Abstract
Video streaming abuses range from copyright infringement and piracy to child sexual abuse and murder. This paper performs proactive forensics of Twitch video streaming activities on Android devices. We designed our experiments using a methodology based on black‐box testing principles and conducted them on Android devices using a forensic framework. The results of our experiments suggest that forensic investigators can extract evidences of streams broadcast, shared, and watched by the user, and associate them with the Twitch account of the user. We detail all the recoverable artifacts of forensic significance, provide mechanisms to extract them based on the identified anchors, and interpret their significance in forensic investigations.