IDENTIFIKASI BUKTI DIGITAL WHATSAPP PADA SISTEM OPERASI PROPRIETARY MENGGUNAKAN LIVE FORENSICS

One form of digital crime is eliminating or deleting digital evidence. Technological advances provide direct challenges in dealing with digital crime. Electronic evidence storage media in Random Access Memory (RAM) is nothing but a target for criminals to evade the law by eliminating evidence files. One method used to identify evidence of digital crime is the (National Institute of Standards and Technology) framework. This method consists of several steps, namely: collection, acquisition, analysis and reporting. With this method, the aim of the research is to find out digital evidence that has been deleted using the FTK Imager and WinHex tools using the National Institute of Standards and Technology method. Find out the percentage of success of digital evidence using the FTK Imager and WinHex tools using the National Institute of Standards and Technology method. The process of searching for digital evidence