A Comparison of FTK Imager and Autopsy in Investigating Telegram Cyberbullying Using the DFRWS Framework

Abstract

This study aims to investigate cyberbullying cases on the Telegram application using the Digital Forensic Research Workshop (DFRWS) framework by comparing the performance of FTK Imager and Autopsy forensic tools. The investigation process consisted of identification, preservation, collection, examination, analysis, and presentation stages to obtain digital evidence from Android devices. The results showed that FTK Imager successfully recovered text chats, voice notes, and metadata with a 100% success rate for text-based artifacts, but failed to recover multimedia files such as photos and videos. Meanwhile, Autopsy successfully recovered chats, photos, videos, metadata, and deleted files with a 100% success rate for multimedia artifacts and deleted file recovery. Overall, FTK Imager achieved a digital evidence recovery rate of 58.3%, while Autopsy achieved 83.3%. Digital evidence integrity validation using MD5 and SHA1 hashing produced identical hash values before and after the investigation process, indicating that the integrity and authenticity of the evidence were successfully maintained. The findings demonstrate that the combined use of FTK Imager and Autopsy provides a more effective, systematic, and comprehensive digital forensic investigation process for handling cyberbullying cases on Telegram.