, has changed the way mankind is interacting virtually. Although IM applications provide several benefits for real-time contact and knowledge sharing, they are also used in private communications for illicit arrangements. When several cell phones are seized in a police operation, many communications using IM may be used as evidence of the committed crime. An investigator spends many hours trying to rearrange this conversation or reading repeated information. This work presents a solution to this problem, retrieving all conversations sequentially from a set of cell phones that participate in the same WhatsApp group. The solution is illustrated with a case study that validates the model and algorithm developed for this purpose. First results pointed to 52% decreasing of investigation effort in some situations.