Current technological developments make it easier for people to share information and carry out communication activities through instant messaging applications using multimedia features in the form of audio and video. Technology has been able to contribute and facilitate humans in a positive sense, but it can also be misused to carry out negative activities. In solving crime problems using instant messages, investigators need to carry out digital forensics, including on mobile devices such as smartphones. This study aims to obtain digital evidence of online drug sales scenarios via Facebook messenger and WhatsApp using four forensic tools, namely Belkasoft, Oxygen, MOBILedit, and Magnet Axiom. The National Institute of Justice (NIJ) is used as a framework with stages, namely identification, solution, testing, evaluation, and reporting of results. out of the four tools, MOBILedit cannot recover deleted audio and video while the other three tools can recover deleted audio and video.