Tencent Meeting forensics based on memory reverse analysis

State of the art

Instant meeting software forensics is an important research direction in the field of digital forensics, and its popularity has been increasing in recent years. Nevertheless, due to the immediacy of such software, the real-time data generated by meetings will not be stored on the disk. Since the operation of any process needs to pass through the memory, instant information such as meeting records always leaves traces in the memory, making it necessary to extract relevant evidence from the memory (Kirmani & Banday, 2024). In this context, the memory forensics problem of Tencent Meeting, a widely used instant meeting software in China, has become a research topic worthy of in-depth investigation.

At present, the development of memory forensics technology has attracted much attention from many researchers. The study conducted by Schatz & Cohen (2017) not only demonstrates the centrality of in-memory forensics in digital investigations but also promotes the adoption of open-source tools such as Volatility and Rekall. These tools play a crucial role in dealing with memory dumps from Windows operating systems, laying the foundation for subsequent application-specific memory analysis. Van Baar, Alink & Van Ballegooij (2008) developed a method for recovering mapped files in memory and discussed the correlation of these files in forensics, which has great significance for understanding the underlying data structures in memory. Law et al. (2010) presented an index data structure for analyzing pages in multiple memory dumps to identify static and dynamic pages, providing an important idea for understanding memory structures and improving the reliability of forensic analysis.

In the field of digital forensics, especially in-memory forensics for real-time meetings, different application types and running environments pose challenges to the selection of forensics methods (Hilgert et al., 2023; Ottmann, Breitinger & Freiling, 2024). The application research of Telegram Desktop provides valuable cases for the memory analysis of various applications. By using the three-stage forensic analysis method, researchers extracted sensitive data from the Windows system, including user account information, communication records, and contacts (Fernández-Álvarez & Rodríguez, 2022). Khalid et al. (2022) analyzed the memory, disk space and network forensics of Cisco WebEx, and based on the analysis, the researchers extracted user account information, communication records, passwords, etc. (Chang et al., 2013). Nicoletti & Bernaschi (2019, 2021) investigated forensic analysis of Skype for Business and Microsoft Teams to extract information related to VoIP codecs and protocols; Mahr et al. (2021) conducted an in-depth disk space forensic analysis of Zoom. They investigated the client-side database in Zoom’s data catalog to extract trace information such as contacts, chat history, email addresses, passwords, caches, and user/device configurations. Forensic analysis of instant meeting software, such as Zoom, Microsoft Teams and GoogleMeet, does not directly involve Tencent Meeting, but the experience in extracting meeting records and communication data provides a reference for the memory forensics of Tencent Meeting (Mahr et al., 2021; Ghafarian & Keskin, 2022; Iqbal et al., 2022). The research work suggests that even in applications designed for privacy protection, it is possible to extract valuable information from memory. Also, it indicates that even if user data is deleted after the session ends, it can be still recovered from memory. Although these studies are not directly targeted at Tencent Meeting, their methodology and tool development provide a reference for the memory analysis of Tencent Meeting.

Though certain progress has been made in the field of memory forensics, there is no report on memory reverse analysis forensics for Tencent Meeting. Regarding the development of memory reverse analysis tools, there is currently a lack of tools specifically developed for Tencent Meeting. Meanwhile, no research has been conducted on the extraction and analysis of sensitive information such as data structures, user information and communication records in the memory of Tencent Meeting. As a result, this article proposes a method for Tencent Meeting forensics based on memory reverse analysis, aiming to obtain relevant evidence during Tencent Meeting through memory file reverse analysis.

Tencent Meeting

Tencent Meeting is a cloud-based video conferencing product that exploits Tencent’s extensive experience in audio and video communication. It provides high-definition, smooth, and reliable performance, making it easy to use and suitable for various meeting scenarios. With Tencent Meeting, users can conduct remote audio and video conferences, collaborate online, manage and control meetings, record sessions, send specific invitations, and arrange layouts. For offline office environments, Tencent Meeting provides a meeting room connector that allows existing meeting room equipment to connect to cloud meetings. Additionally, Tencent Meeting has introduced a new generation of intelligent collaboration meeting rooms called Tencent Meeting Rooms, providing enterprises with more advanced and intelligent meeting room solutions.

Figure 1 illustrates the user interface of Tencent Meeting along with its various functional options:

• Join Meeting: By clicking “Join” and entering the meeting ID and your nickname, you can enter the specified meeting.

• Quick Meeting: Also known as an instant meeting, this feature allows users to initiate a meeting immediately.

• Schedule Meeting: This option enables users to schedule a formal meeting in the future by filling in the relevant information.

