ProHoster > Блог > ozi ịntanetị > WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?

WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?

WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?

Ọ bụrụ n’ịchọrọ ịmata ụdị artifact forensic WhatsApp dị na sistemụ arụmọrụ dị iche iche yana ebe enwere ike ịchọta ha, yabụ ebe a bụ maka gị. Edemede a sitere na ọkachamara na Group-IB Kọmputa Forensics Laboratory Igor Mikhailov na-amalite usoro nke posts banyere WhatsApp forensics na ozi enwere ike nweta site na nyocha ngwaọrụ.

Ka anyị mara ozugbo na sistemụ arụmọrụ dị iche iche na-echekwa ụdị ngwa WhatsApp dị iche iche, ma ọ bụrụ na onye nyocha nwere ike wepụ ụfọdụ ụdị data WhatsApp n'otu ngwaọrụ, nke a apụtaghị na ụdị data ahụ nwere ike isi na ngwaọrụ ọzọ. Dịka ọmụmaatụ, ọ bụrụ na ewepụrụ otu sistemụ na-agba Windows OS, a gaghị ahụ mkparịta ụka WhatsApp na diski ya (ewezuga mbipụta ndabere nke ngwaọrụ iOS, nke enwere ike ịhụ na otu draịva). Njide nke laptọọpụ na ngwaọrụ mkpanaka ga-enwe njirimara nke ya. Ka anyị kwuo banyere nke a n'ụzọ zuru ezu.

WhatsApp artifacts na gam akporo ngwaọrụ

Iji wepụ ihe arịa WhatsApp na ngwaọrụ gam akporo, onye nyocha ahụ ga-enwerịrị ikike superuser ('mgbọrọgwụ') na ngwaọrụ a na-enyocha ma ọ bụ nwee ike wepụ ebe nchekwa anụ ahụ nke ngwaọrụ ahụ, ma ọ bụ sistemụ faịlụ ya (dịka ọmụmaatụ, iji adịghị ike software nke otu ngwaọrụ mkpanaaka).

Faịlụ ngwa dị na ebe nchekwa ekwentị na ngalaba nke echekwara data onye ọrụ. Dị ka a na-achị, a na-akpọ ngalaba a aha 'userdata'. Akwụkwọ ndekọ aha na faịlụ mmemme dị n'akụkụ ụzọ: '/data/data/com.whatsapp/'.

WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
Faịlụ bụ isi nke nwere ihe ngosi nka WhatsApp dị na gam akporo OS bụ ọdụ data 'wa.db' и 'msgstore.db'.

Na nchekwa data 'wa.db' nwere ndepụta kọntaktị zuru ezu nke onye ọrụ WhatsApp, gụnyere nọmba ekwentị, aha ngosi, akara oge, yana ozi ọ bụla ọzọ enyere mgbe ị na-edebanye aha maka WhatsApp. Faịlụ 'wa.db' dị n'akụkụ ụzọ: '/data/data/com.whatsapp/databases/' ma nwee usoro a:

WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
Tebụl kacha adọrọ mmasị na nchekwa data 'wa.db' maka onye nyocha bụ:

  • 'kọntaktị'
    Tebụlụ a nwere ozi kọntaktị: ID kọntaktị WhatsApp, ozi ọkwa, aha ngosipụta onye ọrụ, akara oge, wdg.

    Ọdịdị okpokoro:

    WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
    Nhazi okpokoro

    Aha ubi uru
    _id nọmba ndekọ ndekọ (na SQL table)
    jid WhatsApp kọntaktị ID, nke edere n'ụdị <nọmba ekwentị>@s.whatsapp.net
    bụ_whatsapp_user nwere '1' ma ọ bụrụ na kọntaktị ahụ dabara na onye ọrụ WhatsApp n'ezie, '0' ma ọ bụghị ya
    ọnọdụ nwere ederede egosiri na ọkwa kọntaktị
    status_timestamp nwere stampụ oge n'ụdị Unix Epoch Time (ms).
    ọnụ ọgụgụ akara ekwentị ejikọrọ na kọntaktị
    raw_contact_id nọmba nsonazụ kọntaktị
    aha ngosi aha ngosi kọntaktị
    ụdị ekwentị ụdị ekwentị
    ekwentị_label akara ejikọrọ na nọmba kọntaktị
    a na-ahụghị_msg_count ọnụọgụgụ ozi ndị kọntaktị zitere mana onye nnata agụghị ya
    foto_t nwere stampụ oge n'ụdị Unix Epoch Time
    thumb_ts nwere stampụ oge n'ụdị Unix Epoch Time
    foto_id_timestampụ nwere stampụ oge n'ụdị Unix Epoch Time (ms).
    aha enyere uru ubi dakọtara 'display_name' maka kọntaktị ọ bụla
    aha_aha Aha kọntaktị WhatsApp (a na-egosipụta aha akọwapụtara na profaịlụ kọntaktị)
    ụdị_aha aha kọntaktị eji na ụdị ọrụ
    aha otutu aha njirimara kọntaktị na WhatsApp (a na-egosipụta aha njirimara akọwapụtara na profaịlụ kọntaktị)
    ụlọ ọrụ ụlọ ọrụ (ụlọ ọrụ ahụ akọwapụtara na profaịlụ kọntaktị gosipụtara)
    aha aha (Ms./Mr.; aha ahaziri na profaịlụ kọntaktị na-egosipụta)
    iwe ele mmadụ anya n'ihu
  • 'sqlite_usoro'
    Tebụl a nwere ozi gbasara ọnụọgụ kọntaktị;
  • 'android_metadata'
    Tebụl a nwere ozi gbasara nhazi asụsụ WhatsApp.

Na nchekwa data 'msgstore.db' nwere ozi gbasara ozi ezigara, dị ka nọmba kọntaktị, ederede ozi, ọkwa ozi, akara oge, nkọwa nke faịlụ ebugharị gụnyere na ozi, wdg. Faịlụ 'msgstore.db' dị n'akụkụ ụzọ: '/data/data/com.whatsapp/databases/' ma nwee usoro a:

WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
Tebụl kacha adọrọ mmasị na faịlụ ahụ 'msgstore.db' maka onye nyocha bụ:

  • 'sqlite_usoro'
    Tebụlụ a nwere ozi izugbe gbasara nchekwa data a, dị ka mkpokọta ozi echekwara, mkpokọta nkata, wdg.

    Ọdịdị okpokoro:

    WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?

  • 'ozi_fts_ọdịnaya'
    Nwere ederede ozi ezigara.

    Ọdịdị okpokoro:

    WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?

  • 'ozi'
    Tebụl a nwere ozi dị ka nọmba kọntaktị, ederede ozi, ọkwa ozi, akara oge, ozi gbasara faịlụ ebugharị gụnyere na ozi.

    Ọdịdị okpokoro:

    WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
    Nhazi okpokoro

    Aha ubi uru
    _id nọmba ndekọ ndekọ (na SQL table)
    igodo_remote_jid WhatsApp ID onye mmekọ
    igodo_si m ntụziaka ozi: '0' - mbata, '1' - na-apụ apụ
    igodo_id ihe nchọpụta ozi pụrụ iche
    ọnọdụ ozi ọnọdụ: '0' - ezigara, '4' - na-echere na ihe nkesa, '5' - natara na ebe, '6' - njikwa ozi, '13' - ozi meghere nke nnata (gụọ)
    mkpa_push nwere uru '2' ma ọ bụrụ na ọ bụ ozi mgbasa ozi, ma ọ bụghị nwere '0'
    data ederede ozi (mgbe 'media_wa_type' parameter bụ '0')
    timestamp nwere stampụ oge n'ụdị Unix Epoch Time (ms), uru a na-ewere na elekere ngwaọrụ
    media_url nwere URL nke faịlụ ebufere (mgbe 'media_wa_type' parameter bụ '1', '2', '3')
    media_mime_ụdị Ụdị MIME nke faịlụ ebufere (mgbe 'media_wa_type' paramita hà '1', '2', '3')
    media_wa_ụdị ụdị ozi: '0' - ederede, '1' - faịlụ eserese, '2' - faịlụ ọdịyo, '3' - faịlụ vidiyo, '4' - kaadị kọntaktị, '5' - geodata
    media_size nha faịlụ ebugharị (mgbe 'media_wa_type' parameter bụ '1', '2', '3')
    aha mgbasa ozi aha faịlụ ebugharị (mgbe 'media_wa_type' parameter bụ '1', '2', '3')
    mgbasa ozi_caption Nwere okwu 'audio', 'vidiyo' maka ụkpụrụ kwekọrọ nke paramita 'media_wa_type' (mgbe 'media_wa_type' parameter bụ '1', '3')
    mgbasa_hash base64 edobere hash nke faịlụ ebufere, gbakọọ site na iji HAS-256 algọridim (mgbe 'media_wa_type' parameter bụ '1', '2', '3')
    ogologo oge mgbasa ozi oge n'ime sekọnd maka faịlụ mgbasa ozi (mgbe 'media_wa_type' bụ '1', '2', '3')
    mbido nwere uru '2' ma ọ bụrụ na ọ bụ ozi mgbasa ozi, ma ọ bụghị nwere '0'
    ohere geodata: latitude (mgbe 'media_wa_type' parameter bụ '5')
    ogologo geodata: longitude (mgbe 'media_wa_type' parameter bụ '5')
    thumb_image ozi ọrụ
    remote_resource NJ izipu (maka naanị mkparịta ụka otu)
    natara_timestamp oge nnata, nwere stampụ oge n'ụdị Unix Epoch Time (ms), uru a na-ewere na elekere ngwaọrụ (mgbe 'key_from_me' parameter nwere '0', '-1' ma ọ bụ uru ọzọ)
    send_timestamp ejighi ya, na-enwekarị uru '-1'
    receipt_server_timestamp oge nke ihe nkesa etiti natara, nwere stampụ oge n'ụdị Unix Epoch Time (ms), uru a na-ewere na elekere ngwaọrụ (mgbe 'key_from_me' parameter nwere '1', '-1' ma ọ bụ uru ọzọ.
    receipt_device_timestamp oge nke onye ọzọ debanyere aha natara ozi ahụ, nwere stampụ timestamp na usoro Unix Epoch Time (ms), uru a na-ewere na elekere ngwaọrụ (mgbe 'key_from_me' parameter nwere '1', '-1' ma ọ bụ uru ọzọ.
    gụọ_ngwaọrụ_timestampụ oge imeghe (ịgụ) ozi ahụ, nwere akara timestamp n'ụdị Unix Epoch Time (ms), uru a na-ewere na elekere ngwaọrụ.
    kpọọ_ngwaọrụ_timestamp Oge nkwughachi ozi, nwere stampụ oge n'ụdị Unix Epoch Time (ms), uru a na-ewere na elekere ngwaọrụ.
    data data thumbnail nke faịlụ ebufere (mgbe 'media_wa_type' parameter bụ '1' ma ọ bụ '3')
    onye nnabata_count ọnụọgụ nke ndị nnata (maka ozi mgbasa ozi)
    onye so na hash ejiri geodata na-ebufe ozi
    kpakpando ejighi ya
    ekwuru_row_id amaghị, na-enwekarị uru '0'
    kwuru_jids ejighi ya
    multicast_id ejighi ya
    iwe ele mmadụ anya n'ihu

    Ndepụta mpaghara a anaghị agwụ agwụ. Maka ụdị WhatsApp dị iche iche, mpaghara ụfọdụ nwere ike ịnọ ma ọ bụ anọghị ya. Na mgbakwunye, mpaghara nwere ike ịdị 'media_enc_hash', 'edit_ụdị', 'payment_transaction_id' na ihe ndị ọzọ.

  • 'ozi_thumbnails'
    Tebụl a nwere ozi gbasara onyonyo ebugharị na akara oge. Na kọlụm 'timestamp', egosiri oge ahụ n'ụdị Unix Epoch Time (ms).
  • 'chat_list'
    Tebụl a nwere ozi gbasara nkata.

