Blog >> IM+

Investigating IM+

22/12/2020 Tuesday

IM+ is an instant messaging and audio/video calling application as well as a social networking platform. It provides multimedia file sharing, custom notifications, user status, and easily switching between platforms. IM+ supports multiple accounts per service and available for Windows, IOS, and macOS devices.

Digital Forensics Value of IM+ Artifacts

IM+ artifacts display information about the user, their activity, shared files, and the service that has been used. From a digital forensic perspective, it can provide us with a lot of resources that can be used as critical evidence. Tracking such information is essential throughout the digital analysis process.

Location of IM+ Artifacts

IM+ artifacts are located at the following locations:

%USERPROFILE%\AppData\Local\Packages\shapegmbh.implus_[XXXXXXXXXXXXX]\Account\Accounts.dat %USERPROFILE%\AppData\Local\Packages\shapegmbh.implus_[XXXXXXXXXXXXX]\Contact\Contacts.dat %USERPROFILE%\AppData\Local\Packages\shapegmbh.implus_[XXXXXXXXXXXXX]\Conversation\Conversations.dat %USERPROFILE%\AppData\Local\Packages\shapegmbh.implus_[XXXXXXXXXXXXX]\Messages\*.dat

Structure of IM+ Artifacts

IM+ data and information are stored in .dat files. These files contain information about the user's accounts, contacts, conversations and messages.

Analyzing IM+ Artifacts with ArtiFast Windows

This section will discuss how to use ArtiFast Windows to analyze IM+ artifacts from Windows machines and what kind of digital forensics insights we can gain from the artifacts.

After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select IM+ artifacts:

Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of IM+ artifacts in ArtiFast software.

IM+ Accounts Artifact

IM+ Contacts Artifact

IM+ Conversations Artifact

IM+ Messages Artifact