• Meeting List: The meeting list displays upcoming meetings that are either scheduled or favorited by the user, as well as meetings to which the user has been invited (only scheduled meetings are shown; quick meetings do not appear in the list).

• Historical Meetings: This section archives content generated from past meetings.

However, once a meeting concludes, neither the meeting records nor the messages exchanged during the communication are stored on disk. These messages can only be viewed by participants in the meeting or call, and they disappear once the meeting or call ends. Therefore, memory forensics is required for data retrieval.

Additionally, when searching for Tencent Meeting on the international internet, VooV Meeting appears. VooV Meeting is the international version of Tencent Meeting, offering similar and interoperable features. Due to the author’s lack of an international phone number, this study focuses on the Chinese version of Tencent Meeting.

Tencent Meeting metadata reverse extraction algorithm

Tencent Meeting metadata mainly refers to meeting information such as the meeting number and meeting theme. The reverse extraction algorithm of Tencent Meeting metadata mainly involves three steps: the identification of the Tencent Meeting process, the memory extraction of the Tencent Meeting process, and the extraction of Tencent Meeting metadata. The detailed process is illustrated in Fig. 3.

• Create a Windows 10 virtual machine using VMware, create a Tencent Meeting with the theme of “Memory Forensic”, and obtain the meeting number 788-357-045.

• Capture the memory image file Windows 10 x64-da1a05fb.vmem on the virtual machine during a meeting.

• Employing Volatility to analyze the memory image file, and use the pslist or psscan plugin to list the process related to Tencent Meeting.

• Extract the process number corresponding to the Tencent Meeting process, namely Process ID (PID) and its virtual address number, as shown in Fig. 4. It can be seen from the figure that in the task manager of the computer, Tencent Meeting runs in the memory under the process name “wemeetapp.exe”.

• Use the dumpfiles command of Volatility to dump the files in memory via the PID and then transfer them to the findstr command using a pipeline to filter the memory files related to the Tencent Meeting as shown in Fig. 5.

• This section introduces how to analyze the dumped memory files. There are many types of files in the dumped files, including data files (dat), virtual address control block files (vacb), and disk image files (img). The dumped files were opened one by one for analysis. It was found that the time, theme and meeting number of the Tencent Meeting were included in the dat file. The content illustrated in Fig. 6 is consistent with the actual meeting creation, which proves that the required Tencent Meeting metadata information is stored in the dat dump file.

Therefore, this article proposes a reverse extraction algorithm for Tencent Meeting metadata. Based on Volatility dumped memory files, the dat files in the dump folder are scanned and then converted into strings in the format of “2024-04-24 08: 43: 31 MemoryForensic 788-357-045”, as shown in the above figure. Then, the data is matched to finally obtain the Tencent Meeting metadata.

Tencent Meeting data flow engraving algorithm

The meeting data flow of Tencent Meeting usually refers to the various data and information flows generated, transmitted and stored in the meeting process, including the basic information of the participating users, the text and file messages sent, as well as the sending time. Some studies have been conducted studies on memory forensics and memory structure analysis (Zhang et al., 2023, 2024). This article proposes a meeting data flow engraving algorithm to obtain meeting data flow information. The proposed algorithm mainly involves three steps: reverse reconstruction of the Tencent Meeting data structure, meeting data flow matching, and meeting data flow extraction. The design process of each stage is as follows:

(1) Reverse reconstruction of the Tencent Meeting data structure

The main purpose of the reverse reconstruction of the Tencent Meeting data structure is to build the structural information of Tencent Meeting to store the data of the meeting in memory. The basic design ideas are described below:

• Employ VMware to set up Win10 virtual machines, create and participate in Tencent Meeting, and send text messages such as “how are you” and file messages such as “story for us.mp3”.

• Capture the memory image file Windows 10 x64-da1a05fb.vmem on the virtual machine.

• Manually open the obtained memory image file “Windows 10 x64-da1a05fb.vmem” using the WinHex hexadecimal editor, and reverse engineer the data structures of the text and file messages by analyzing its hexadecimal data.

• Perform reverse reconstruction of the text message structure: Search the sent text message “how are you”, and the search result is demonstrated in Fig. 7. By analyzing the hexadecimal data of the memory image using WinHex, the messages transmitted in JSON format during the meeting can be reverse-engineered. “how are you” and “text_elem_content” form a key-value pair, where “how are you” is stored in “text_elem_content”. Focusing on this key-value pair, forward analysis reveals a preceding key-value pair “elem_type”:0. After verification by multiple sets of data, although this “elem_type” has no forensic significance, it acts as verification data within the same object as the message key-value pair. Continuing with the forward analysis, “{” and “[” can be seen in the graph, indicating that some data may exist in the same object or array. Continuing with the backward analysis, “}” can be found, indicating that the above two groups of key-value pairs exist in the same object. Since there are multiple groups of objects, several groups of key-value pairs associated with the message can be found, such as \“nickname\”: \“ysl\”, \“unique_id\”: \“144115391065829678\”, etc., and this agrees with the actual situation. Finally, “]” is found, proving that multiple groups of objects are stored in the array“ message_elem_array”, i.e., in the graph stored in the same “[]”. Therefore, the array as a whole represents all the relevant information of the message, and according to its integrity, the validity of this part of the data can be determined.