    Ọdịdị okpokoro:

    WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?

Ọzọkwa, mgbe ị na-enyocha WhatsApp na ngwaọrụ mkpanaka na-agba gam akporo, ị kwesịrị ịṅa ntị na faịlụ ndị a:

  • file 'msgstore.db.cryptXX' (ebe XX bụ otu ma ọ bụ ọnụọgụ abụọ sitere na 0 ruo 12, dịka ọmụmaatụ, msgstore.db.crypt12). Nwere nchekwa ezoro ezo nke ozi WhatsApp (faịlụ ndabere msgstore.db). Faịlụ 'msgstore.db.cryptXX' dị n'akụkụ ụzọ: '/data/media/0/WhatsApp/Databases/' (kaadị SD mebere), '/mnt/sdcard/WhatsApp/Ebe nchekwa data/ (kaadị SD anụ ahụ)'.
  • file ' igodo'. Nwere igodo cryptographic. Dị n'akụkụ ụzọ: '/data/data/com.whatsapp/files/'. A na-eji ewepụ ihe ndabere WhatsApp ezoro ezo.
  • file 'com.whatsapp_preferences.xml'. Nwere ozi gbasara profaịlụ akaụntụ WhatsApp gị. Faịlụ a dị n'akụkụ ụzọ: '/data/data/com.whatsapp/shared_prefs/'.

    Iberibe ọdịnaya faịlụ

    <?xml version="1.0" encoding="ISO-8859-1"?>
…
<string name="ph">9123456789</string> (номер телефона, ассоциированный с аккаунтом WhatsApp)
…
<string name="version">2.17.395</string> (версия WhatsApp)
…
<string name="my_current_status">Hey there! I am using WhatsApp.</string> (сообщение, отображаемое в статусе аккаунта)
…
<string name="push_name">Alex</string> (имя владельца аккаунта)
…
  • file 'ndebanye aha.RegisterPhone.xml'. Nwere ozi gbasara akara ekwentị ejikọrọ na akaụntụ WhatsApp. Faịlụ a dị n'akụkụ ụzọ: '/data/data/com.whatsapp/shared_prefs/'.

    Faịlụ ọdịnaya 

    <?xml version="1.0" encoding="ISO-8859-1"?>
<map>
<string name="com.whatsapp.registration.RegisterPhone.phone_number">9123456789</string>
<int name="com.whatsapp.registration.RegisterPhone.verification_state" value="0"/>
<int name="com.whatsapp.registration.RegisterPhone.country_code_position" value="-1"/>
<string name="com.whatsapp.registration.RegisterPhone.input_phone_number">912 345-67-89</string>
<int name="com.whatsapp.registration.RegisterPhone.phone_number_position" value="10"/>
<string name="com.whatsapp.registration.RegisterPhone.input_country_code">7</string>
<string name="com.whatsapp.registration.RegisterPhone.country_code">7</string>
</map>
  • file 'axolotl.db'. Nwere igodo nzuzo na data ndị ọzọ dị mkpa iji chọpụta onye nwe akaụntụ ahụ. Dị n'akụkụ ụzọ: '/data/data/com.whatsapp/databases/'.
  • file 'chatsettings.db'. Nwere ozi nhazi ngwa.
  • file 'wa.db'. Nwere nkọwa kọntaktị. Ihe na-adọrọ mmasị nke ukwuu (site na akụkụ nyocha) na nchekwa data na-enye ihe ọmụma. Ọ nwere ike ịnwe ozi zuru ezu gbasara kọntaktị ehichapụrụ.

