<![CDATA[The increasing incidence of cyberbullying on online communication platforms presents significant challenges for digital forensic investigations, particularly when perpetrators delete all message histories. Telegram Web, a browser-based messaging platform, produces volatile digital artifacts because its activity data is stored in system memory (RAM). This study aims to analyze the persistence of Telegram Web digital artifacts in volatile memory under six device condition variations using the NIST SP 800-86 framework, addressing a research gap in the quantitative evaluation of acquisition conditions for browser-based platforms. A cyberbullying simulation was conducted via Telegram private chat, generating 10 digital artifacts text messages, images, a document, and an audio file all subsequently deleted by the perpetrator. Memory acquisition was performed using Exterro FTK Imager under six conditions: immediately post-incident, sleep mode, hibernate mode, browser closed, browser closed with subsequent application use, and shutdown. Artifact identification employed keyword-based analysis on memory images. Results show that the first three conditions yielded 100% artifact recovery, as RAM preserved Chrome process data through DRAM self-refresh (ACPI S3) and byte-for-byte copying to hiberfil.sys (ACPI S4). Closing the browser reduced recovery to 40%, subsequent application use further reduced it to 10% due to zero-fill operations on reallocated memory pages, and shutdown produced 0% as all DRAM capacitor charges were lost. These findings demonstrate that artifact recovery rates are predictable from computer memory architecture, providing empirical guidance for digital forensic practitioners in web-based cybercrime cases.]]>
Copyrights © 2026
