IDENTIFICATION OF DIGITAL EVIDENCE FACEBOOK MESSENGER ON MOBILE PHONE WITH NATIONAL INSTITUTE OF STANDARDS TECHNOLOGY (NIST) METHOD

Facebook Messenger is a popular social media. The increasing number of Facebook Messenger users certainly has a positive and negative impact, one of the negative effects is being used for digital crime. One of the sciences to get digital evidence is to do Digital forensics. Digital forensics can be done on a smartphone used by criminals. This research will carry out as much evidence of digital crime as possible from Facebook Messenger. In this study the forensic devices, Magnet AXIOM and Oxygen Forensics Suite 2014 were used using the National Institute of Standards Technology (NIST) method. NIST has work guidelines for both policies and standards to ensure that each examiner follows the same workflow so that their work is documented and the results can be repeated and maintained. The results of the research in the Magnet AXIOM and Oxygen Forensics Suite 2014 get digital evidence in the form of accounts, conversation texts, and images. This study successfully demonstrated the results of an analysis of forensic devices and digital evidence on Facebook Messenger. The results of the performance evaluation of forensic tools in the acquisition process using AXIOM Magnets are considered the best compared to Oxygen Forensics Suite 2014.


NIST METHOD
The method used to analyze digital evidence or the stage for obtaining information from digital evidence is the NIST method.Based on Figure 2, this can be explained in the following stages of cellular Forensic Analysis [14] : Fig. 2 NIST method process • Collection is labeling, identifying, recording, and retrieving data from data sources that are relevant to the following procedures to maintain data integrity.
• Examination is the processing of data collected in forensic use in a combination of various scenarios, whether automatic or manual, and assessing and releasing data according to your needs while maintaining data integrity.
• Analysis is the analysis of examination results using justified technical methods and laws.
• Reporting is reporting the results of an analysis that includes describing the actions taken.The researcher used parameters from NIST as on Table 3 NIST lists the measurement parameters of forensic tools on two written reports entitled mobile device tool the additional parameters are more focused on the abilities of forensic tools to extract artifacts from Facebook Messenger for logical acquisition and physical acquisition [15] [16].

RESULT AND DISCUSSION
The results of the research that we did have obtained results.The process of obtaining evidence on an Android smartphone uses Axiom Magnet forensic software.Table 1          The third performs the stage analysis.
In the analysis phase using the Magnet Axiom Forensics and Oxigen Forensics Suite tools.
The results were in the form of user accounts, text conversations and images.Fig. 9 The database magnet axiom forensics.
Figure 9 shows the text and user account in the database.there is a database and threads_db2 is contained in it, in thread_db2 there is a user account and text conversation.In the picture there are five types of images, there are three pictures of drugs, one map image and one picture of a region.
The fourth performs the stage reporting.
Reporting is reporting the results of an analysis that includes describing the actions taken.

BIBLIOGRAPHY
Figure 1 is the most downloaded social

Fig. 1
Fig. 1 Graph of facebook messenger users calculations with index numbers to determine the performance of each forensic tool in accordance with the experiment results.The calculation of index number used is unweighted index [17].Information : ΣPo = The Result of Data Acquisition Tools ΣPn = The Total Number Of Parameters  = Percentage results are expected The first to do the stage collection.Collection is labeling, identifying, recording, and retrieving data from data sources that are relevant to the following procedures to maintain data integrity.Retrieving data from data sources that are relevant to the following procedures to maintain data integrity.In the collection process using Android.

Fig
Fig 4. Oxygen forensic smartphone information

Figure 4 and
Figure 4 and Table 4 explains the specifications on the Samsung Galaxy V + SM-G318HZ smartphone that are read by Oxigen Forensics Suite .

Fig. 5
Fig. 5 Stage of examination on a smartphone

Fig 6 .
Fig 6.Examination using magnet axiom forensics Figure 6 there is a display of evidence that will be examined.the picture contains text message and image data.

Fig. 7 .
Fig. 7. Dump file using a forensics magnet axiom and oxigen forensics suite

Fig. 10
Fig. 10 Conversation account results Figure 10 is the result of a conversation account on Facebook Messenger, the account named "Andria Kw and Arwana".

Fig. 13
Fig. 13 The results obtained are in the form of an image

Fig. 14
Fig. 14 The database contains accounts and text conversations Figure 14 there is a database and threads_db2 is contained in it, in thread_db2 there is a user account and text conversation.

Fig. 16
Fig. 16 Conversation results obtained Figure 16 is the result of the conversation obtained on Facebook Messenger using Oxigen Forensics Suite.

Fig. 17
Fig. 17 The results obtained are in the form of an image Figure 17 there are results of images on facebook messenger using Axiom Forensic.

Table 4 .CONCLUSION
The results of the parameter Based on the results obtained in this study the results of the comparison of Oxigen Forensics Suite tools and Axiom Magnets on Facebook Messenger using NIST method parameters have found that the Axiom Magnet has a value of 75% and Oxigen Forensics Suite of 79%.Subsequent research can add other tools to get accurate results.

Table 3 .
Nist forensic tool parameters

Table 1 .
Experiment tools