I kwesịkwara ịṅa ntị na akwụkwọ ndekọ aha ndị a:

  • Directory '/data/media/0/WhatsApp/Media/WhatsApp Images/'. Nwere faịlụ eserese ebugharị.
  • Directory '/data/media/0/WhatsApp/Media/WhatsApp ndetu olu/'. Nwere ozi olu na faịlụ usoro OPUS.
  • Directory '/data/data/com.whatsapp/cache/Foto profaịlụ/'. Nwere faịlụ eserese - onyonyo kọntaktị.
  • Directory '/data/data/com.whatsapp/files/Avatars/'. Nwere faịlụ eserese - onyonyo nke obere kọntaktị. Faịlụ ndị a nwere ndọtị '.j' mana ha bụ faịlụ onyonyo JPEG (JPG).
  • Directory '/data/data/com.whatsapp/files/Avatars/'. Nwere faịlụ eserese - onyogho na thumbnail nke onyonyo edobere dị ka avatar nke onye nwe akaụntụ ahụ setịpụrụ.
  • Directory '/data/data/com.whatsapp/files/Logs/'. Nwere ndekọ ọrụ mmemme (faịlụ 'whatsapp.log') yana nkwado ndabere nke ndekọ ọrụ mmemme (faịlụ nwere aha n'ụdị whatsapp-yyyy-mm-dd.1.log.gz).

Otu faịlụ ndekọ WhatsApp:

WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
Iberibe akwụkwọ akụkọ2017-01-10 09:37:09.757 LL_I D [524:WhatsApp Ọrụ #1] aza oku oku/ọnụọgụ:0 timestamp:0
2017-01-10 09:37:09.758 LL_I D [524:WhatsApp Worker #1] aza oku/mmelite kagbuo eziokwu
2017-01-10 09:37:09.768 LL_I D [1: main] app-init/load-me
2017-01-10 09:37:09.772 LL_I D [1: main] okwuntughe faịlụ efu ma ọ bụ enweghị ọgụgụ
2017-01-10 09:37:09.782 LL_I D [1: main] statistics Ozi ederede: 59 zitere, 82 natara / Ozi mgbasa ozi: 1 zitere (0 bytes), 0 natara (9850158 bytes) / Ozi na-anọghị n'ịntanetị: 81 natara ( 19522 msec nkezi igbu oge) / Ọrụ ozi: 116075 bytes zitere, 211729 bytes natara / oku Voip: oku ọpụpụ 1, oku mbata 0, 2492 bytes ezigara, 1530 bytes natara / Google mbanye: 0 bytes ezigara, 0 bytes natara / na-agagharị: 1524 bytes ezigara, 1826 bytes natara / ngụkọta data: 118567 bytes ezigara, 10063417 bytes natara.
2017-01-10 09:37:09.785 LL_I D [1: main] media-state- manager/refresh-media-state/writable-media
2017-01-10 09: 37: 09.806 LL_I D [1: isi] ngwa-init / ibido / ngụ oge / nkwụsị: 24
2017-01-10 09:37:09.811 LL_I D [1: main] msgstore/checkhealth
2017-01-10 09:37:09.817 LL_I D [1: main] msgstore/checkhealth/akwụkwọ akụkọ/ehichapụ ụgha
2017-01-10 09:37:09.818 LL_I D [1: main] msgstore/checkhealth/azụ/ehichapụ ụgha
2017-01-10 09:37:09.818 LL_I D [1: isi] msgstore/checkdb/data/data/com.whatsapp/databases/msgstore.db
2017-01-10 09:37:09.819 LL_I D [1: main] msgstore/checkdb/list _jobqueue-WhatsAppJobManager 16384 drw=011
2017-01-10 09:37:09.820 LL_I D [1: main] msgstore/checkdb/list _jobqueue-WhatsAppJobManager-journal 21032 drw=011
2017-01-10 09:37:09.820 LL_I D [1: main] msgstore/checkdb/ndepụta axolotl.db 184320 drw=011
2017-01-10 09:37:09.821 LL_I D [1: main] msgstore/checkdb/list axolotl.db-wal 436752 drw=011
2017-01-10 09:37:09.821 LL_I D [1: main] msgstore/checkdb/list axolotl.db-shm 32768 drw=011
2017-01-10 09:37:09.822 LL_I D [1: main] msgstore/checkdb/list msgstore.db 540672 drw=011
2017-01-10 09:37:09.823 LL_I D [1: main] msgstore/checkdb/list msgstore.db-wal 0 drw=011
2017-01-10 09:37:09.823 LL_I D [1: main] msgstore/checkdb/list msgstore.db-shm 32768 drw=011
2017-01-10 09:37:09.824 LL_I D [1: main] msgstore/checkdb/list wa.db 69632 drw=011
2017-01-10 09:37:09.825 LL_I D [1: main] msgstore/checkdb/list wa.db-wal 428512 drw=011
2017-01-10 09:37:09.825 LL_I D [1: main] msgstore/checkdb/list wa.db-shm 32768 drw=011
2017-01-10 09:37:09.826 LL_I D [1: main] msgstore/checkdb/list chatsettings.db 4096 drw=011
2017-01-10 09:37:09.826 LL_I D [1: main] msgstore/checkdb/list chatsettings.db-wal 70072 drw=011
2017-01-10 09:37:09.827 LL_I D [1: main] msgstore/checkdb/list chatsettings.db-shm 32768 drw=011
2017-01-10 09:37:09.838 LL_I D [1: main] msgstore/checkdb/ụdị 1
2017-01-10 09:37:09.839 LL_I D [1:isi] msgstore/canquery
2017-01-10 09:37:09.846 LL_I D [1:isi] msgstore/canquery/gụọ 1
2017-01-10 09:37:09.847 LL_I D [1: main] msgstore/canquery/timer/nkwụsị: 8
2017-01-10 09:37:09.847 LL_I D [1: main] msgstore/canquery 517 | oge eji:8
2017-01-10 09:37:09.848 LL_I D [529:WhatsApp Worker #3] media-state- manager/refresh-media-state/internal-storage dị:1,345,622,016 ngụkọta:5,687,922,688

