Forensic Correlation of WhatsApp View-Once Video Artifacts with Device-Resident Source Media Using SQLite Metadata Analysis

Abstract

Privacy-oriented messaging features such as WhatsApp view-once media introduce significant challenges for mobile forensic investigations by limiting user-side visibility and complicating direct artifact attribution. This study presents a forensic correlation framework for linking a transmitted WhatsApp view-once video artifact with a candidate device-resident source video recovered from a Unisoc-based ZTE Z2350 smartphone following physical extraction. Direct examination of the recovered msgstore.db database enabled identification of the target message record and associated media metadata, including file attributes, logical storage paths, and a surviving thumbnail BLOB. Because platform-induced transcoding altered file size and resolution, direct hash equivalence was not feasible. Instead, correlation was established through structured comparison of duration, format consistency, temporal and chat-context relevance, and visual similarity between the recovered thumbnail and visible video frames. The results demonstrate that reliable attribution of WhatsApp view-once multimedia remains achievable with high forensic confidence despite expected media transformation during transmission. These findings highlight the evidentiary importance of relational SQLite analysis and metadata-driven attribution strategies in investigations involving privacy-preserving messaging features.