<![CDATA[Smartphones are currently experiencing rapid development along with technological developments. The rapid development of smartphones is also followed by the increasing use of social media and instant messaging. One of the well-known instant messaging applications, namely Whatsapp, issues a notification that its user content, whether uploading, storing, receiving or sending anything on WhatsApp, the company can use, reproduce, and display or distribute it. With this notification, WhatsApp users switch to more private instant messaging, namely Telegram and Signal Messenger. This study uses the National Institute of Standards and Technology (NIST) method, namely collection, examination, analysis, presentation. This study uses two smartphones with root and non-root conditions that have installed the whatsapp, telegram, and signal messenger applications. The case used in this study is a narcotics sale and purchase transaction. Digital evidence was obtained using four forensic tools, namely MOBILedit Forensic Express, Oxygen forensics, Belkasoft Evidence, and Magnet Axiom. This study produces digital evidence in the form of chat files, images, videos, perpetrator accounts, contacts, locations and conversations that have been deleted from smartphone devices. The calculation of the index result from the percentage of evidence obtained by the WhatsApp application on a smartphone with root conditions using the forensic tool Oxygen forensic got the result, namely 50%. Telegram gets 50% results using Oxygen forensic with root conditions. While the signal gets the result, which is 30% using MOBILedit with root conditions.]]>
