Forensic analysis for multi-platform Cisco Webex

As contactless work has become more popular, the use of video conferencing and collaboration applications has increased. These applications provide versions for each platform in order to enable communications using various OS and devices. In order to provide a continuous workflow when switching between devices, data is stored on the cloud and then synchronized. Therefore, methods for extracting and analyzing data from various platforms and collecting data stored in the cloud must be preceded for digital forensic investigation. We present the data analysis results of Cisco's Webex, a popular video conferencing and collaboration application, in Windows, macOS, iOS, and Android environments. Webex uses the data protection API provided by each OS to encrypt user data. We propose a method to unprotect data protected by the data protection API as well as a method to decrypt encrypted Webex user data. The decrypted data contained most of the user's data, and we analyze it to propose a method to recover deleted messages. We also propose a method to acquire cloud data by utilizing the decrypted data to migrate credential data stored on a device. The proposed method decrypts encrypted data on any platform and allows login via credentials.