Emoji: The Hidden Forensic Artifact?

No ratings

Presented at TechnoSecurity&DigitalForensics 2019 by

One of the most popular new ways people communicate in cybersapce today is via the emoji. This is particularly true in the mobile digital space. Studies have revealed that many young people communicate entirely through emoji. There is a blind spot in many of today’s digital forensic examiners who are unaware of the proliferation of emojis as passwords and file names. This blindness may lead to the examiner missing critical evidence through sheer ignorance of modern glyph communication. There are also the forensic implications of using operating systems or forensic tools which do not support the latest available emoji characters. Even if the examiner is fully apprised of emoji usage, if their forensic tools don’t support emoji decoding, this may also be crippling to an examination. Another issue regarding the use of emojis is that of the private use areas and private emojis. If suspects use these non-standard emojis, only the applications they were specifically created for may be able to decode them. This makes all an examiner’s forensic tools effectively blind to private emoji communications. This session will discuss this passive form of crypto communication which could easily be overlooked by an examiner and is easily accessible by the average user. The presenter will share: Unicode implementation in computers-and why you should care; Emoji - Unicode linkage; Forensic consequences of emoji ignorance; and How to overcome them.