  • Directory '/data/media/0/WhatsApp/Media/WhatsApp Audio/'. Nwere faịlụ ọdịyo enwetara.
  • Directory '/data/media/0/WhatsApp/Media/WhatsApp Audio/Ezitere/'. Nwere faịlụ ọdịyo ezitere.
  • Directory '/data/media/0/WhatsApp/Media/WhatsApp Images/'. Nwere faịlụ eserese ndị a ga-esi na ya pụta.
  • Directory '/data/media/0/WhatsApp/Media/WhatsApp Images/Ezitere/'. Nwere faịlụ eserese ezigara.
  • Directory '/data/media/0/WhatsApp/Media/WhatsApp Video/'. Nwere faịlụ vidiyo enwetara.
  • Directory '/data/media/0/WhatsApp/Media/WhatsApp Video/zitere/'. Nwere faịlụ vidiyo ezitere.
  • Directory '/data/media/0/WhatsApp/Media/WhatsApp foto profaịlụ/'. Nwere faịlụ eserese jikọtara ya na onye nwe akaụntụ WhatsApp.
  • Iji chekwaa oghere ebe nchekwa na ekwentị gam akporo gị, enwere ike ịchekwa ụfọdụ data WhatsApp na kaadị SD. Na kaadị SD, na ndekọ mgbọrọgwụ, enwere ndekọ 'WhatsApp', ebe enwere ike ịhụ arịa ndị a nke mmemme a:

    WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?

  • Directory '.Share' ('/mnt/sdcard/WhatsApp/.Share/'). Nwere nnomi faịlụ ekesara ndị ọrụ WhatsApp ndị ọzọ.
  • Directory '.ihe mkpofu' ('/mnt/sdcard/WhatsApp/.trash/'). Nwere faịlụ ehichapụrụ.
  • Directory 'databases' ('/mnt/sdcard/WhatsApp/Ebe nchekwa data/'). Nwere nkwado ndabere ezoro ezo. Enwere ike mebie ha ma ọ bụrụ na faịlụ dị ' igodo', ewepụtara na ebe nchekwa ngwaọrụ nyochara.

    Faịlụ dị n'ime akwụkwọ ndekọ aha 'databases':

    WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?

