Forensic Analysis of Tencent QQ: Investigating New Mobile Features for Evidence Collection on Android and iOS Devices

Forensic Analysis of Tencent QQ: Investigating New Mobile Features for Evidence Collection on Android and iOS Devices | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Forensic Analysis of Tencent QQ: Investigating New Mobile Features for Evidence Collection on Android and iOS Devices Yufeng Gong, Umit Karabiyik This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-6803566/v1 This work is licensed under a CC BY 4.0 License Status: Published Journal Publication published 25 Oct, 2025 Read the published version in Discover Computing → Version 1 posted 13 You are reading this latest preprint version Abstract Tencent QQ, established in 1999, ranks among the most extensively utilized instant messaging applications globally. At its peak, it attracted approximately 900 million users QQ900 . Despite the emergence of numerous similar applications such as WeChat, QQ continues to hold a strong position within business and interest-based communities, particularly appealing to young adults. Forensic examinations of QQ have been ongoing since 2009, primarily addressing its memory function, instant messaging capabilities, and desktop version. However, there is a notable lack of thorough research on the many beneficial functions of the mobile version of QQ on both Android and iOS platforms. Additionally, online fraudsters, especially scam groups in Southeast Asia, have taken advantage of the app. Inadvertently, QQ provides scammers with the means to contact victims and extort property. To bridge this knowledge gap, this study performs a forensic analysis of QQ's new features on Android and iOS. Our study covers new capabilities such as device detection, file editing and transferring, the integrated camera, document sharing, payment, and service functions, message withdrawal, real-time location sharing, phone numbers, contacts, QQ group activities, chat history with its backup, QQ zone, payment, and privacy preservation and protection measures. The objective of this research is to assist investigators by enhancing the use of forensic tools concerning QQ and its new functionalities to discern what evidence can be acquired and recovered, thereby closing the existing knowledge gap. Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Published Journal Publication published 25 Oct, 2025 Read the published version in Discover Computing → Version 1 posted Editorial decision: Revision requested 21 Jul, 2025 Reviews received at journal 12 Jul, 2025 Reviews received at journal 11 Jul, 2025 Reviews received at journal 11 Jul, 2025 Reviewers agreed at journal 04 Jul, 2025 Reviewers agreed at journal 03 Jul, 2025 Reviewers agreed at journal 03 Jul, 2025 Reviewers agreed at journal 03 Jul, 2025 Reviewers invited by journal 03 Jul, 2025 Editor invited by journal 26 Jun, 2025 Editor assigned by journal 06 Jun, 2025 Submission checks completed at journal 06 Jun, 2025 First submitted to journal 02 Jun, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-6803566","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":481249780,"identity":"eba22da5-58e0-412e-9eb1-addf9b90da9b","order_by":0,"name":"Yufeng Gong","email":"","orcid":"","institution":"Purdue University West Lafayette","correspondingAuthor":false,"prefix":"","firstName":"Yufeng","middleName":"","lastName":"Gong","suffix":""},{"id":481249781,"identity":"f1435cb2-7975-4d7c-8f32-1f870acdf023","order_by":1,"name":"Umit Karabiyik","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAqUlEQVRIiWNgGAWjYFACxgaGDyD6AIhgI05LY+MMErUwMDbzkKTF4Nrh9se2Ow7n891IPsDwoewwEVpuJzY25545bDnzRloC44xzRGtpO2xgcCPHgJm3jVgtlmAt+R+Y/xKthRFiCwMzIzFaJIFaZvaeSTeQPPPM4GDPuXTCWvhupz/48HOHtQHf8eSHD36UWRPWAgbABAAGB4hUj6RlFIyCUTAKRgFWAADHikPN8J1BbgAAAABJRU5ErkJggg==","orcid":"","institution":"Purdue University West Lafayette","correspondingAuthor":true,"prefix":"","firstName":"Umit","middleName":"","lastName":"Karabiyik","suffix":""}],"badges":[],"createdAt":"2025-06-02 15:23:18","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-6803566/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-6803566/v1","draftVersion":[],"editorialEvents":[{"content":"https://doi.org/10.1007/s10791-025-09725-9","type":"published","date":"2025-10-25T16:17:26+00:00"}],"editorialNote":"","failedWorkflow":false,"files":[{"id":94490224,"identity":"6acf063f-efdc-4ae9-82a7-e10aab9979b4","added_by":"auto","created_at":"2025-10-27 17:08:20","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1203463,"visible":true,"origin":"","legend":"","description":"","filename":"ForensicsAnalysisofAndroidandiOSSocialNetworkingApplicationTencentQQRevisited.pdf","url":"https://assets-eu.researchsquare.com/files/rs-6803566/v1_covered_24fa40f3-d29c-407e-9959-0d6761d26eb3.