Penerapan Metode National Institute of Standards and Technology (NIST) 800-86 dalam Investigasi Forensik Digital di Aplikasi Instagram dan Telegram

As technology advances, platforms such as Instagram and Telegram, which are becoming increasingly popular, also have the potential to be misused for cybercrime, necessitating digital forensic investigations. This study applies the NIST 800-86 method as a framework in the stages of identification, acquisition, analysis, and reporting, with seven categories of evidence, namely images, chats, perpetrator accounts, account activity, captions, profile bios, and contacts. Three forensic tools were used, namely FTK Imager, Autopsy, and MOBILedit Forensic Express, which produced varying performance results. MOBILedit Forensic Express showed the highest accuracy of 53.70% with the extraction of 29 pieces of evidence covering images, accounts, activities, and contacts, but it took the longest time at 10 minutes and 45 seconds. FTK Imager achieved an accuracy of 33.33% with 18 pieces of evidence, including 4 chats and 2 account data, while Autopsy reached an accuracy of 22.22% with 12 images and the fastest time of 7 minutes and 11 seconds. In addition, testing was conducted on smartphones without rooting to compare extraction capabilities between devices. The results showed very limited capabilities, with an accuracy of only 3.7% for each tool. FTK Imager and Autopsy only managed to extract two images, while MOBILedit Forensic Express obtained information about the perpetrator's applications and accounts with a processing time of between 4 and 10 minutes. These findings confirm that the NIST 800-86 method is effective as a framework for identifying performance differences and limitations of each forensic tool, both on rooted and non-rooted devices.