In recent years, the increasing usage of smartphones has influenced the relevance of smartphone messenger like WhatsApp. As a consequence, the importance of the SMS as a communication service is decreasing. The messengers evolve constantly from an merely text messaging tool into an instrument used for sending media files and IP telephony. As a result, a lot of data is accumulated on the smartphone.
Making this data by a forensic examination available is worthwhile, because it could deliver important information. The purpose of this thesis is an investigation, which of the data is important for a forensic examination and which conclusions could be gathered from it. It is exposed on two exemplary cases. As a comparison to the data a classical forensic software is used to indicate the differences and the value of the messengers. For this purpose, the different access ways are indicated and the data stored in the clients is revealed. As a result of the investigation many forensic usable tracks like sending or receiving messages and their timestamps could be found on the smartphone. On top of this, a different handling of messengers extinguishing data occurs. On one hand, the messenger WhatsApp deletes backups of its data automatically, on the other hand telegram does not distinguish any data of phone numbers.