Analysis of Digital Forensics Artifacts Based on Deletion Methods in Mobile Wiping Applications

Personal information is a valuable resource for identifying individuals and, holds significant value. To protect this information, there is increasing interest among users in the complete deletion of data. However, despite being an important measure for protecting personal information, complete data deletion may be perceived as an anti-forensic measure. This paper provides an analysis of artifacts related to the use of mobile wiping applications from a digital forensic perspective, and this findings can contribute to the development of techniques for detecting applications. To this end, three mobile wiping applications that support standard data deletion techniques were analyzed by deleting camera, screenshots, download images. Then, we analyzed the residual traces left after deletion, the traces of the deletion techniques used, and whether the data was completely deleted according to the deletion techniques. The results showed that while all three applications performed deletion at the original location of the data, some data remained in other locations, indicating that the data was not completely erased. Additionally, it was found that the deletion of cache data varied between applications, traces and related artifacts of the deletion techniques used were left behind. The paper also discusses how analysis results can be applied in digital forensic investigations.