• When searching for “how are you”, multiple search results can be obtained, and the validity of the search result can be determined by analyzing whether it has verification data, so the final result is obtained after filtering, as shown in Fig. 7.

• By analyzing the overall data in the above figure, it can be seen that most of the objects exist as necessary components in an array, without forensic significance, and they are only used for verification. Verification can prove that this part is indeed a real communication record rather than a forged one. Some objects within it can also help identify the record as belonging to a specific communication, preventing messages related to other meetings from confusing the results. Therefore, from the perspective of forensic analysis of other information, the text data structure of Tencent Meeting in memory with forensic significance is finally obtained and shown in Fig. 8.

• Reversely reconstruct the file message structure: Search the sent MP3 file “story for us” in the memory image file "Windows 10 x64-da1a05fb.vmem”, and the search result is presented in Fig. 9. It can be seen from the figure that the file names “story for us” and “name” form a key-value pair and are stored in the object “file_info” together with other sets of key-value pairs. Through the analysis of the surrounding data centered on the key-value pair, several groups of key-value pairs associated with the file can be found, such as \“nickname\”: \“ysl\”,\“size\”: 5368895,\“report_file_type\”: \“mp3\”, and this is consistent with the actual situation. Multiple objects are also stored in the array“ message_elem_array”, so the array as a whole represents all relevant information about the file, which is the same as the text, and through backward analysis, the array end position can be found, forming a closed loop. The validity of this part of the data can be also determined by the integrity of the array, preventing multiple invalid files from appearing during scanning.

Through the analysis of the overall data in the figure, it can be seen that most of the objects are a necessary component of an array, with no forensic significance, and they can only be used for verification. Therefore, from the perspective of forensics analysis, the finally obtained file data structure of Tencent Meeting in the memory with forensic significance is demonstrated in Fig. 10.

(2) Meeting data flow matching

Meeting data flow matching is devised to accurately identify and locate the data structures of Tencent Meeting from memory image files. To enhance search efficiency and reduce mismatching, this article adopts the Knuth-Morris-Pratt (KMP) algorithm and optimizes it to adapt to the characteristics of the Tencent Meeting data structure. The specific details are as follows (Lu, 2019):

According to the reconstructed data structure, message_elem_array is a core data structure. Other key information, such as message timestamp, user ID, meeting ID, and message content, have a close correlation to message_elem_array and are stored in this array. This intrinsic data correlation allows the algorithm to locate message_elem_array first to narrow the scope of subsequent searches, thereby achieving higher search efficiency.

When message_elem_array is matched, a second round of matching is conducted, i.e., matching the required key-value pairs according to the data structure of the text message and file message in memory. Several pieces of message_elem_array data will be matched in the first round of search. Therefore, in the second round, it needs to use validation data such as key values to filter “elem_type”:0 to exclude invalid message_elem_array data.

Using the phased string matching strategy, the algorithm can effectively match the data structure of Tencent Meeting forensics from the memory image file. By narrowing the search space and optimizing the search scope, this strategy enhances search efficiency and matching accuracy, and it has important practical application value for data extraction in memory forensics.

(3) Meeting data stream extraction

The Meeting data stream extraction stage aims to extract specific meeting data stream information precisely from the identified memory region, so a carving algorithm is proposed in this article as follows:

• Use the matching position of message_elem_array and other key data structure key-value pairs to determine the specific extraction range of each identifier.

• Based on the matching location of message_elem_array, extract the data blocks of message_client_time, nickname, unique_id, and text_elem_content.

• Analyze the message_elem_array data block to identify the start and end locations of each message. Then, for each message, extract and parse the timestamp, the nicknames and unique identifiers of the sender and receiver, and the specific message content.

• Construct a complete message object including message elements, time stamps, user information and message content, and integrate all message objects in chronological order to form the meeting process, as illustrated in Figs. 11 and 12.

• Organize the integrated meeting process into a data flow to ensure the logical sequence and data integrity, and mark key events in the data flow, such as the start of the meeting, file transfer, and important messages.

• Collate the data into formatted report outputs including key events and complete meeting flow.

