Abstract

MMORPGs are a combination of RPGs and MMOGs in which millions of players worldwide play simultaneously. MMORPG is the most popular genre of gaming among millions of people. Many crimes are taking place due to MMORPGs such as homicides, sexual offences, theft, fraud, hacking etc. A study was conducted in order to detect information which is left by the MMORPGs in computer systems, which can also be used as corroborating evidence or real evidence connecting the suspect to the crime in cybercrime investigations. Eight games were selected (4 browser based, 4 client based) as samples, downloaded, installed and certain number of sessions were played. The hard disk which contained the sample was analyzed using Access Data’s FTK Imager for game information and chat histories. The client based games were uninstalled and analyzed as well. We found that browser based MMORPGs did not leave any traces of chat history but it had traces of important information such as URLs and timestamps. Client based MMORPGs left a lot of vital information as well as chat history. After uninstallation, the client based MMORPGs had yielded the same data as before uninstallation, but as deleted files. Thus, from this study we could prove that MMORPGs data can be detected and obtained from suspect hard disks and also can be used as corroborating evidence or real digital evidence which links the suspect directly to the crime in cybercrime investigations. Context: In the field of digital forensics and cybercrime, determining the information left behind by various applications is a necessity. MMORPGs are one type of such applications that require in depth analysis as to the type of information that can be retrieved from the computer system that is being used by the games. This will further help forensic examiners to proceed in the right direction and create a protocol for analysis of such games. Aim: To determine the information that can be retrieved from MMORPGs in a computer system. Settings and Design: Experimental study conducted on a system with eight MMORPGs. The games were used and various activities including chatting was conducted on it and then information was searched for in the computer system. traces of important information such as URLs and time stamps. Client-based MMORPGs left a lot of vital information as well as chat history. After uninstallation, the client-based MMORPGs had yielded the same data as before uninstallation, but as deleted files. Conclusions: This study we could prove that MMORPGs data can be detected and obtained from suspect hard disks and also can be used as corroborating evidence or real digital evidence which links the suspect directly to the crime in cybercrime investigations

• 1.   Lars Daniel, Larry Daniel, (October 2011), Digital Forensics for Legal Professionals, Elsevier Science, Syngress.
• 2.   Leigh Achterbosch, Robyn Pierce, Gregory Simmons, (March 2008), “Massively Multiplayer Online RolePlaying Games: The Past, Present, and Future”, ACM Computers in Entertainment, Vol. 5, No. 4, Article 9.
• 3.   Ying-Chieh Chen, Patrick S. Chen, Jing-Jang Hwang, Ronggong Song, Larry Korba, George Yee, (2005) ,“An analysis of online gaming crime characteristics”, Emerald Internet Research, Vol. 15 No. 3, Emerald Group Publishing Limited.
• 4.   Madihah Mohd. Saudi, (2001), An overview of disk imaging tool in computer forensics, SANS Institute.
• 5.   Mirko Suznjevic, Ognjen Dobrijevic, Maja Matijasevic, (2009), “Hack, Slash, and Chat: A study of players’ behaviour and communication in MMORPGs”, research project 036-0362027-1639, Ministry of Science, Republic of Croatia.
• 6.   Jason Moore, Ibrahim Baggili, Andrew Marrington, Armindo Rodrigues, (2013), “Preliminary forensic analysis of the Xbox One”, Digital Investigation, The International Journal of Digital Forensics & Incident Response, Vol. 10, Issue 4, Elsevier.
• 7.   News articles of online games tracking by intelligence agencies for terrorist clues. http://www.computer world.com/article/2486632/cyberwarfare/the-nsatracks-world-of-warcraft-and-other-online-gamesfor-terrorist-clues.html.

Data Sharing Statement

Funding