Inā makemake ʻoe e ʻike i ke ʻano o WhatsApp forensic artifacts i loaʻa ma nā ʻōnaehana hana like ʻole a ma hea e loaʻa ai lākou, a laila ʻo kēia kahi no ʻoe. ʻO kēia ʻatikala mai kahi loea ma ka Group-IB Computer Forensics Laboratory Igor Mikhailov e hoʻomaka i kahi ʻano o nā pou e pili ana i nā forensics WhatsApp a me nā ʻike e hiki ke hōʻiliʻili ʻia mai ka nānā ʻana i ka hāmeʻa.
E hoʻomaopopo koke kākou i ka mālama ʻana o nā ʻōnaehana hana like ʻole i nā ʻano mea like ʻole o WhatsApp, a inā hiki i kahi mea noiʻi ke unuhi i kekahi mau ʻano o ka ʻikepili WhatsApp mai kahi mea hoʻokahi, ʻaʻole kēia manaʻo e hiki ke kiʻi ʻia nā ʻano ʻikepili mai kahi mea ʻē aʻe. No ka laʻana, inā wehe ʻia kahi ʻōnaehana e holo ana i ka Windows OS, ʻaʻole ʻike ʻia nā kamaʻilio WhatsApp ma kāna mau disks (koe naʻe nā kope kope o nā polokalamu iOS, hiki ke loaʻa ma nā drive like). ʻO ka hopu ʻana i nā laptops a me nā polokalamu kelepona e loaʻa i kāna mau hiʻohiʻona ponoʻī. E kamaʻilio hou kākou e pili ana i kēia.
Nā mea hana WhatsApp ma ka polokalamu Android
No ka unuhi ʻana i nā mea kiʻi WhatsApp mai kahi polokalamu Android, pono e loaʻa i ka mea noiʻi nā kuleana superuser ('aʻa') ma ka hāmeʻa e hoʻokolokolo ʻia ana a i ʻole hiki iā ia ke unuhi i kahi hoʻolei hoʻomanaʻo kino o ka hāmeʻa, a i ʻole kona ʻōnaehana faila (e laʻa, me ka hoʻohana ʻana i nā haʻahaʻa polokalamu o kahi polokalamu kelepona paʻa).
Aia nā faila noi ma ka hoʻomanaʻo o ke kelepona ma ka ʻāpana i mālama ʻia ai ka ʻikepili mea hoʻohana. E like me ke kānāwai, ua kapa ʻia kēia ʻāpana 'ʻikepili hoʻohana'. Aia nā subdirectories a me nā faila papahana ma ke ala: '/data/data/com.whatsapp/'.
ʻO nā faila nui i loaʻa nā kiʻi forensic WhatsApp ma ka Android OS he waihona 'wa.db' и 'msgstore.db'.
Ma ka waihona 'wa.db' Loaʻa ka papa inoa piha o kahi mea hoʻohana WhatsApp, me ka helu kelepona, ka inoa hōʻike, nā timestamp a me nā ʻike ʻē aʻe i hāʻawi ʻia i ke kau inoa ʻana no WhatsApp. waihona 'wa.db' aia ma ke ala: '/data/data/com.whatsapp/databases/' a loaʻa iā ia ke ʻano penei:
ʻO nā papaʻaina hoihoi loa i ka waihona 'wa.db' no ka mea noiʻi:
- 'wa_contacts'
Aia kēia papa ʻaina i ka ʻike pili: WhatsApp contact id, ʻike kūlana, inoa hōʻike mea hoʻohana, timestamp, etc.Nānā papa:
Hoʻolālā papainoa kahua waiwai _id hoʻopaʻa i ka helu kaʻina (ma ka papa SQL) jid WhatsApp contact ID, i kākau ʻia ma ke ʻano <helu kelepona>@s.whatsapp.net is_whatsapp_user Aia ka '1' inā pili ka pilina me kahi mea hoʻohana WhatsApp maoli, '0' inā ʻaʻole kūlana aia ka kikokikona i hōʻike ʻia ma ke kūlana pili status_timestamp Loaʻa i kahi hōʻailona manawa ma ke ʻano Unix Epoch Time (ms). helu helu kelepona e pili ana i ka pilina raw_contact_id hoʻokaʻaʻike helu serial hōʻike_name inoa hōʻike hoʻopili phone_type ʻano kelepona phone_label lepili pili me ka helu hoʻopili unseen_msg_count ka helu o nā memo i hoʻouna ʻia e kahi mea hoʻopili akā ʻaʻole i heluhelu ʻia e ka mea i loaʻa kiʻi_ts Loaʻa i kahi hōʻailona manawa ma ke ʻano Unix Epoch Time thumb_ts Loaʻa i kahi hōʻailona manawa ma ke ʻano Unix Epoch Time photo_id_timestamp Loaʻa i kahi hōʻailona manawa ma ke ʻano Unix Epoch Time (ms). kapa inoa pili ka waiwai kahua 'display_name' no kēlā me kēia hui wa_name ʻO ka inoa hoʻopili WhatsApp (hōʻike ʻia ka inoa i hōʻike ʻia ma ka ʻaoʻao o ka pilina) inoa_ano inoa hoʻopili i hoʻohana ʻia i nā hana ʻano inoa inoa ka inoa kapakapa ma WhatsApp (hōʻike ʻia ka inoa inoa i hōʻike ʻia ma ka ʻaoʻao o ka pilina) poe ʻoihana (hōʻike ʻia ka hui i hōʻike ʻia ma ka ʻaoʻao pili) inoa inoa (Ms./Mr.; hōʻike ʻia ke poʻo inoa i hoʻonohonoho ʻia ma ka ʻaoʻao pili) hoʻopau kūpilikiʻi - 'sqlite_sequence'
Aia kēia papa ʻike i ka helu o nā mea hoʻopili; - 'android_metadata'
Aia i loko o kēia pākaukau ka ʻike e pili ana i ka ʻōlelo kūloko o WhatsApp.
