Forensics Analysis of Browser-Based GoToMeeting Clients: Uncovering Memory and Browser Artefacts

In this paper, we address the method through memory forensics and browser forensics of recovering and searching hidden forensic evidence in a GoToMeeting session under a web browser-based (SaaS) platform. The goal of our research is to identify potential occurrences, such as meeting records (including meeting type, time zone, and duration), user details (such as username, display name, and email), participant details (such as display name and email id, join time, etc.), chat messages, notes shared during meetings, scheduled meeting details, and the AES key used for encrypting the contents. This will be done by exploring the techniques for acquiring and analysing the memory dumps and browser forensics. Particularly, we are considering the specific challenges and issues that one has to face when carrying out the forensic inspection of SaaS applications, such as GoToMeeting. Also, the findings of this study offer valuable insights into the efficacy of memory forensics and browser forensics in retrieving evidence from web-based video conferencing programs. This information may be useful for law enforcement and cyber security professionals engaged in a digital investigation, as well as for those who are implementing efficient security measures.