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Forensic Analysis of Tencent QQ: Investigating New Mobile Features for Evidence Collection on Android and iOS Devices","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":true,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"discover-computing","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"","sideBox":"Learn more about [Discover Computing](https://link.springer.com/journal/10791)","snPcode":"10791","submissionUrl":"https://submission.springernature.com/new-submission/10791/3","title":"Discover Computing","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Discover Series","inReviewEnabled":true,"inReviewRevisionsEnabled":true},"keywords":"","lastPublishedDoi":"10.21203/rs.3.rs-6803566/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-6803566/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eTencent QQ, established in 1999, ranks among the most extensively utilized instant messaging applications globally. At its peak, it attracted approximately 900 million users \u003cspan citationid=\"CR21\" class=\"CitationRef\"\u003eQQ900\u003c/span\u003e. Despite the emergence of numerous similar applications such as WeChat, QQ continues to hold a strong position within business and interest-based communities, particularly appealing to young adults. Forensic examinations of QQ have been ongoing since 2009, primarily addressing its memory function, instant messaging capabilities, and desktop version. However, there is a notable lack of thorough research on the many beneficial functions of the mobile version of QQ on both Android and iOS platforms. Additionally, online fraudsters, especially scam groups in Southeast Asia, have taken advantage of the app. Inadvertently, QQ provides scammers with the means to contact victims and extort property. To bridge this knowledge gap, this study performs a forensic analysis of QQ's new features on Android and iOS. Our study covers new capabilities such as device detection, file editing and transferring, the integrated camera, document sharing, payment, and service functions, message withdrawal, real-time location sharing, phone numbers, contacts, QQ group activities, chat history with its backup, QQ zone, payment, and privacy preservation and protection measures. The objective of this research is to assist investigators by enhancing the use of forensic tools concerning QQ and its new functionalities to discern what evidence can be acquired and recovered, thereby closing the existing knowledge gap.\u003c/p\u003e","manuscriptTitle":"Forensic Analysis of Tencent QQ: Investigating New Mobile Features for Evidence Collection on Android and iOS Devices","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-07-07 04:32:26","doi":"10.21203/rs.3.rs-6803566/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2025-07-21T05:21:43+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-07-13T01:18:27+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-07-12T01:36:38+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-07-11T10:40:44+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"35281597944817394687177988483248658119","date":"2025-07-04T09:00:32+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"105512585006075080250843540836701498440","date":"2025-07-03T18:12:01+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"190339645779385967024490184343468597037","date":"2025-07-03T11:38:26+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"2032448704343100069231553615825131912","date":"2025-07-03T10:37:50+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-07-03T09:22:57+00:00","index":"","fulltext":""},{"type":"editorInvited","content":"","date":"2025-06-26T18:08:20+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-06-06T13:16:33+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-06-06T13:15:20+00:00","index":"","fulltext":""},{"type":"submitted","content":"Discover Computing","date":"2025-06-02T15:12:53+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"discover-computing","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"","sideBox":"Learn more about [Discover Computing](https://link.springer.com/journal/10791)","snPcode":"10791","submissionUrl":"https://submission.springernature.com/new-submission/10791/3","title":"Discover Computing","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Discover Series","inReviewEnabled":true,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"22bac5f0-2c2d-4bd9-b8fd-a82c0a072fbf","owner":[],"postedDate":"July 7th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"published-in-journal","subjectAreas":[],"tags":[],"updatedAt":"2025-10-27T16:33:35+00:00","versionOfRecord":{"articleIdentity":"rs-6803566","link":"https://doi.org/10.1007/s10791-025-09725-9","journal":{"identity":"discover-computing","isVorOnly":false,"title":"Discover Computing"},"publishedOn":"2025-10-25 16:17:26","publishedOnDateReadable":"October 25th, 2025"},"versionCreatedAt":"2025-07-07 04:32:26","video":"","vorDoi":"10.1007/s10791-025-09725-9","vorDoiUrl":"https://doi.org/10.1007/s10791-025-09725-9","workflowStages":[]},"version":"v1","identity":"rs-6803566","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-6803566","identity":"rs-6803566","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}