Digital Artifact Analysis on Windows Subsystem for Android (WSA) based on ISO/IEC 27037:2012 and ISO/IEC 27042:2015

This study explores the characteristics of digital artifacts generated by the Windows Subsystem for Android (WSA) on the Windows 11 operating system. Utilizing ISO/IEC 27037:2012 and ISO/IEC 27042:2015 standards, the research encompasses the identification, collection, acquisition, preservation, analysis, interpretation, and reporting of digital artifacts found. The research methodology involves scenarios including the installation of WSA, usage of Android applications, and uninstallation of WSA to observe changes in the host system. The results indicate that the installation and usage of WSA produce various digital artifacts such as activity logs, application data files, and application usage metadata. The application of ISO/IEC digital forensic standards has proven effective in maintaining data integrity and authenticity during the investigation process. These findings can support similar digital forensic investigations in the future.