
Both tools are open source under the GNU/GPLv3 license to promote their use and extensibility to applications of other instant messaging services.

Obtaining these data is of great help for a forensic analyst, since the analysis of these data can be vital to clarify the events that occurred in some type of criminal act. Bug fixes, performance improvements and all that jazz. Power saving mode turns on automatically based on battery charge. Individual autoplay settings for videos, GIFs, stickers, animated emoji and more. Adapting these tools to this application, their joint use allows obtaining forensic artifacts of interest for an investigation, such as user contacts or the content of conversations that have taken place, among others, even when the application is blocked. New switch to disable all resource-intensive processes with one click. As a case study, we focus on the Telegram application for Windows systems called Telegram Desktop. This second tool can be easily adapted and extended to provide analysis support for any instant messaging application. One of the tools is responsible for extracting the content of a process that runs on a Windows system, while the other focuses on studying the information present in the process memory of an instant messaging application. Following a three-phase forensic analysis methodology, this work has developed a forensic analysis environment for instant messaging applications composed of two tools. This type of applications generally store their data in a secure way or transmit it through encrypted channels and thus, the forensic analysis of memory takes on special relevance to analyze them.

The forensic analysis of these applications can help provide essential clues to solve or clarify a possible crime.

Instant messaging applications have become a very common way of communicating, and today there are many applications of this type.
