

Additionally, we identify anti-forensic artifacts such as deleted chat messages. We develop a memory parsing tool for Cisco WebEx based on the extracted artifacts. These include user credentials, emails, user IDs, profile photos, chat messages, shared media, meeting information including meeting passwords, contacts, Advanced Encryption Standard (AES) keys, keyword searches, timestamps, and call logs. From the extracted artifacts, it is evident that valuable user data can be retrieved from different data localities.

We focus on three digital forensic areas, namely memory, disk space, and network forensics. More precisely, we present the results of the forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications. In this contribution, we present a detailed forensic analysis of Cisco WebEx which is among the top three videoconferencing applications available today. Digital forensic analysis of videoconferencing applications has received considerable attention recently, owing to the wider adoption and diffusion of such applications following the recent COVID-19 pandemic.