Ma ka waihona 'msgstore.db' Loaʻa ka ʻike e pili ana i nā memo i hoʻouna ʻia, e like me ka helu kelepona, ke kikokikona memo, ke kūlana memo, nā timestamp, nā kikoʻī o nā faila i hoʻoili ʻia i loko o nā memo, etc. waihona 'msgstore.db' aia ma ke ala: '/data/data/com.whatsapp/databases/' a loaʻa iā ia ke ʻano penei:
ʻO nā papaʻaina hoihoi loa i ka faila 'msgstore.db' no ka mea noiʻi:
- 'sqlite_sequence'
Aia i loko o kēia pākaukau ka ʻike maʻamau e pili ana i kēia waihona, e like me ka huina o nā memo i mālama ʻia, ka huina o nā kamaʻilio, etc.Nānā papa:
- 'message_fts_content'
Loaʻa ka kikokikona o nā memo i hoʻouna ʻia.Nānā papa:
- 'mau memo'
Aia i loko o kēia pākaukau ka ʻike e like me ka helu hoʻokaʻaʻike, kikokikona memo, kūlana memo, timestamp, ʻike e pili ana i nā faila i hoʻoili ʻia i loko o nā memo.Nānā papa:
Hoʻolālā papainoa kahua waiwai _id hoʻopaʻa i ka helu kaʻina (ma ka papa SQL) key_remote_jid WhatsApp ID o ka hoa kamaʻilio kī_mai_ʻu kuhikuhi memo: '0' – komo mai, '1' – puka kī_id ʻike memo kū hoʻokahi kūlana kūlana memo: '0' - hāʻawi ʻia, '4' - kali ma ke kikowaena, '5' - loaʻa ma kahi e hele ai, '6' - mana memo, '13' - wehe ʻia ka memo e ka mea loaʻa (heluhelu) pono_paʻi Loaʻa ka waiwai '2' inā he leka hoʻolaha, inā ʻaʻole i loaʻa ka '0' ʻikepili kikokikona memo (inā ʻo ka 'media_wa_type' parameter '0') ka manawa kuhikuhi Loaʻa i kahi hōʻailona manawa ma ke ʻano Unix Epoch Time (ms), lawe ʻia ka waiwai mai ka uaki o ka mea hana media_url Loaʻa ka URL o ka faila i hoʻoili ʻia (inā ʻo '1', '2', '3' ka palena 'media_wa_type') media_mime_type ʻAno MIME o ka faila i hoʻoili ʻia (inā ua like ka ʻāpana 'media_wa_type' me '1', '2', '3') media_wa_type ʻano memo: '0' - kikokikona, '1' - faila kiʻi, '2' - waihona leo, '3' - waihona wikiō, '4' - kāleka pili, '5' - geodata media_size ka nui o ka faila i hoʻoili ʻia (inā ʻo '1', '2', '3' ka palena 'media_wa_type') inoa_palapala inoa o ka faila i hoʻoili ʻia (inā ʻo '1', '2', '3' ka palena 'media_wa_type') kapalapalapalapala Loaʻa nā huaʻōlelo 'audio', 'video' no nā waiwai pili o ka 'media_wa_type' parameter (inā ʻo ka 'media_wa_type' parameter '1', '3') media_hash base64 i hoʻopaʻa ʻia i ka hash o ka faila i hoʻouna ʻia, helu ʻia me ka HAS-256 algorithm (inā like ka 'media_wa_type' parameter me '1', '2', '3') lōʻihi_media ka lōʻihi i kekona no ka waihona media (inā ʻo 'media_wa_type' '1', '2', '3') nā kumu Loaʻa ka waiwai '2' inā he leka hoʻolaha, inā ʻaʻole i loaʻa ka '0' latitude geodata: latitu (inā ʻo ka 'media_wa_type' ka palena '5') loa geodata: longitude (inā ʻo ka 'media_wa_type' parameter '5') thumb_image ʻike lawelawe remote_resource ID mea hoʻouna (no nā kamaʻilio pūʻulu wale nō) loaʻa_timestamp ka manawa o ka loaʻa ʻana, loaʻa kahi hōʻailona manawa ma ke ʻano Unix Epoch Time (ms), lawe ʻia ka waiwai mai ka uaki o ka mea hana (inā loaʻa ka 'key_from_me' parameter '0', '-1' a i ʻole waiwai ʻē aʻe) send_timestamp ʻaʻole i hoʻohana ʻia, loaʻa pinepine ka waiwai '-1' receipt_server_timestamp ka manawa i loaʻa e ke kikowaena kikowaena, loaʻa i kahi timestamp ma Unix Epoch Time (ms) format, lawe ʻia ka waiwai mai ka uaki o ka mīkini (ke loaʻa ka 'key_from_me' parameter '1', '-1' a i ʻole waiwai ʻē aʻe. loaʻa_device_timestamp i ka manawa i loaʻa mai ai ka memo e kekahi mea kākau inoa, loaʻa kahi hōʻailona manawa ma Unix Epoch Time (ms) format, lawe ʻia ka waiwai mai ka uaki o ka hāmeʻa (ke loaʻa ka 'key_from_me' parameter '1', '-1' a i ʻole kekahi waiwai ʻē aʻe. heluhelu_device_timestamp ka manawa o ka wehe ʻana (heluhelu) i ka memo, loaʻa kahi hōʻailona manawa ma ke ʻano Unix Epoch Time (ms), lawe ʻia ka waiwai mai ka uaki o ka mīkini. playing_device_timestamp ka manawa pāʻani memo, loaʻa kahi hōʻailona manawa ma ke ʻano Unix Epoch Time (ms), lawe ʻia ka waiwai mai ka uaki. raw_data ka liʻiliʻi liʻiliʻi o ka faila i hoʻoili ʻia (inā ʻo '1' a i ʻole '3' ka palena 'media_wa_type') helu_loaa helu o ka poʻe i loaʻa (no nā leka hoʻolaha) participant_hash hoʻohana ʻia i ka hoʻouna ʻana i nā memo me geodata ʻikeʻia hoʻohana ʻole ʻia quoted_row_id ʻike ʻole ʻia, loaʻa mau ka waiwai '0' olelo_jids hoʻohana ʻole ʻia multicast_id hoʻohana ʻole ʻia hoʻopau kūpilikiʻi ʻAʻole i pau kēia papa inoa o nā kahua. No nā mana like ʻole o WhatsApp, aia paha kekahi mau kahua a i ʻole. Eia hou, aia paha nā kahua 'media_enc_hash', 'edit_version', 'id_transaction_id' a pēlā aku nō.
- 'messages_thumbnails'
Aia i loko o kēia pākaukau ka ʻike e pili ana i nā kiʻi i hoʻoili ʻia a me nā hōʻailona manawa. Ma ke kolamu 'timestamp', hōʻike ʻia ka manawa ma ke ʻano Unix Epoch Time (ms). - 'papa inoa_kamaʻilio'
Loaʻa i kēia pākaukau ka ʻike e pili ana i nā kamaʻilio.Nānā papa:
Eia kekahi, i ka nānā ʻana iā WhatsApp ma kahi polokalamu kelepona e holo ana i ka Android, pono ʻoe e hoʻolohe i nā faila aʻe:
- waihona 'msgstore.db.cryptXX' (ma kahi o XX he hoʻokahi a ʻelua paha helu mai 0 a 12, no ka laʻana, msgstore.db.crypt12). Loaʻa i kahi waihona hoʻopili ʻia o nā memo WhatsApp (file backup msgstore.db). Kōnae (mau) 'msgstore.db.cryptXX' aia ma ke ala: '/data/media/0/WhatsApp/Databases/' (kāleka SD virtual), '/mnt/sdcard/WhatsApp/Databases/ (kāleka SD kino)'.
- waihona 'kī'. Loaʻa i kahi kī cryptographic. Aia ma ke ala: '/data/data/com.whatsapp/files/'. Hoʻohana ʻia e hoʻokaʻawale i nā backup WhatsApp i hoʻopili ʻia.
- waihona 'com.whatsapp_preferences.xml'. Loaʻa ka ʻike e pili ana i kāu moʻokāki WhatsApp. Aia ka faila ma ke ala: '/data/data/com.whatsapp/shared_prefs/'.
ʻĀpana maʻiʻo waihona
<?xml version="1.0" encoding="ISO-8859-1"?> … <string name="ph">9123456789</string> (номер телефона, ассоциированный с аккаунтом WhatsApp) … <string name="version">2.17.395</string> (версия WhatsApp) … <string name="my_current_status">Hey there! I am using WhatsApp.</string> (сообщение, отображаемое в статусе аккаунта) … <string name="push_name">Alex</string> (имя владельца аккаунта) … - waihona 'registration.RegisterPhone.xml'. Loaʻa ka ʻike e pili ana i ka helu kelepona pili me ka moʻokāki WhatsApp. Aia ka faila ma ke ala: '/data/data/com.whatsapp/shared_prefs/'.
waihona waihona
<?xml version="1.0" encoding="ISO-8859-1"?> <map> <string name="com.whatsapp.registration.RegisterPhone.phone_number">9123456789</string> <int name="com.whatsapp.registration.RegisterPhone.verification_state" value="0"/> <int name="com.whatsapp.registration.RegisterPhone.country_code_position" value="-1"/> <string name="com.whatsapp.registration.RegisterPhone.input_phone_number">912 345-67-89</string> <int name="com.whatsapp.registration.RegisterPhone.phone_number_position" value="10"/> <string name="com.whatsapp.registration.RegisterPhone.input_country_code">7</string> <string name="com.whatsapp.registration.RegisterPhone.country_code">7</string> </map> - waihona 'axolotl.db'. Loaʻa nā kī cryptographic a me nā ʻikepili ʻē aʻe e pono ai e ʻike i ka mea nona ka moʻokāki. Aia ma ke ala: '/data/data/com.whatsapp/databases/'.
- waihona 'chatsettings.db'. Loaʻa ka ʻike hoʻonohonoho noi.
- waihona 'wa.db'. Loaʻa nā kikoʻī pili. He mea hoihoi loa (mai kahi ʻano forensic) a me ka ʻikepili ʻike. Hiki iā ia ke loaʻa ka ʻike kikoʻī e pili ana i nā hoʻopili i holoi ʻia.
Pono ʻoe e nānā i nā papa kuhikuhi ma lalo nei:
- papa kuhikuhi '/data/media/0/WhatsApp/Media/WhatsApp Images/'. Loaʻa i nā faila kiʻi i hoʻoili ʻia.
- papa kuhikuhi '/data/media/0/WhatsApp/Media/WhatsApp Voice Notes/'. Loaʻa nā memo leo ma nā faila .OPUS.
- papa kuhikuhi '/data/data/com.whatsapp/cache/Kiʻi Profile/'. Loaʻa nā faila kiʻi - nā kiʻi o nā pilina.
- papa kuhikuhi '/data/data/com.whatsapp/files/Avatars/'. Loaʻa nā faila kiʻi - nā kiʻi liʻiliʻi o nā mea pili. He '.j' kēia mau faila akā he mau faila kiʻi JPEG (JPG).
- papa kuhikuhi '/data/data/com.whatsapp/files/Avatars/'. Loaʻa nā faila kiʻi - he kiʻi a me ka liʻiliʻi o ke kiʻi i hoʻonohonoho ʻia ma ke ʻano he avatar e ka mea nona ka moʻokāki.
- papa kuhikuhi '/data/data/com.whatsapp/files/Logs/'. Loaʻa ka moʻolelo hana papahana (faila 'whatsapp.log') a me nā kope kope o nā moʻolelo hana papahana (nā waihona me nā inoa ma ke ʻano whatsapp-yyyy-mm-dd.1.log.gz).
Nā waihona waihona WhatsApp:
ʻāpana puke moʻolelo2017-01-10 09:37:09.757 LL_I D [524:WhatsApp Worker #1] missedcallnotification/init count:0 timestamp:0
2017-01-10 09:37:09.758 LL_I D [524:WhatsApp Worker #1] poina kelepona leka hoʻomaopopo/hōʻano hou hoʻopau ʻoiaʻiʻo
2017-01-10 09:37:09.768 LL_I D [1:main] app-init/load-me
2017-01-10 09:37:09.772 LL_I D [1:main] nalo a hiki ʻole ke heluhelu ʻia
2017-01-10 09:37:09.782 LL_I D [1:main] statistics Text Messages: 59 i hoʻouna ʻia, 82 i loaʻa / Media Messages: 1 i hoʻouna ʻia (0 bytes), 0 loaʻa (9850158 bytes) / Offline Messages: 81 loaʻa ( 19522 msec awelika lohi) / Message Service: 116075 bytes i hoʻouna ʻia, 211729 bytes i loaʻa / Voip Calls: 1 outgoing calls, 0 incoming calls, 2492 bytes i hoʻouna ʻia, 1530 bytes i loaʻa / Google Drive: 0 bytes i hoʻouna ʻia, 0 bytes i loaʻa / Roaming: nā bytes i hoʻouna ʻia, 1524 bytes i loaʻa / Huina ʻikepili: 1826 bytes i hoʻouna ʻia, 118567 bytes i loaʻa
2017-01-10 09:37:09.785 LL_I D [1:main] media-state-manager/refresh-media-state/writable-media
2017-01-10 09:37:09.806 LL_I D [1: koʻikoʻi] app-init/initialize/timer/stop: 24
2017-01-10 09:37:09.811 LL_I D [1:main] msgstore/checkhealth
2017-01-10 09:37:09.817 LL_I D [1:main] msgstore/checkhealth/journal/delete false
2017-01-10 09:37:09.818 LL_I D [1:main] msgstore/checkhealth/back/delete false
2017-01-10 09:37:09.818 LL_I D [1:main] msgstore/checkdb/data/data/com.whatsapp/databases/msgstore.db
2017-01-10 09:37:09.819 LL_I D [1: main] msgstore/checkdb/list _jobqueue-WhatsAppJobManager 16384 drw=011
2017-01-10 09:37:09.820 LL_I D [1: main] msgstore/checkdb/list _jobqueue-WhatsAppJobManager-journal 21032 drw=011
2017-01-10 09:37:09.820 LL_I D [1:main] msgstore/checkdb/list axolotl.db 184320 drw=011
2017-01-10 09:37:09.821 LL_I D [1:main] msgstore/checkdb/list axolotl.db-wal 436752 drw=011
2017-01-10 09:37:09.821 LL_I D [1:main] msgstore/checkdb/list axolotl.db-shm 32768 drw=011
2017-01-10 09:37:09.822 LL_I D [1:main] msgstore/checkdb/list msgstore.db 540672 drw=011
2017-01-10 09:37:09.823 LL_I D [1:main] msgstore/checkdb/list msgstore.db-wal 0 drw=011
2017-01-10 09:37:09.823 LL_I D [1:main] msgstore/checkdb/list msgstore.db-shm 32768 drw=011
2017-01-10 09:37:09.824 LL_I D [1:main] msgstore/checkdb/list wa.db 69632 drw=011
2017-01-10 09:37:09.825 LL_I D [1:main] msgstore/checkdb/list wa.db-wal 428512 drw=011
2017-01-10 09:37:09.825 LL_I D [1:main] msgstore/checkdb/list wa.db-shm 32768 drw=011
2017-01-10 09:37:09.826 LL_I D [1:main] msgstore/checkdb/list chatsettings.db 4096 drw=011
2017-01-10 09:37:09.826 LL_I D [1:main] msgstore/checkdb/list chatsettings.db-wal 70072 drw=011
2017-01-10 09:37:09.827 LL_I D [1:main] msgstore/checkdb/list chatsettings.db-shm 32768 drw=011
2017-01-10 09:37:09.838 LL_I D [1:main] msgstore/checkdb/version 1
2017-01-10 09:37:09.839 LL_I D [1:main] msgstore/canquery
2017-01-10 09:37:09.846 LL_I D [1:main] msgstore/canquery/count 1
2017-01-10 09:37:09.847 LL_I D [1:main] msgstore/canquery/timer/stop: 8
2017-01-10 09:37:09.847 LL_I D [1:main] msgstore/canquery 517 | manawa i hala:8
2017-01-10 09:37:09.848 LL_I D [529:WhatsApp Worker #3] media-state-manager/refresh-media-state/internal-storage loaʻa:1,345,622,016 huina:5,687,922,688
- papa kuhikuhi '/data/media/0/WhatsApp/Media/WhatsApp Audio/'. Loaʻa nā faila leo i loaʻa.
- papa kuhikuhi '/data/media/0/WhatsApp/Media/WhatsApp Audio/Sent/'. Loaʻa nā faila i hoʻouna ʻia.
- papa kuhikuhi '/data/media/0/WhatsApp/Media/WhatsApp Images/'. Loaʻa nā faila kiʻi i loaʻa.
- papa kuhikuhi '/data/media/0/WhatsApp/Media/WhatsApp Images/Hoʻouna ʻia/'. Loaʻa nā faila kiʻi i hoʻouna ʻia.
- papa kuhikuhi '/data/media/0/WhatsApp/Media/WhatsApp Video/'. Loaʻa nā faila wikiō i loaʻa.
- papa kuhikuhi '/data/media/0/WhatsApp/Media/WhatsApp Video/Hoʻouna ʻia/'. Loaʻa nā faila wikiō i hoʻouna ʻia.
- papa kuhikuhi '/data/media/0/WhatsApp/Media/WhatsApp Profile Photos/'. Loaʻa i nā faila kiʻi pili me ka mea nona ka moʻokāki WhatsApp.
- No ka mālama ʻana i kahi hoʻomanaʻo ma kāu kelepona Android, hiki ke mālama ʻia kekahi ʻikepili WhatsApp ma kahi kāleka SD. Ma ke kāleka SD, ma ka papa kuhikuhi kumu, aia kahi papa kuhikuhi 'WhatsApp', kahi e ʻike ʻia ai nā mea waiwai o kēia papahana:
- papa kuhikuhi '.Kaʻana like' ('/mnt/sdcard/WhatsApp/.Share/'). Loaʻa i nā kope o nā faila i kaʻana like me nā mea hoʻohana ʻē aʻe WhatsApp.
- papa kuhikuhi '.'ōpala' ('/mnt/sdcard/WhatsApp/.trash/'). Loaʻa nā faila i holoi ʻia.
- papa kuhikuhi 'Ikepili' ('/mnt/sdcard/WhatsApp/Databases/'). Loaʻa nā waihona i hoʻopili ʻia. Hiki iā lākou ke decrypted inā aia ka faila 'kī', unuhi ʻia mai ka hoʻomanaʻo ʻana o ka mea i kālailai ʻia.
Aia nā faila ma kahi papa kuhikuhi 'Ikepili':
- papa kuhikuhi 'Hapa' ('/mnt/sdcard/WhatsApp/Media/'). Loaʻa nā subdirectories 'WallPaper', 'WhatsApp Audio', 'Kiʻi WhatsApp', 'Kiʻi kiʻi moʻolelo WhatsApp', 'WhatsApp Video', 'WhatsApp Voice Notes', ka mea i loaʻa a hoʻouna ʻia nā faila multimedia (nā faila kiʻi, nā faila wikiō, nā memo leo, nā kiʻi pili i ka ʻaoʻao o ka mea nona ka moʻokāki WhatsApp, nā wallpaper).
- papa kuhikuhi 'Kiʻi Paʻi' ('/mnt/sdcard/WhatsApp/Kiʻi Profile/'). Loaʻa nā faila kiʻi e pili ana i ka ʻaoʻao o ka mea nona ka moʻokāki WhatsApp.
- I kekahi manawa aia paha kahi papa kuhikuhi ma ke kāleka SD 'faila' ('/mnt/sdcard/WhatsApp/Files/'). Aia kēia papa kuhikuhi i nā faila e mālama i nā hoʻonohonoho papahana a me nā makemake o ka mea hoʻohana.
Nā hiʻohiʻona o ka mālama ʻikepili i kekahi mau hiʻohiʻona o nā polokalamu kelepona
Hiki i kekahi mau hiʻohiʻona o nā polokalamu kelepona e holo ana i ka Android OS ke mālama i nā kiʻi kiʻi WhatsApp ma kahi ʻokoʻa. Loaʻa kēia ma muli o nā hoʻololi i ka waiho ʻana o ka ʻikepili noi e ka polokalamu ʻōnaehana o ka polokalamu kelepona. No ka laʻana, loaʻa i nā polokalamu kelepona Xiaomi kahi hana no ka hana ʻana i kahi lua hana ("SecondSpace"). Ke ho'ā 'ia kēia hana, ho'ololi ka wahi o ka 'ikepili. No laila, inā i loko o kahi polokalamu kelepona maʻamau e holo ana i ka ʻikepili mea hoʻohana Android OS e mālama ʻia i ka papa kuhikuhi '/ʻikepili/mea hoʻohana/0/' (ʻo ia kahi kuhikuhi i ka mea maʻamau '/ʻikepili/ʻikepili/'), a laila mālama ʻia ka ʻikepili noi hana lua ma ka papa kuhikuhi '/ʻikepili/mea hoʻohana/10/'. ʻO ia hoʻi, me ka hoʻohana ʻana i ka laʻana o kahi faila 'wa.db':
- i ke kelepona hele maʻamau e holo ana i ka Android OS: /data/user/0/com.whatsapp/databases/wa.db' (ʻo ia ka mea like '/data/data/com.whatsapp/databases/wa.db');
- i ka lua o ka hana o ke kelepona Xiaomi: '/data/user/10/com.whatsapp/databases/wa.db'.
Nā kiʻi kiʻi WhatsApp ma ka polokalamu iOS
ʻAʻole like me Android OS, i loko o iOS WhatsApp noi ʻia ka ʻikepili i kahi kope kope (iTunes backup). No laila, ʻo ka unuhi ʻana i ka ʻikepili mai kēia noi ʻaʻole pono e unuhi i ka ʻōnaehana faila a i ʻole ka hana ʻana i kahi hoʻomanaʻo hoʻomanaʻo kino o ka hāmeʻa e hoʻokolokolo ʻia nei. Aia ka hapa nui o nā ʻike pili i ka waihona 'ChatStorage.sqlite', aia ma ke ala: '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/' (ma kekahi mau papahana e ʻike ʻia kēia ala e like me 'AppDomainGroup-group.net.whatsapp.WhatsApp.shared').
'ole 'ChatStorage.sqlite':
ʻO nā papa ʻike nui loa ma ka waihona 'ChatStorage.sqlite' 'ZWAMESSAGE' и 'ZWAMEDIAIITEM'.
Nānā papa 'ZWAMESSAGE':
ʻO ke ʻano o ka pākaukau 'ZWAMESSAGE'
| inoa kahua | waiwai |
|---|---|
| Z_PK | hoʻopaʻa i ka helu kaʻina (ma ka papa SQL) |
| Z_ENT | ʻike papa, loaʻa ka waiwai '9' |
| Z_OPT | ʻike ʻole ʻia, loaʻa nā waiwai mai '1' a i '6' |
| ZCHILDMESSAGESDELIVEREDCOUNT | ʻike ʻole ʻia, loaʻa mau ka waiwai '0' |
| ZCHILDMESSAGESPLAYEDCOUNT | ʻike ʻole ʻia, loaʻa mau ka waiwai '0' |
| ZCHILDMESSAGESREADCOUNT | ʻike ʻole ʻia, loaʻa mau ka waiwai '0' |
| ZDATAITEMVERSION | ʻike ʻole ʻia, loaʻa ka waiwai '3', he hōʻailona memo paha |
| ZDOCID | ʻikeʻole |
| ZENCRETRYCOUNT | ʻike ʻole ʻia, loaʻa mau ka waiwai '0' |
| ZFILTEREDRECIPIENTCOUNT | ʻike ʻole ʻia, loaʻa nā waiwai '0', '2', '256' |
| ZISFROMME | kuhikuhi memo: '0' – komo mai, '1' – puka |
| ZMESSAGEERRORSATUS | kūlana hoʻouna ʻōlelo. Inā hoʻouna ʻia / loaʻa ka memo, loaʻa iā ia ka waiwai '0' |
| ZMESSAGETYPE | ʻano memo e hoʻouna ʻia ana |
| ZSORT | ʻikeʻole |
| ZSPOTLIGHSTATUS | ʻikeʻole |
| ZSTARRED | ʻike ʻole, hoʻohana ʻole ʻia |
| ZCHATSESSION | ʻikeʻole |
| ZGROUPMEMBER | ʻike ʻole, hoʻohana ʻole ʻia |
| HOOLAHA | ʻikeʻole |
| ZMEDIAIITEM | ʻikeʻole |
| ZMESSAGEINFO | ʻikeʻole |
| ZPARENTMESSAGE | ʻike ʻole, hoʻohana ʻole ʻia |
| ZMESSAGEDATE | hōʻailona manawa ma ke ʻano o ka OS X Epoch Time |
| ZSENTDATE | ka manawa i hoʻouna ʻia ai ka memo ma ke ʻano o ka OS X Epoch Time |
| ZFROMJID | WhatsApp Sender ID |
| ZMEDIASECTIONID | Aia ka makahiki a me ka mahina i hoʻouna ʻia ai ka faila media |
| ZPHASH | ʻike ʻole, hoʻohana ʻole ʻia |
| ZPUSHPAME | inoa o ka mea hoʻokaʻaʻike nāna i hoʻouna i ka faila media ma ke ʻano UTF-8 |
| ZSTANZID | ʻike memo kū hoʻokahi |
| ZTEXT | kikokikona memo |
| ZTOJID | ʻO WhatsApp ID o ka mea loaʻa |
| KAHELE | kūpilikiʻi |
Nānā papa 'ZWAMEDIAIITEM':
ʻO ke ʻano o ka pākaukau 'ZWAMEDIAITEM'
| inoa kahua | waiwai |
|---|---|
| Z_PK | hoʻopaʻa i ka helu kaʻina (ma ka papa SQL) |
| Z_ENT | ʻike papa, loaʻa ka waiwai '8' |
| Z_OPT | ʻike ʻole, loaʻa nā waiwai mai '1' a i '3'. |
| ZCLOUDSTATUS | Aia ka waiwai '4' inā hoʻouka ʻia ka faila. |
| ZFILESIZE | Loaʻa ka lōʻihi o ka faila (ma nā bytes) no nā faila i hoʻoiho ʻia |
| ZMEDIAORIGIN | ʻike ʻole ʻia, loaʻa ka waiwai '0' |
| ZMOVIEDURATION | ka lōʻihi o ka waihona media, no nā faila pdf hiki ke loaʻa ka helu o nā ʻaoʻao o ka palapala |
| ZMESSAGE | Loaʻa i kahi helu serial (ʻokoʻa ka helu mai ka helu i hōʻike ʻia ma ke kolamu 'Z_PK') |
| ZASPECTRATIO | lākiō hiʻohiʻona, ʻaʻole i hoʻohana ʻia, hoʻonohonoho maʻamau i '0' |
| ZHACCURACY | ʻike ʻole ʻia, loaʻa ka waiwai '0' |
| ZLATTITUDE | laula ma nā pika |
| ZLONGTITUDE | kiʻekiʻe i nā pika |
| ZMEDIAURLDATE | hōʻailona manawa ma ke ʻano o ka OS X Epoch Time |
| ZAUTHORNAME | mea kākau (no nā palapala, aia paha ka inoa faila) |
| ZCOLLECTIONNAME | hoʻohana ʻole ʻia |
| ZMEDIALOCALPATH | inoa faila (me ke ala) ma ka ʻōnaehana waihona |
| ZMEDIAURL | ʻO ka URL kahi i loaʻa ai ka faila media. Inā ua hoʻoili ʻia kahi faila mai kahi mea kākau inoa i kekahi, ua hoʻopili ʻia a hōʻike ʻia kona hoʻonui ʻia ma ke ʻano he hoʻonui o ka faila i hoʻoili ʻia - .enc |
| ZTHUMBNAILLOCALPATH | ala i ka liʻiliʻi liʻiliʻi waihona ma ka ʻōnaehana faila |
| ZTITLE | poʻomanaʻo waihona |
| ZVCARDNAME | media file hash; i ka wā e hoʻoneʻe ai i kahi faila i kahi hui, aia paha ka mea hoʻouna |
| ZVCARDSTRING | Loaʻa ka ʻike e pili ana i ke ʻano o ka faila e hoʻoili ʻia (e laʻana, kiʻi/jpeg); i ka wā e hoʻoili ai i kahi faila i kahi hui, aia paha ka ʻike o ka mea loaʻa. |
| ZXMPPTHUMBPATH | ala i ka liʻiliʻi liʻiliʻi waihona ma ka ʻōnaehana faila |
| ZMEDIAKEY | ʻike ʻole, aia paha ke kī e wehe i ka faila i hoʻopili ʻia. |
| ZMETADATA | metadata o ka memo i hooiliia |
| Ka hewa | kūpilikiʻi |
Nā papa ʻikepili hoihoi ʻē aʻe 'ChatStorage.sqlite' i:
- 'ZWAPROFILEPUSHNAME'. Hoʻopili i ka WhatsApp ID me ka inoa pili;
- 'ZWAPROFILEPICTUREITEM'. Hoʻohālikelike i ka WhatsApp ID me ka avatar contact;
- 'Z_PRIMARYKEY'. Aia i ka papa ʻaina ka ʻike maʻamau e pili ana i kēia waihona, e like me ka huina o nā memo i mālama ʻia, ka huina o nā kamaʻilio, etc.
Eia kekahi, i ka nānā ʻana iā WhatsApp ma kahi polokalamu kelepona e holo ana iā iOS, pono ʻoe e hoʻolohe i nā faila aʻe:
- waihona 'BackedUpKeyValue.sqlite'. Loaʻa nā kī cryptographic a me nā ʻikepili ʻē aʻe e pono ai e ʻike i ka mea nona ka moʻokāki. Aia ma ke ala: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- waihona 'ContactsV2.sqlite'. Loaʻa ka ʻike e pili ana i nā pilina o ka mea hoʻohana, e like me ka inoa piha, ka helu kelepona, ke kūlana hoʻopili (ma ke ʻano kikokikona), WhatsApp ID, etc. Aia ma ke ala: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- waihona 'mea ho'ohana_version'. Loaʻa ka helu mana o ka noi WhatsApp i kau ʻia. Aia ma ke ala: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- waihona 'current_wallpaper.jpg'. Loaʻa i ka wallpaper kāʻei kua WhatsApp o kēia manawa. Aia ma ke ala: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/. Hoʻohana nā mana kahiko o ka polokalamu i ka faila 'pepa pepa', aia ma ke ala: '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/'.
- waihona 'blockedcontacts.dat'. Loaʻa i ka ʻike e pili ana i nā pilina paʻa. Aia ma ke ala: /private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/.
- waihona 'pw.dat'. Loaʻa i kahi ʻōlelo huna i hoʻopili ʻia. Aia ma ke ala: '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/'.
- waihona 'net.whatsapp.WhatsApp.plist' (a i ʻole faila 'group.net.whatsapp.WhatsApp.shared.plist'). Loaʻa ka ʻike e pili ana i kāu moʻokāki WhatsApp. Aia ka faila ma ke ala: '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Library/Preferences/'.
Ma loko o ka waihona 'group.net.whatsapp.WhatsApp.shared.plist'
Pono ʻoe e nānā i nā papa kuhikuhi ma lalo nei:
- papa kuhikuhi '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Media/Profile/'. Loaʻa nā liʻiliʻi liʻiliʻi o nā pilina, nā hui (nā faila me ka hoʻonui .kelu), hoʻokaʻaʻike avatar, WhatsApp nona ka moʻokāki avatar (file 'Photo.jpg').
- papa kuhikuhi '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Message/Media/'. Loaʻa nā faila multimedia a me kā lākou mau kiʻi liʻiliʻi
- papa kuhikuhi '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/'. Loaʻa iā ia ka log hana o ka papahana (file 'calls.log') a me nā kope kope o nā papa hana papahana (file 'calls.backup.log').
- papa kuhikuhi '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/stickers/'. Loaʻa i nā stickers (nā faila ma ke ʻano '.webp').
- papa kuhikuhi '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/Logs/'. Loaʻa nā moʻolelo hana papahana.
Nā mea hana WhatsApp ma Windows
Hiki ke loaʻa nā mea kiʻi WhatsApp ma Windows ma nā wahi he nui. ʻO ka mea mua, ʻo ia nā papa kuhikuhi i loaʻa nā faila papahana a me nā mea kōkua (no Windows 8/10):
- 'C: Nā Kōnae Papahana (x86) WhatsApp'
- 'C:Users%User profile% AppDataLocalWhatsApp'
- 'C:Users%User profile% AppDataLocalVirtualStore Program Files (x86)WhatsApp'
Ma ka papa helu 'C:Users%User profile% AppDataLocalWhatsApp' aia ka waihona log 'SquirrelSetup.log', aia ka ʻike e pili ana i ka nānā ʻana i nā mea hou a me ka hoʻokomo ʻana i ka polokalamu.
Ma ka papa helu 'C: Nā mea hoʻohana% moʻolelo mea hoʻohana% AppDataRoamingWhatsApp' Aia kekahi mau subdirectories:
waihona 'main-process.log' aia ka ʻike e pili ana i ka hana ʻana o ka polokalamu WhatsApp.
Papa kuhikuhi 'ikepili waihona' he waihona 'Databases.db', akā ʻaʻole i loaʻa i kēia faila kekahi ʻike e pili ana i nā kamaʻilio a i ʻole nā pilina.
ʻO ka mea hoihoi loa mai kahi ʻike forensic ʻo nā faila i loaʻa i ka papa kuhikuhi 'Cache'. He mau faila kēia i kapa ʻia 'f_*******' (ma kahi o * he helu mai 0 a 9) loaʻa nā faila multimedia i hoʻopili ʻia a me nā palapala, akā aia kekahi mau faila i hoʻopili ʻole ʻia ma waena o lākou. ʻO ka hoihoi nui nā faila 'ikepili_0', 'ikepili_1', 'ikepili_2', 'ikepili_3', aia ma ka papa kuhikuhi like. Nā waihona 'ikepili_0', 'ikepili_1', 'ikepili_3' Loaʻa nā loulou waho i nā faila multimedia i hoʻopili ʻia a me nā palapala.
Laʻana o ka ʻike i loko o ka waihona 'data_1'
Also waihona 'ikepili_3' hiki ke loaʻa nā faila kiʻi.
waihona 'ikepili_2' loaʻa nā avatar pili (hiki ke hoʻihoʻi ʻia ma ka ʻimi ʻana e nā poʻomanaʻo faila).
Aia nā Avatar i loko o ka faila 'ikepili_2':
No laila, ʻaʻole hiki ke loaʻa nā kamaʻilio iā lākou iho i ka hoʻomanaʻo o ka kamepiula, akā hiki iā ʻoe ke loaʻa:
- waihona multimedia;
- nā palapala i hoʻouna ʻia ma o WhatsApp;
- ʻike e pili ana i nā pilina o ka mea nona ka moʻokāki.
Nā mea hana WhatsApp ma MacOS
I loko o MacOS hiki iā ʻoe ke ʻike i nā ʻano o WhatsApp artifact e like me nā mea i loaʻa ma Windows OS.
Aia nā faila papahana ma nā papa kuhikuhi:
- 'C:ApplicationsWhatsApp.app'
- 'C:Pplications._WhatsApp.app'
- 'C:Users%User profile%LibraryPreferences'
- 'C:Users%User profile%LibraryLogsWhatsApp'
- 'C:Users%User profile%LibrarySaved Application StateWhatsApp.savedState'
- 'C:Users%User profile%LibraryApplication Scripts'
- 'C:Users%User profile%LibraryApplication SupportCloudDocs'
- 'C:Users%User profile%LibraryApplication SupportWhatsApp.ShipIt'
- 'C:Users%User profile%LibraryContainerscom.rockysandstudio.app-for-whatsapp'
- 'C:Users%User profile% Library Mobile Documents <text variable> WhatsApp Accounts'
Aia i loko o kēia papa kuhikuhi nā subdirectories nona nā inoa i nā helu kelepona pili me ka mea nona ka moʻokāki WhatsApp. - 'C:Users%User profile%LibraryCachesWhatsApp.ShipIt'
Aia kēia papa kuhikuhi i ka ʻike e pili ana i ka hoʻokomo ʻana i ka polokalamu. - 'C: Mea hoʻohana% moʻolelo mea hoʻohana%PicturesiPhoto Library.photolibraryMasters', 'C: Mea hoʻohana% moʻolelo mea hoʻohana%PicturesiPhoto Library.photolibraryThumbnails'
Aia kēia mau papa kuhikuhi i nā faila lawelawe o ka papahana, me nā kiʻi a me nā kiʻi liʻiliʻi o nā pilina WhatsApp. - 'C:Users%User profile%LibraryCachesWhatsApp'
Aia i loko o kēia papa kuhikuhi kekahi mau ʻikepili SQLite i hoʻohana ʻia no ka mālama ʻana i ka ʻikepili. - 'C: Nā mea hoʻohana% moʻolelo hoʻohana% LibraryApplication SupportWhatsApp'
Aia i loko o kēia papa kuhikuhi kekahi mau subdirectories:
Ma ka papa helu 'C:Users%User profile%LibraryApplication SupportWhatsAppCache' aia nā faila 'ikepili_0', 'ikepili_1', 'ikepili_2', 'ikepili_3' a me nā faila me nā inoa 'f_*******' (kahi * he helu mai 0 a 9). No ka ʻike e pili ana i ka ʻike i loaʻa i kēia mau faila, e ʻike iā WhatsApp Artifacts ma Windows.Ma ka papa helu 'C: Nā mea hoʻohana% moʻolelo hoʻohana% LibraryApplication SupportWhatsAppIndexedDB' Loaʻa paha nā faila multimedia (ʻaʻohe mea hoʻonui).
waihona 'main-process.log' aia ka ʻike e pili ana i ka hana ʻana o ka polokalamu WhatsApp.
Pūnaewele
- ʻO ka loiloi forensic o WhatsApp Messenger ma nā kelepona Android, na Cosimo Anglano, 2014.
- Whatsapp Forensics: Hōʻike i nā ʻōnaehana palapala a me ka ʻikepili kumu ma ka polokalamu Android a me iOS na Ahmad Pratama, 2014.
Ma nā ʻatikala ma kēia moʻo:
ʻO ka wehe ʻana i nā ʻikepili WhatsApp i hoʻopili ʻiaʻO kahi ʻatikala e hāʻawi i ka ʻike e pili ana i ka hana ʻana o ke kī encryption WhatsApp a me nā hiʻohiʻona kūpono e hōʻike ana pehea e hoʻokaʻawale ai i nā ʻikepili i hoʻopili ʻia o kēia noi.
Wehe i ka ʻikepili WhatsApp mai ka mālama ʻana i ke aoʻO kahi ʻatikala kahi e haʻi aku ai mākou iā ʻoe i ka ʻikepili WhatsApp i mālama ʻia i loko o nā ao a wehewehe i nā ala no ka hoʻihoʻi ʻana i kēia ʻikepili mai nā waihona kapuaʻi.
ʻO ka ʻikepili ʻikepili WhatsApp: Nā Laʻana HoʻomaʻamaʻaʻO kahi ʻatikala e wehewehe i kēlā me kēia pae i nā papahana a pehea e unuhi ai i ka ʻikepili WhatsApp mai nā ʻano mea like ʻole.
Source: www.habr.com