After the above steps, the meeting data stream engraving algorithm can accurately extract and reconstruct the meeting data, providing a basis for further analysis and forensics.

Experimental configuration

Experimental software: Tencent Meeting 3.31.2.441

Operating system: Windows 10 Professional

Experimental tool: Vmware16, Volatility3, WinHex20

First, create a Windows 10 virtual machine with VMware, and then install and start Tencent Meetings.

When opening Tencent Meeting, we can see options such as “Start”, “Join”,“Schedule”, and “Cast screen”. The goal of this experiment is to find information about a specific meeting, including its theme, participants, and meeting content, through the method proposed in this article, so as to provide evidence for later criminal forensics. Therefore, we start and join a meeting with the theme “Memory Forensic” and send messages in the chat box for later verification. Figures 13, 14 and 15 display some scenes during the creation and operation of Tencent Meeting:

We suspend this virtual machine to obtain a memory image file. Then, we locate the .vmem image snapshot file in the virtual machine’s path, as shown in Fig. 16, for subsequent analysis of this image snapshot using tools such as Volatility.

Experimental verification

Suppose that Tencent Meeting was used to plan and execute a sophisticated online fraud case, where fraudsters used the instant messaging function of Tencent Meeting to deceive victims to invest through false identities and fake backgrounds. To conceal their criminal behavior, the fraudsters also used Tencent Meeting’s document transfer function to transmit forged investment reports and contract documents.

After the case was revealed, forensic analysts found that the data stored in Tencent’s meeting memory could be used as key evidence to uncover the criminal behavior of fraudsters. Due to the large amount of communication and file transfer conducted by fraudsters in Tencent Meeting, the memory may contain their real identity information, criminal plans, personal information of victims, as well as detailed records of fraud activities.

Therefore, forensic analysts need to perform a forensic analysis of the memory of the Tencent Meeting to obtain this key evidence. This will help determine the true identity of fraudsters, expose their criminal activities, and protect more potential victims. By conducting a forensic analysis of Tencent Meeting memory, forensic personnel are expected to reveal the criminal network of fraudsters and take appropriate legal action.

When conducting a forensic analysis of Tencent Meeting memory image, it needs to consider various conditions when Tencent Meeting is running and after it is shut down. In this experiment, the proposed inverse extraction algorithm of Tencent Meeting software metadata was employed to identify and extract the relevant information of the Tencent Meeting process “wemeetapp.exe” by using the pslist/pscan plugin of the Volatility tool.

After using the pslist/pscan plugin of the Volatility tool respectively to identify and extract the Tencent Meeting process, it can be found that Tencent Meeting running time does not lead to a significant difference, as illustrated in Fig. 4.

After the Tencent Meeting was shut down, by using the pslist/pscan plugin of the Volatility tool to identify and extract the Tencent Meeting process, it can be found that the output results of different commands are inconsistent. The comparison results are shown in Fig. 17.

After the process information was obtained, files were dumped by the process ID. After the dat file of the Tencent Meeting was dumped by PID, the theme of the past meeting was extracted from the series of files output by the Tencent Meeting process in combination with the metadata in a specific format, and the start time of the latest meeting was recorded and determined, as listed in Table 1.

After the meeting number and the topic of the meeting are obtained, it is also necessary to obtain the meeting data to provide strong evidence of digital crime. Therefore, the user behavior data was carved by the proposed meeting data stream engraving algorithm. Previous studies have known the data structure of Tencent Meeting to store various information. After the data source file was obtained, the designed engraving algorithm was employed to scan, match and extract the entire memory image file, and the user behavior data was output, as shown in Fig. 18 and Table 2.

According to the output, the same meeting identifier can confirm that the message comes from the same meeting. Even if each user has the same ID, each has his/her own user ID and can still be distinguished. The timestamp indicates the time when the message was sent. The time converted to Beijing time is consistent with the fact. The content of the message can provide important support for evidence acquisition.

For file transmission, the experiment also utilized the meeting data stream engraving algorithm to extract the user’s behavior data of file transmission, and the results are shown in Table 3.

By analyzing the output results, it can be confirmed that the content of the transmitted file is consistent with reality. In the experiment, the information communication and transmission files in the meeting were recovered through the meeting data stream engraving algorithm, which played a crucial role in obtaining the real identity information of the criminals, the crime plan, the personal information of the victims, as well as the detailed records of the fraud activities, and it also provided key evidence for the punishment of the crime.

The above experiments can demonstrate the feasibility and effectiveness of our developed Tencent Meeting forensics method based on memory reverse analysis. It not only regenerates the data transmission of Tencent Meeting but also has great significance for the forensics of instant meetings.