The Single-Page Application (SPA) architecture based on React, Vue, or Angular has revolutionized browser development with a dynamic user experience. However, its complexity poses challenges for forensic analysis that have not yet been maximally addressed by conventional frameworks. This research designs an open-source forensic testing framework specifically for SPAs, integrating volatile memory acquisition, client-side artifact analysis, and log correlation on APIs. This hybrid method combines live memory forensics with API transaction tracing to reconstruct user activity longitudinally. Evaluation of 15 SPAs showed that the framework successfully identified 92% of XSS and injection traces missed by traditional forensic tools, with a 40% improvement in user session reconstruction. The novelty of the research lies in the SPA-specific modules for virtual DOM extraction and state management, temporal integration using Plaso for synchronizing client-side events and server-side logs, and the adaptation of open-source forensic tools for the SPA environment. In this study, blind spots in forensic activities such as the dynamism of client-side rendering and encrypted API calls can be addressed. Case studies illustrate the effectiveness in uncovering credential hijacking in Vue.js applications. This framework provides a foundation with standards for SPA investigations that critically combine aspects of cloud, client, and API forensics.
Arif Faizal (Tue,) studied this question.
Synapse has enriched 5 closely related papers on similar clinical questions. Consider them for comparative context: