Yog tias koj xav paub dab tsi ntawm WhatsApp forensic artifacts muaj nyob rau ntawm cov kev khiav hauj lwm sib txawv thiab qhov twg raws nraim lawv tuaj yeem pom, ces qhov no yog qhov chaw rau koj. Kab lus no yog los ntawm tus kws tshaj lij ntawm Group-IB Computer Forensics Laboratory Igor Mikhailov pib cov lus tshaj tawm txog WhatsApp forensics thiab cov ntaub ntawv dab tsi tuaj yeem tau txais los ntawm kev tshuaj xyuas lub cuab yeej.
Cia peb nco ntsoov tam sim ntawd tias cov kev khiav hauj lwm sib txawv khaws ntau hom WhatsApp artifacts, thiab yog tias tus kws tshawb fawb tuaj yeem rho tawm qee yam ntawm WhatsApp cov ntaub ntawv los ntawm ib lub cuab yeej, qhov no tsis txhais tau tias cov ntaub ntawv zoo sib xws tuaj yeem raug rho tawm los ntawm lwm lub cuab yeej. Piv txwv li, yog tias lub system khiav Windows OS raug tshem tawm, WhatsApp chats tej zaum yuav tsis pom ntawm nws cov disks (nrog rau qhov tshwj tsis yog cov ntawv luam theej ntawm iOS, uas tuaj yeem pom ntawm tib lub drives). Kev qaug dab peg ntawm lub laptops thiab cov khoom siv mobile yuav muaj nws tus yam ntxwv. Wb tham txog qhov no kom ntxaws ntxiv.
WhatsApp artifacts hauv Android ntaus ntawv
Txhawm rau rho tawm WhatsApp artifacts los ntawm Android ntaus ntawv, tus kws tshawb fawb yuav tsum muaj txoj cai superuser ('cag') ntawm lub cuab yeej nyob rau hauv kev kawm lossis muaj peev xwm rho tawm lub cev pov tseg ntawm lub cuab yeej lub cim xeeb, lossis nws cov ntaub ntawv kaw lus (piv txwv li, siv software vulnerabilities ntawm ib lub xov tooj ntawm tes).
Daim ntawv thov cov ntaub ntawv nyob rau hauv lub xov tooj lub cim xeeb nyob rau hauv seem uas cov neeg siv cov ntaub ntawv tau txais kev cawmdim. Raws li txoj cai, ntu no muaj npe 'userdata'. Subdirectories thiab cov ntaub ntawv kev pab cuam yog nyob ntawm txoj kev: '/data/data/com.whatsapp/'.
Cov ntaub ntawv tseem ceeb uas muaj WhatsApp forensic artifacts hauv Android OS yog databases 'ua.db' ΠΈ 'msgstore.db'.
Hauv database 'ua.db' muaj tag nrho cov npe hu rau tus neeg siv WhatsApp, suav nrog tus xov tooj, lub npe, lub sijhawm, thiab lwm yam ntaub ntawv muab thaum sau npe rau WhatsApp. Cov ntaub ntawv 'ua.db' nyob rau ntawm txoj kev: '/data/data/com.whatsapp/databases/' thiab muaj cov qauv hauv qab no:
Cov rooj nthuav dav tshaj plaws hauv cov ntaub ntawv 'ua.db' rau tus kws tshawb fawb yog:
- 'ua_contacts'
Cov lus no muaj cov ntaub ntawv tiv tauj: WhatsApp hu rau ID, cov ntaub ntawv xwm txheej, tus neeg siv lub npe, lub sijhawm teev, thiab lwm yam.Rooj tsos:
Rooj qauvLub npe teb nqi _id ib sau tus lej ua ntu zus (hauv SQL rooj) jid ua WhatsApp tiv tauj ID, sau rau hauv hom <xov tooj>@s.whatsapp.net yog_whatsapp_user muaj '1' yog tias qhov kev sib cuag sib haum rau tus neeg siv WhatsApp tiag tiag, '0' txwv tsis pub raws li txoj cai muaj cov ntawv nyeem nyob rau hauv cov xwm txheej tiv tauj status_timestamp muaj cov ntawv teev sijhawm hauv Unix Epoch Time (ms) hom tooj tus lej xov tooj cuam tshuam nrog kev sib cuag raw_contact_id hu rau serial tooj display_name hu rau lub npe phone_type hom xov tooj phone_label daim ntawv lo txuam nrog tus xov tooj hu unseen_msg_ suav tus naj npawb ntawm cov lus uas tau xa los ntawm ib tug neeg tab sis tsis tau nyeem los ntawm tus neeg txais photo_ts muaj cov ntawv teev sijhawm hauv Unix Epoch Time format thumb_tsi muaj cov ntawv teev sijhawm hauv Unix Epoch Time format photo_id_timestamp muaj cov ntawv teev sijhawm hauv Unix Epoch Time (ms) hom muab_npe teb tus nqi sib tw 'display_name' rau txhua tus neeg sib cuag wa_ npe WhatsApp hu rau lub npe (lub npe teev nyob rau hauv kev sib cuag tus profile yog tso tawm kom pom) sort_npe hu rau lub npe siv nyob rau hauv kev ua haujlwm npe menyuam yaus hu rau lub npe menyuam yaus hauv WhatsApp (lub npe menyuam yaus teev nyob rau hauv kev sib cuag tus profile yog tshwm sim) lub tuam txhab tuam txhab (lub tuam txhab teev nyob rau hauv tus xov tooj tus profile yog tso tawm kom pom) title title (Ms./Mr.; title configured in the contact profile is displayed) offset kev tsis ncaj ncees - 'sqlite_sequence'
Cov lus no muaj cov ntaub ntawv hais txog tus naj npawb ntawm cov neeg hu; - 'android_metadata'
Cov lus no muaj cov ntaub ntawv hais txog WhatsApp lus hauv zos.
Hauv database 'msgstore.db' muaj cov ntaub ntawv hais txog kev xa xov, xws li tus xov tooj hu, cov ntawv xov xwm, xov xwm xwm txheej, teev sijhawm, cov ntsiab lus ntawm cov ntaub ntawv hloov pauv nrog rau cov lus, thiab lwm yam. Cov ntaub ntawv 'msgstore.db' nyob rau ntawm txoj kev: '/data/data/com.whatsapp/databases/' thiab muaj cov qauv hauv qab no:
Cov rooj nthuav dav tshaj plaws hauv cov ntaub ntawv 'msgstore.db' rau tus kws tshawb fawb yog:
- 'sqlite_sequence'
Cov lus no muaj cov ntaub ntawv dav dav txog cov ntaub ntawv no, xws li tag nrho cov lus khaws tseg, tag nrho cov kev sib tham, thiab lwm yam.Rooj tsos:
- 'message_fts_content'
Muaj cov ntawv ntawm cov lus xa.Rooj tsos:
- 'cov lus'
Cov lus no muaj cov ntaub ntawv xws li tus xov tooj hu, cov ntawv xov xwm, cov xwm txheej, cov ntawv teev sijhawm, cov ntaub ntawv hais txog cov ntaub ntawv xa mus nrog rau cov lus.Rooj tsos:
Rooj qauvLub npe teb nqi _id ib sau tus lej ua ntu zus (hauv SQL rooj) key_remote_jid WhatsApp ID ntawm kev sib txuas lus tus khub key_from_kuv Cov lus qhia: '0' - nkag mus, '1' - tawm key_id tus cim kab lus cim raws li txoj cai lus xwm txheej: '0' - xa, '4' - tos ntawm tus neeg rau zaub mov, '5' - tau txais ntawm qhov chaw, '6' - tswj cov lus, '13' - cov lus qhib los ntawm tus neeg txais (nyeem) xav_push muaj tus nqi '2' yog tias nws yog xov xwm tshaj tawm, txwv tsis pub muaj '0' cov ntaub ntawv lus ntawv (thaum 'media_wa_type' parameter yog '0') timestamp muaj ib lub sij hawm nyob rau hauv Unix Epoch Time (ms) hom, tus nqi yog muab los ntawm lub moos ntaus ntawv media_url muaj qhov URL ntawm cov ntaub ntawv hloov pauv (thaum 'media_wa_type' parameter yog '1', '2', '3') media_mime_type MIME hom ntawm cov ntaub ntawv pauv (thaum lub 'media_wa_type' parameter yog sib npaug rau '1', '2', '3') media_wa_type lus hom: '0' - text, '1' - nraaj ntaub ntawv, '2' - audio file, '3' - video file, '4' - hu rau daim card, '5' - geodata media_size qhov loj ntawm cov ntaub ntawv hloov pauv (thaum 'media_wa_type' parameter yog '1', '2', '3') media_npe lub npe ntawm cov ntaub ntawv hloov pauv (thaum 'media_wa_type' parameter yog '1', '2', '3') media_caption Muaj cov lus 'suab', 'video' rau cov txiaj ntsig sib xws ntawm 'media_wa_type' parameter (thaum 'media_wa_type' parameter yog '1', '3') media_hash base64 encoded hash ntawm cov ntaub ntawv xa mus, suav nrog HAS-256 algorithm (thaum lub 'media_wa_type' parameter yog sib npaug rau '1', '2', '3') media_ ncua sij hawm ntev hauv vib nas this rau cov ntaub ntawv xov xwm (thaum 'media_wa_type' yog '1', '2', '3') keeb kwm muaj tus nqi '2' yog tias nws yog xov xwm tshaj tawm, txwv tsis pub muaj '0' latitude geodata: latitude (thaum 'media_wa_type' parameter yog '5') ntev ntev geodata: longitude (thaum 'media_wa_type' parameter yog '5') thumb_ duab cov ntaub ntawv kev pabcuam remote_resource Sender ID (rau pab pawg sib tham nkaus xwb) tau txais_timestamp lub sij hawm ntawm daim ntawv txais nyiaj, muaj ib lub sij hawm nyob rau hauv Unix Epoch Time (ms) hom, tus nqi yog muab los ntawm lub moos ntaus ntawv (thaum lub 'key_from_me' parameter muaj '0', '-1' los yog lwm yam nqi) xa_timestamp tsis siv, feem ntau muaj tus nqi '-1' receipt_server_timestamp lub sij hawm tau txais los ntawm lub hauv paus neeg rau zaub mov, muaj ib lub sij hawm nyob rau hauv Unix Epoch Time (ms) hom, tus nqi yog muab los ntawm lub moos ntaus ntawv (thaum lub 'key_from_me' parameter muaj '1', '-1' los yog lwm yam nqi receipt_device_timestamp lub sij hawm cov lus tau txais los ntawm lwm tus neeg, muaj ib lub sij hawm nyob rau hauv Unix Epoch Time (ms) hom, tus nqi yog muab los ntawm lub moos ntaus ntawv (thaum lub 'key_from_me' parameter muaj '1', '-1' los yog lwm tus nqi read_device_timestamp lub sij hawm qhib (nyeem) cov lus, muaj lub sij hawm nyob rau hauv Unix Epoch Time (ms) hom, tus nqi yog muab los ntawm lub moos ntaus ntawv play_device_timestamp lus playback lub sij hawm, muaj ib lub sij hawm nyob rau hauv Unix Epoch Time (ms) hom, tus nqi yog muab los ntawm lub moos ntaus ntawv raw_data thumbnail ntawm cov ntaub ntawv pauv (thaum lub 'media_wa_type' parameter yog '1' lossis '3') tus neeg txais_ suav tus naj npawb ntawm cov neeg tau txais (rau cov lus tshaj tawm) participant_hash siv thaum xa cov lus nrog geodata starred tsis siv quoted_row_id tsis paub, feem ntau muaj tus nqi '0' hais_jids tsis siv multicast_id tsis siv offset kev tsis ncaj ncees Cov npe ntawm thaj chaw no tsis yog tag nrho. Rau qhov sib txawv ntawm WhatsApp, qee qhov chaw tuaj yeem muaj lossis tsis tuaj. Tsis tas li ntawd, cov teb tuaj yeem muaj 'media_enc_hash', 'edit_version', 'payment_transaction_id' thiab ua li ntawd.
- 'messages_thumbnails'
Cov lus no muaj cov ntaub ntawv hais txog cov duab hloov pauv thiab lub sijhawm teev tseg. Hauv kab ntawv 'timestamp', lub sijhawm tau qhia hauv Unix Epoch Time (ms) hom. - 'chat_list'
Lub rooj no muaj cov ntaub ntawv hais txog kev sib tham.Rooj tsos:
Tsis tas li ntawd, thaum soj ntsuam WhatsApp ntawm lub xov tooj ntawm tes khiav Android, koj yuav tsum tau them sai sai rau cov ntaub ntawv hauv qab no:
- cov ntaub ntawv 'msgstore.db.cryptXX' (qhov twg XX yog ib lossis ob tus lej ntawm 0 txog 12, piv txwv li, msgstore.db.crypt12). Muaj ib qho encrypted thaub qab ntawm WhatsApp lus (cov ntaub ntawv thaub qab msgstore.db ib). Cov ntaub ntawv 'msgstore.db.cryptXX' nyob rau ntawm txoj kev: '/data/media/0/WhatsApp/Databases/' (virtual SD card), '/mnt/sdcard/WhatsApp/Databases/ (lub cev SD daim npav)'.
- cov ntaub ntawv 'tus yuam sij'. Muaj tus yuam sij cryptographic. Nyob ntawm txoj kev: '/data/data/com.whatsapp/files/'. Siv los decrypted WhatsApp thaub qab.
- cov ntaub ntawv 'com.whatsapp_preferences.xml'. Muaj cov ntaub ntawv hais txog koj tus account WhatsApp profile. Cov ntaub ntawv yog nyob ntawm txoj kev: '/data/data/com.whatsapp/shared_prefs/'.
Cov ntsiab lus fragment
<?xml version="1.0" encoding="ISO-8859-1"?> β¦ <string name="ph">9123456789</string> (Π½ΠΎΠΌΠ΅Ρ ΡΠ΅Π»Π΅ΡΠΎΠ½Π°, Π°ΡΡΠΎΡΠΈΠΈΡΠΎΠ²Π°Π½Π½ΡΠΉ Ρ Π°ΠΊΠΊΠ°ΡΠ½ΡΠΎΠΌ WhatsApp) β¦ <string name="version">2.17.395</string> (Π²Π΅ΡΡΠΈΡ WhatsApp) β¦ <string name="my_current_status">Hey there! I am using WhatsApp.</string> (ΡΠΎΠΎΠ±ΡΠ΅Π½ΠΈΠ΅, ΠΎΡΠΎΠ±ΡΠ°ΠΆΠ°Π΅ΠΌΠΎΠ΅ Π² ΡΡΠ°ΡΡΡΠ΅ Π°ΠΊΠΊΠ°ΡΠ½ΡΠ°) β¦ <string name="push_name">Alex</string> (ΠΈΠΌΡ Π²Π»Π°Π΄Π΅Π»ΡΡΠ° Π°ΠΊΠΊΠ°ΡΠ½ΡΠ°) β¦ - cov ntaub ntawv 'registration.RegisterPhone.xml'. Muaj cov ntaub ntawv hais txog tus lej xov tooj cuam tshuam nrog WhatsApp account. Cov ntaub ntawv yog nyob ntawm txoj kev: '/data/data/com.whatsapp/shared_prefs/'.
Cov ntaub ntawv txheem
<?xml version="1.0" encoding="ISO-8859-1"?> <map> <string name="com.whatsapp.registration.RegisterPhone.phone_number">9123456789</string> <int name="com.whatsapp.registration.RegisterPhone.verification_state" value="0"/> <int name="com.whatsapp.registration.RegisterPhone.country_code_position" value="-1"/> <string name="com.whatsapp.registration.RegisterPhone.input_phone_number">912 345-67-89</string> <int name="com.whatsapp.registration.RegisterPhone.phone_number_position" value="10"/> <string name="com.whatsapp.registration.RegisterPhone.input_country_code">7</string> <string name="com.whatsapp.registration.RegisterPhone.country_code">7</string> </map> - cov ntaub ntawv 'axolotl.db'. Muaj cov yuam sij cryptographic thiab lwm yam ntaub ntawv uas tsim nyog los txheeb xyuas tus tswv tus account. Nyob ntawm txoj kev: '/data/data/com.whatsapp/databases/'.
- cov ntaub ntawv 'chatsettings.db'. Muaj cov ntaub ntawv thov kev teeb tsa.
- cov ntaub ntawv 'ua.db'. Muaj cov ntaub ntawv tiv tauj. Ib qho nthuav heev (los ntawm forensic nam) thiab cov ntaub ntawv qhia. Nws tuaj yeem muaj cov ncauj lus kom ntxaws txog cov neeg raug tshem tawm.
Koj kuj yuav tsum tau them sai sai rau cov npe hauv qab no:
- Directory '/data/media/0/WhatsApp/Media/WhatsApp Duab/'. Muaj cov ntaub ntawv hloov dua siab tshiab.
- Directory '/data/media/0/WhatsApp/Media/WhatsApp Voice Notes/'. Muaj cov suab lus hauv .OPUS hom ntaub ntawv.
- Directory '/data/data/com.whatsapp/cache/Profile Duab/'. Muaj cov duab nraaj - cov duab ntawm kev sib cuag.
- Directory '/data/data/com.whatsapp/files/Avatars/'. Muaj cov duab nraaj β duab thumbnail ntawm kev sib cuag. Cov ntaub ntawv no muaj '.j' txuas ntxiv tab sis tseem yog JPEG (JPG) cov duab cov ntaub ntawv.
- Directory '/data/data/com.whatsapp/files/Avatars/'. Muaj cov duab nraaj - ib daim duab thiab tus duab me me ntawm cov duab teeb tsa ua tus avatar los ntawm tus tswv tus account.
- Directory '/data/data/com.whatsapp/files/Log/'. Muaj cov ntawv teev npe ua haujlwm (cov ntaub ntawv 'whatsapp.log') thiab cov ntawv luam theej ntawm cov ntawv teev npe ua haujlwm (cov ntaub ntawv nrog cov npe hauv hom whatsapp-yyyy-mm-dd.1.log.gz).
WhatsApp Log Files:
Phau ntawv fragment2017-01-10 09:37:09.757 LL_I D [524:WhatsApp Worker #1] missedcallnotification/init count:0 timestamp:0
2017-01-10 09:37:09.758 LL_I D [524:WhatsApp Worker #1] missedcallnotification/update cancel true
2017-01-10 09:37:09.768 LL_I D [1:main] app-init/load-kuv
2017-01-10 09:37:09.772 LL_I D [1:main] lo lus zais cov ntaub ntawv ploj lossis nyeem tsis tau
2017-01-10 09:37:09.782 LL_I D [1:main] txheeb cais Cov Lus Xa: 59 xa, 82 tau txais / Media Messages: 1 xa (0 bytes), 0 tau txais (9850158 bytes) / Offline Messages: 81 tau txais ( 19522 msec nruab nrab ncua sijhawm) / Kev Pabcuam Xov Xwm: 116075 bytes xa, 211729 bytes tau txais / Voip Hu: 1 hu tawm, 0 hu xov tooj, 2492 bytes xa, 1530 bytes tau txais / Google Drive: 0 bytes xa, 0 bytes tau txais / Roaming: bytes xa, 1524 bytes tau txais / Tag nrho cov ntaub ntawv: 1826 bytes xa, 118567 bytes tau txais
2017-01-10 09:37:09.785 LL_I D [1:main] media-state-manager/refresh-media-state/writable-media
2017-01-10 09:37:09.806 LL_I D [1:main] app-init/initialize/timer/stop: 24
2017-01-10 09:37:09.811 LL_I D [1:main] msgstore/checkhealth
2017-01-10 09:37:09.817 LL_I D [1:main] msgstore/checkhealth/journal/delete cuav
2017-01-10 09:37:09.818 LL_I D [1:main] msgstore/checkhealth/back/delete cuav
2017-01-10 09:37:09.818 LL_I D [1:main] msgstore/checkdb/data/data/com.whatsapp/databases/msgstore.db
2017-01-10 09:37:09.819 LL_I D [1:main] msgstore/checkdb/list _jobqueue-WhatsAppJobManager 16384 drw=011
2017-01-10 09:37:09.820 LL_I D [1:main] msgstore/checkdb/list _jobqueue-WhatsAppJobManager-journal 21032 drw=011
2017-01-10 09:37:09.820 LL_I D [1:main] msgstore/checkdb/list axolotl.db 184320 drw=011
2017-01-10 09:37:09.821 LL_I D [1:main] msgstore/checkdb/list axolotl.db-wal 436752 drw=011
2017-01-10 09:37:09.821 LL_I D [1:main] msgstore/checkdb/list axolotl.db-shm 32768 drw=011
2017-01-10 09:37:09.822 LL_I D [1:main] msgstore/checkdb/list msgstore.db 540672 drw=011
2017-01-10 09:37:09.823 LL_I D [1:main] msgstore/checkdb/list msgstore.db-wal 0 drw=011
2017-01-10 09:37:09.823 LL_I D [1:main] msgstore/checkdb/list msgstore.db-shm 32768 drw=011
2017-01-10 09:37:09.824 LL_I D [1:main] msgstore/checkdb/list wa.db 69632 drw=011
2017-01-10 09:37:09.825 LL_I D [1:main] msgstore/checkdb/list wa.db-wal 428512 drw=011
2017-01-10 09:37:09.825 LL_I D [1:main] msgstore/checkdb/list wa.db-shm 32768 drw=011
2017-01-10 09:37:09.826 LL_I D [1:main] msgstore/checkdb/list chatsettings.db 4096 drw=011
2017-01-10 09:37:09.826 LL_I D [1:main] msgstore/checkdb/list chatsettings.db-wal 70072 drw=011
2017-01-10 09:37:09.827 LL_I D [1:main] msgstore/checkdb/list chatsettings.db-shm 32768 drw=011
2017-01-10 09:37:09.838 LL_I D [1:main] msgstore/checkdb/version 1
2017-01-10 09:37:09.839 LL_I D [1:main] msgstore/canquery
2017-01-10 09:37:09.846 LL_I D [1:main] msgstore/canquery/ suav 1
2017-01-10 09:37:09.847 LL_I D [1:main] msgstore/canquery/timer/nres: 8
2017-01-10 09:37:09.847 LL_I D [1:main] msgstore/canquery 517 | lub sijhawm siv: 8
2017-01-10 09:37:09.848 LL_I D [529:WhatsApp Worker #3] media-state-manager/refresh-media-state/internal-storage available: 1,345,622,016 total: 5,687,922,688
- Directory '/data/media/0/WhatsApp/Media/WhatsApp Audio/'. Muaj cov ntaub ntawv audio tau txais.
- Directory '/data/media/0/WhatsApp/Media/WhatsApp Audio/Sent/'. Muaj cov ntaub ntawv xa tawm.
- Directory '/data/media/0/WhatsApp/Media/WhatsApp Duab/'. Muaj cov duab nraaj uas tshwm sim.
- Directory '/data/media/0/WhatsApp/Media/WhatsApp Images/Sent/'. Muaj cov duab xa tuaj.
- Directory '/data/media/0/WhatsApp/Media/WhatsApp Video/'. Muaj cov ntaub ntawv video tau txais.
- Directory '/data/media/0/WhatsApp/Media/WhatsApp Video/Sent/'. Muaj cov ntaub ntawv video xa tuaj.
- Directory '/data/media/0/WhatsApp/Media/WhatsApp Profile Photos/'. Muaj cov duab nraaj cuam tshuam nrog tus tswv ntawm WhatsApp account.
- Txhawm rau txuag qhov chaw nco ntawm koj lub smartphone hauv Android, qee cov ntaub ntawv WhatsApp tuaj yeem khaws cia rau ntawm SD daim npav. Nyob rau hauv SD daim npav, nyob rau hauv lub hauv paus directory, muaj ib tug directory 'Whatsapp', qhov twg hauv qab no artifacts ntawm qhov kev pab cuam no yuav nrhiav tau:
- Directory '.Qhia' ('/mnt/sdcard/WhatsApp/.Share/'). Muaj cov ntawv luam ntawm cov ntaub ntawv uas tau muab qhia rau lwm tus neeg siv WhatsApp.
- Directory '. thoob khib nyiab' ('/mnt/sdcard/WhatsApp/.trash/'). Muaj cov ntaub ntawv deleted.
- Directory 'Databases' ('/mnt/sdcard/WhatsApp/Databases/'). Nws muaj encrypted backups. Lawv tuaj yeem decrypted yog tias cov ntaub ntawv tam sim no 'tus yuam sij', muab rho tawm los ntawm lub cim xeeb ntawm cov cuab yeej txheeb xyuas.
Cov ntaub ntawv nyob rau hauv ib tug subdirectory 'Databases':
- Directory 'ib nrab' ('/mnt/sdcard/WhatsApp/Media/'). Muaj subdirectories 'WallPaper', 'WhatsApp Audio', 'WhatsApp Duab', 'WhatsApp Profile Duab', 'WhatsApp Video', 'WhatsApp Voice Notes', uas muaj cov ntaub ntawv tau txais thiab xa tawm ntau cov ntaub ntawv (cov ntaub ntawv nraaj, cov ntaub ntawv video, suab lus, cov duab cuam tshuam nrog tus profile ntawm WhatsApp tus tswv account, wallpapers).
- Directory 'Cov duab Profile' ('/mnt/sdcard/WhatsApp/Profile Pictures/'). Muaj cov duab nraaj cuam tshuam nrog profile ntawm WhatsApp tus tswv tus account.
- Qee lub sij hawm tej zaum yuav muaj ib daim ntawv teev npe nyob rau hauv daim npav SD 'cov ntaub ntawv' ('/mnt/sdcard/WhatsApp/Files/'). Daim ntawv teev npe no muaj cov ntaub ntawv khaws cov kev pab cuam thiab cov neeg siv nyiam.
Nta ntawm cov ntaub ntawv khaws cia hauv qee cov qauv ntawm cov khoom siv mobile
Qee cov qauv ntawm cov khoom siv txawb uas siv Android OS tuaj yeem khaws WhatsApp artifacts hauv qhov chaw sib txawv. Qhov no yog vim muaj kev hloov pauv hauv qhov chaw cia ntawm daim ntawv thov cov ntaub ntawv los ntawm qhov system software ntawm lub xov tooj ntawm tes. Piv txwv li, Xiaomi mobile pab kiag li lawm muaj ib tug muaj nuj nqi rau tsim ib tug thib ob workspace ("SecondSpace"). Thaum qhov haujlwm no qhib, qhov chaw ntawm cov ntaub ntawv hloov pauv. Yog li, yog tias nyob rau hauv ib txwm mobile ntaus ntawv khiav Android OS cov neeg siv cov ntaub ntawv khaws cia hauv phau ntawv teev npe '/data/user/0/' (uas yog ib qho kev siv rau ib txwm '/data/cov/'), tom qab ntawd hauv qhov chaw ua haujlwm thib ob daim ntawv thov cov ntaub ntawv khaws cia hauv phau ntawv teev npe '/data/user/10/'. Ntawd yog, siv qhov piv txwv ntawm cov ntaub ntawv qhov chaw 'ua.db':
- Nyob rau hauv ib txwm smartphone khiav Android OS: /data/user/0/com.whatsapp/databases/wa.db' (uas yog sib npaug '/data/data/com.whatsapp/databases/wa.db');
- Hauv qhov chaw ua haujlwm thib ob ntawm Xiaomi smartphone: '/data/user/10/com.whatsapp/databases/wa.db'.
WhatsApp artifacts hauv iOS no ntaus ntawv
Tsis zoo li Android OS, hauv iOS WhatsApp daim ntawv thov cov ntaub ntawv raug xa mus rau ib daim ntawv theej thaub qab (iTunes thaub qab). Yog li ntawd, rho tawm cov ntaub ntawv los ntawm daim ntawv thov no tsis tas yuav rho tawm cov ntaub ntawv kaw lus lossis tsim lub cim xeeb ntawm lub cuab yeej hauv kev tshawb xyuas. Feem ntau ntawm cov ntaub ntawv cuam tshuam yog muaj nyob rau hauv cov ntaub ntawv 'ChatStorage.sqlite', uas nyob ntawm txoj kev: '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/' (hauv qee qhov kev pab cuam no txoj kev zoo li 'AppDomainGroup-group.net.whatsapp.WhatsApp.shared').
Qauv 'ChatStorage.sqlite':
Cov lus qhia tshaj plaws hauv 'ChatStorage.sqlite' database yog 'ZWAMESSAGE' ΠΈ 'ZWAMEDIAITEM'.
Rooj tsos 'ZWAMESSAGE':
Qauv ntawm lub rooj 'ZWAMESSAGE'
| Lub npe teb | nqi |
|---|---|
| Z_PK | sau tus lej ua ntu zus (hauv SQL rooj) |
| Z_ENT | table identifier, muaj tus nqi '9' |
| Z_OPT | tsis paub, feem ntau muaj qhov tseem ceeb ntawm '1' txog '6' |
| ZCHILDMESSAGESDELIVEREDCOUNT | tsis paub, feem ntau muaj tus nqi '0' |
| ZCHILDMESSAGESPLAYEDCOUNT | tsis paub, feem ntau muaj tus nqi '0' |
| ZCHILDMESSAGESREADCOUNT | tsis paub, feem ntau muaj tus nqi '0' |
| ZDATAITEMVERSION | tsis paub, feem ntau muaj tus nqi '3', tej zaum yuav muaj cov ntawv qhia |
| ZDOCID | yog tsis paub |
| ZENCRETRYCOUNT | tsis paub, feem ntau muaj tus nqi '0' |
| ZFILTEREDRECIPIENTCOUNT | tsis paub, feem ntau muaj qhov tseem ceeb '0', '2', '256' |
| ZISFROMME | Cov lus qhia: '0' - nkag mus, '1' - tawm |
| ZMESSAGEERROSTATUS | xov xwm kis tau tus mob. Yog tias cov lus xa / tau txais, ces nws muaj tus nqi '0' |
| ZMESSAGETYPE | hom lus raug xa mus |
| ZSORT | yog tsis paub |
| ZSPOTLIGHSTATUS | yog tsis paub |
| ZSTARRED | tsis paub, tsis siv |
| ZCHATSESSION | yog tsis paub |
| ZGROUPMEMBER | tsis paub, tsis siv |
| ZLASTSESSION | yog tsis paub |
| ZMEDIAITEM | yog tsis paub |
| ZMESSAGEINFO | yog tsis paub |
| ZPARENTMESSAGE | tsis paub, tsis siv |
| ZMESSAGEDATE | timestamp hauv OS X Epoch Time format |
| ZSENTDATE | lub sij hawm cov lus raug xa hauv OS X Epoch Time format |
| ZFROMJID | WhatsApp Sender ID |
| ZMEDIASECTIONID | muaj lub xyoo thiab hli cov ntaub ntawv xov xwm tau xa |
| ZPHASH | tsis paub, tsis siv |
| ZPUSHPAME | lub npe ntawm tus neeg uas xa cov ntaub ntawv tawm hauv UTF-8 hom ntawv |
| ZSTANZID | tus cim kab lus cim |
| ZTEXT | Cov ntawv nyeem |
| ZTOJID | Tus neeg txais WhatsApp ID |
| OFFSET | kev tsis ncaj ncees |
Rooj tsos 'ZWAMEDIAITEM':
Structure of table 'ZWAMEDIAITEM'
| Lub npe teb | nqi |
|---|---|
| Z_PK | sau tus lej ua ntu zus (hauv SQL rooj) |
| Z_ENT | table identifier, muaj tus nqi '8' |
| Z_OPT | tsis paub, feem ntau muaj qhov tseem ceeb ntawm '1' txog '3'. |
| ZCLOUDSTATUS | muaj tus nqi '4' yog tias cov ntaub ntawv thauj khoom. |
| ZFILESIZE | muaj cov ntaub ntawv ntev (hauv bytes) rau cov ntaub ntawv rub tawm |
| ZMEDIAORIGIN | tsis paub, feem ntau muaj tus nqi '0' |
| ZMOVIEDURATION | ntev ntawm cov ntaub ntawv xov xwm, rau cov ntaub ntawv pdf yuav muaj cov nplooj ntawv ntawm cov ntaub ntawv |
| ZMESSAGE | muaj tus lej xov tooj (tus lej txawv ntawm qhov qhia hauv kab 'Z_PK') |
| ZASPECTRATIO | nam piv, tsis siv, feem ntau teem rau '0' |
| ZHACCURACY | tsis paub, feem ntau muaj tus nqi '0' |
| ZLATTITUDE | dav hauv pixels |
| ZLONGTITUDE | qhov siab hauv pixels |
| ZMEDIAURLDATE | timestamp hauv OS X Epoch Time format |
| ZAUTHORNAME | tus sau (rau cov ntaub ntawv, tej zaum yuav muaj cov ntaub ntawv npe) |
| ZCOLLECTIONNAME | tsis siv |
| ZMEDIALOCALPATH | cov ntaub ntawv npe (nrog rau txoj hauv kev) hauv cov cuab yeej cov ntaub ntawv system |
| ZMEDIAURL | Qhov URL qhov twg cov ntaub ntawv xov xwm nyob. Yog tias cov ntaub ntawv raug xa los ntawm ib tus neeg rau npe mus rau lwm tus, nws tau encrypted thiab nws qhov txuas ntxiv yuav raug qhia raws li qhov txuas ntxiv ntawm cov ntaub ntawv hloov pauv - .enc |
| ZTHUMBNAILLOCALPATH | txoj kev mus rau cov ntaub ntawv thumbnail nyob rau hauv lub ntaus ntawv cov ntaub ntawv system |
| ZTITLE | ntaub ntawv header |
| ZVCARDNAME | hash ntawm cov ntaub ntawv xov xwm; thaum hloov cov ntaub ntawv mus rau ib pab pawg, nws yuav muaj tus xa tus cim |
| ZVCARDSTRING | muaj cov ntaub ntawv hais txog hom ntaub ntawv raug xa mus (piv txwv li, duab / jpeg); thaum hloov cov ntaub ntawv mus rau ib pab pawg, nws yuav muaj tus neeg txais tus cim |
| ZXMPPTHUMBPATH | txoj kev mus rau cov ntaub ntawv thumbnail nyob rau hauv lub ntaus ntawv cov ntaub ntawv system |
| ZMEDIAKEY | tsis paub, tej zaum muaj tus yuam sij rau decrypt cov ntaub ntawv encrypted. |
| ZMETADATA | metadata ntawm kev xa xov |
| Offset | kev tsis ncaj ncees |
Lwm nthuav database rooj 'ChatStorage.sqlite' yog:
- 'ZWAPROFILEPUSHNAME'. Txuas WhatsApp ID nrog lub npe hu;
- 'ZWAPROFILEPICTUREITEM'. Txuas WhatsApp ID nrog kev sib cuag avatar;
- 'Z_PRIMARYKEY'. Lub rooj muaj cov ntaub ntawv dav dav txog cov ntaub ntawv no, xws li tag nrho cov lus khaws cia, tag nrho cov lus sib tham, thiab lwm yam.
Tsis tas li ntawd, thaum soj ntsuam WhatsApp ntawm lub xov tooj ntawm tes khiav iOS, koj yuav tsum tau them sai sai rau cov ntaub ntawv hauv qab no:
- cov ntaub ntawv 'BackedUpKeyValue.sqlite'. Muaj cov yuam sij cryptographic thiab lwm yam ntaub ntawv uas tsim nyog los txheeb xyuas tus tswv tus account. Nyob ntawm txoj kev: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- cov ntaub ntawv 'ContactsV2.sqlite'. Muaj cov ntaub ntawv hais txog tus neeg siv cov kev sib cuag, xws li lub npe tag nrho, tus xov tooj, kev sib cuag (hauv daim ntawv), WhatsApp ID, thiab lwm yam. Nyob ntawm txoj kev: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- cov ntaub ntawv 'consumer_version'. Muaj tus lej version ntawm daim ntawv thov WhatsApp ntsia. Nyob ntawm txoj kev: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- cov ntaub ntawv 'tam sim no_wallpaper.jpg'. Muaj tam sim no WhatsApp keeb kwm yav dhau wallpaper. Nyob ntawm txoj kev: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/. Cov ntawv qub ntawm daim ntawv thov siv cov ntaub ntawv 'wallpaper', uas nyob ntawm txoj kev: '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/'.
- cov ntaub ntawv 'blockedcontacts.dat'. Muaj cov ntaub ntawv hais txog cov neeg raug kaw. Nyob ntawm txoj kev: /private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/.
- cov ntaub ntawv 'pw.dat'. Muaj ib tug encrypted password. Nyob ntawm txoj kev: '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/'.
- cov ntaub ntawv 'net.whatsapp.WhatsApp.plist' (los yog ntaub ntawv 'group.net.whatsapp.WhatsApp.shared.plist'). Muaj cov ntaub ntawv hais txog koj tus account WhatsApp profile. Cov ntaub ntawv yog nyob ntawm txoj kev: '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Library/Preferences/'.
Cov ntsiab lus ntawm cov ntaub ntawv 'group.net.whatsapp.WhatsApp.shared.plist'
Koj kuj yuav tsum tau them sai sai rau cov npe hauv qab no:
- Directory '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Media/Profile/'. Muaj cov duab me me ntawm kev sib cuag, pab pawg (cov ntaub ntawv nrog qhov txuas ntxiv .thuav), hu rau avatars, WhatsApp account tus tswv avatar (file 'Photo.jpg').
- Directory '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Message/Media/'. Muaj cov ntaub ntawv multimedia thiab lawv cov duab me me
- Directory '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/'. Muaj cov program ua haujlwm log (file 'calls.log') thiab thaub qab cov ntawv luam ntawm cov haujlwm ua haujlwm cav (file 'calls.backup.log').
- Directory '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/stickers/'. Muaj cov ntawv nplaum (cov ntaub ntawv hauv hom '.webp').
- Directory '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/Logs/'. Muaj cov ntawv teev kev ua haujlwm.
WhatsApp artifacts ntawm Windows
WhatsApp artifacts ntawm Windows tuaj yeem pom hauv ntau qhov chaw. Ua ntej ntawm tag nrho cov, cov no yog cov npe uas muaj cov ntaub ntawv ua haujlwm tau thiab pab cuam (rau Windows 8/10):
- 'C:Program Files (x86)WhatsApp'
- 'C: Cov neeg siv% Cov neeg siv profile% AppDataLocalWhatsApp'
- 'C: Cov neeg siv% Cov neeg siv profile% AppDataLocalVirtualStore Program Files (x86)WhatsApp'
Hauv phau ntawv teev lus 'C: Cov neeg siv% Cov neeg siv profile% AppDataLocalWhatsApp' cov ntaub ntawv log yog nyob 'SquirrelSetup.log', uas muaj cov ntaub ntawv hais txog kev kuaj xyuas qhov hloov tshiab thiab txhim kho qhov program.
Hauv phau ntawv teev lus 'C: Cov neeg siv% Cov neeg siv profile% AppDataRoamingWhatsApp' Muaj ntau ntau subdirectories:
cov ntaub ntawv 'main-process.log' muaj cov ntaub ntawv hais txog kev ua haujlwm ntawm WhatsApp program.
Subdirectory 'databases' muaj ib cov ntaub ntawv 'Databases.db', tab sis cov ntaub ntawv no tsis muaj cov ntaub ntawv hais txog kev sib tham lossis kev sib cuag.
Qhov nthuav tshaj plaws los ntawm forensic taw tes ntawm view yog cov ntaub ntawv nyob rau hauv lub directory 'Cache'. Cov no yog cov ntaub ntawv muaj npe 'f_****** ib' (qhov twg * yog tus lej los ntawm 0 txog 9) uas muaj cov ntaub ntawv multimedia encrypted thiab cov ntaub ntawv, tab sis kuj tseem muaj cov ntaub ntawv tsis muaj ntaub ntawv ntawm lawv. Ntawm qhov txaus siab yog cov ntaub ntawv 'cov_0', 'cov_1', 'cov_2', 'cov_3', nyob rau hauv tib lub subdirectory. Cov ntaub ntawv 'cov_0', 'cov_1', 'cov_3' muaj cov txuas sab nraud rau kis tau encrypted multimedia ntaub ntawv thiab cov ntaub ntawv.
Piv txwv ntawm cov ntaub ntawv muaj nyob rau hauv cov ntaub ntawv 'data_1'
Kuj ua ntaub ntawv 'cov_3' tej zaum yuav muaj cov duab nraaj.
cov ntaub ntawv 'cov_2' muaj cov avatars tiv tauj (tuaj yeem rov qab los ntawm kev tshawb nrhiav los ntawm cov ntaub ntawv headers).
Avatar muaj nyob rau hauv cov ntaub ntawv 'cov_2':
Yog li, cov chats lawv tus kheej tsis tuaj yeem pom hauv lub computer lub cim xeeb, tab sis koj tuaj yeem pom:
- multimedia ntaub ntawv;
- cov ntaub ntawv kis tau los ntawm WhatsApp;
- cov ntaub ntawv hais txog tus tswv tus account hu.
WhatsApp artifacts ntawm MacOS
Hauv MacOS koj tuaj yeem nrhiav hom WhatsApp artifacts zoo ib yam li cov pom hauv Windows OS.
Cov ntaub ntawv program muaj nyob hauv cov npe hauv qab no:
- 'C: Applications WhatsApp.app'
- 'C:Applications._WhatsApp.app'
- 'C:Users%User profile%LibraryPreferences'
- 'C: Cov neeg siv% cov neeg siv profile%LibraryLogsWhatsApp'
- 'C: Cov neeg siv% Cov neeg siv profile% Lub Tsev Qiv Ntawv Sau Npe StateWhatsApp.savedState'
- 'C: Cov neeg siv% Cov neeg siv profile% Cov Ntawv Sau Ntawv Sau Ntawv'
- 'C: Cov neeg siv% Cov neeg siv profile% LibraryApplication SupportCloudDocs'
- 'C: Cov neeg siv% Cov neeg siv profile% Lub Tsev Qiv Ntawv Thov Kev Pabcuam Whatsapp.ShipIt'
- 'C: Cov neeg siv% Cov neeg siv profile%LibraryContainerscom.rockysandstudio.app-for-whatsapp'
- 'C: Cov neeg siv% Cov neeg siv profile% Cov Ntaub Ntawv Txawb Cov Ntaub Ntawv <text hloov pauv> WhatsApp Accounts'
Cov npe no muaj cov npe subdirectories uas nws cov npe yog cov xov tooj cuam tshuam nrog tus tswv ntawm WhatsApp account. - 'C:Users%User profile%LibraryCachesWhatsApp.ShipIt'
Phau ntawv no muaj cov ntaub ntawv hais txog kev txhim kho qhov program. - 'C:Users%User profile%PicturesiPhoto Library.photolibraryMasters', 'C:Users%User profile%PicturesiPhoto Library.photolibraryThumbnails'
Cov ntawv teev npe no muaj cov ntaub ntawv pabcuam ntawm qhov kev pabcuam, suav nrog cov duab thiab cov duab me me ntawm WhatsApp hu. - 'C: Cov neeg siv% cov neeg siv profile%LibraryCachesWhatsApp'
Cov kab ntawv no muaj ob peb SQLite databases uas siv rau cov ntaub ntawv caching. - 'C: Cov neeg siv% Cov neeg siv profile% Lub Tsev Qiv Ntawv Thov Kev Pabcuam WhatsApp'
Phau ntawv no muaj ob peb subdirectories:
Hauv phau ntawv teev lus 'C: Cov neeg siv% Cov neeg siv profile% Lub Tsev Qiv Ntawv Thov Kev Pabcuam WhatsAppCache' muaj cov ntaub ntawv 'cov_0', 'cov_1', 'cov_2', 'cov_3' thiab cov ntaub ntawv nrog cov npe 'f_****** ib' (qhov twg * yog tus lej ntawm 0 txog 9). Yog xav paub txog dab tsi cov ntaub ntawv no muaj, saib WhatsApp Artifacts ntawm Windows.Hauv phau ntawv teev lus 'C: Cov neeg siv% Cov neeg siv profile% Lub Tsev Qiv Ntawv Thov Kev PabcuamWhatsAppIndexedDB' tej zaum yuav muaj cov ntaub ntawv multimedia (cov ntaub ntawv tsis muaj qhov txuas ntxiv).
cov ntaub ntawv 'main-process.log' muaj cov ntaub ntawv hais txog kev ua haujlwm ntawm WhatsApp program.
Cov chaw
- Forensic tsom xam ntawm WhatsApp Messenger ntawm Android smartphones, los ntawm Cosimo Anglano, 2014.
- Whatsapp Forensics: Eksplorasi system berkas thiab cov ntaub ntawv hauv paus rau kev siv Android thiab iOS los ntawm Ahmad Pratama, 2014.
Nyob rau hauv cov lus hauv qab no hauv series:
Decryption ntawm encrypted WhatsApp databasesIb tsab xov xwm uas yuav muab cov ntaub ntawv hais txog yuav ua li cas tus yuam sij WhatsApp encryption yog tsim thiab cov qauv siv tau qhia yuav ua li cas decrypted cov ntaub ntawv encrypted ntawm daim ntawv thov no.
Extracting WhatsApp cov ntaub ntawv los ntawm huab ciaIb tsab xov xwm uas peb yuav qhia koj tias WhatsApp cov ntaub ntawv khaws cia hauv huab thiab piav qhia txog txoj hauv kev los muab cov ntaub ntawv no los ntawm huab cia.
WhatsApp Cov ntaub ntawv rho tawm: Cov piv txwv zooIb tsab xov xwm uas yuav piav qhia txog ib kauj ruam yog dab tsi cov kev pab cuam thiab yuav ua li cas rho tawm WhatsApp cov ntaub ntawv los ntawm ntau yam khoom siv.
Tau qhov twg los: www.hab.com