Forensic Timeline Extraction of Android Viber Calls

Viber is a messaging and voice/video calling application that may be involved in digital forensic investigations. However, popular forensic timeline tools such as Plaso do not natively support extracting call history from Viber’s internal databases. This paper presents the development of a custom Plaso parser plugin for Viber call artifacts from Android devices. The plugin enables the extraction of metadata from the SQLite database “viber_data”, parsing call timestamps, numbers, types, durations, and translating them into timeline events. The experiments show that the proposed extension supports a more comprehensive forensic timeline analysis and was tested using forensic images from Digital Corpora, a repository of public digital forensic datasets.