  • Directory 'Ọkara' ('/mnt/sdcard/WhatsApp/Media/'). Nwere subdirectories 'Akwụkwọ ahụaja', 'WhatsApp Audio', Foto 'WhatsApp', Foto profaịlụ nke WhatsApp, 'WhatsApp Video', 'Ihe ndetu olu WhatsApp', nke nwere faịlụ mgbasa ozi enwetara ma bufee ya (faịlụ eserese, faịlụ vidiyo, ozi olu, foto metụtara profaịlụ onye nwe akaụntụ WhatsApp, akwụkwọ ahụaja).
  • Directory 'Foto profaịlụ' ('/mnt/sdcard/WhatsApp/Foto profaịlụ/'). Nwere faịlụ eserese jikọtara na profaịlụ onye nwe akaụntụ WhatsApp.
  • Mgbe ụfọdụ enwere ike ịnwe ndekọ dị na kaadị SD 'faịlụ' ('/mnt/sdcard/WhatsApp/Files/'). Akwụkwọ ndekọ aha nwere faịlụ na-echekwa ntọala mmemme yana mmasị onye ọrụ.

Njirimara nke nchekwa data n'ụdị ụfọdụ ngwaọrụ mkpanaka

Ụfọdụ ụdị nke mobile ngwaọrụ na-agba ọsọ gam akporo OS nwere ike na-echekwa WhatsApp artifacts na a dị iche iche ebe. Nke a bụ n'ihi mgbanwe na ebe nchekwa data ngwa site na ngwanrọ sistemụ nke ngwaọrụ mkpanaka. Dịka ọmụmaatụ, ngwaọrụ mkpanaka Xiaomi nwere ọrụ maka ịmepụta oghere ọrụ nke abụọ ("SecondSpace"). Mgbe arụ ọrụ a na-arụ ọrụ, ọnọdụ data gbanwere. Ya mere, ọ bụrụ na na a mgbe mobile ngwaọrụ na-agba ọsọ gam akporo os data na-echekwara na ndekọ '/data/onye ọrụ/0/' (nke bụ nrụtụ aka na mbụ '/data/data/'), mgbe ahụ, na nke abụọ ọrụ ohere data na-echekwara na ndekọ '/data/onye ọrụ/10/'. Ya bụ, iji ihe atụ nke ebe faịlụ 'wa.db':

  • na ekwentị oge niile na-agba ọsọ Android OS: /data/user/0/com.whatsapp/databases/wa.db' (nke ya bụ nhata '/data/data/com.whatsapp/databases/wa.db');
  • na ebe ọrụ nke abụọ nke Xiaomi smartphone: '/data/user/10/com.whatsapp/databases/wa.db'.

WhatsApp artifacts na iOS ngwaọrụ

N'adịghị ka gam akporo os, na iOS WhatsApp data na-ebufe na a ndabere oyiri (iTunes ndabere). Ya mere, iwepụta data na ngwa a anaghị achọ iwepụ sistemụ faịlụ ma ọ bụ mepụta ebe nchekwa anụ ahụ nke ngwaọrụ a na-enyocha. Ọtụtụ ozi dị mkpa dị na nchekwa data 'ChatStorage.sqlite', nke dị n'akụkụ ụzọ: '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/' (n'ụfọdụ mmemme ụzọ a na-egosi dị ka 'AppDomainGroup-group.net.whatsapp.WhatsApp.shared').

Ọdịdị 'ChatStorage.sqlite':

WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
Tebụl kacha enye nkọwa na nchekwa data 'ChatStorage.sqlite' bụ 'ZWAMESSAGE' и 'ZWAMEDIAITEM'.

Ọdịdị okpokoro 'ZWAMESSAGE':

WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
Nhazi nke tebụl 'ZWAMESSAGE'

Aha ubi uru
Z_PK nọmba ndekọ ndekọ (na SQL table)
Z_ENT ihe nchọpụta tebụl, nwere uru '9'
Z_OPT amaghị, na-enwekarị ụkpụrụ sitere na '1' ruo '6'
ZCHILDMESSAGESWEERE COUNT amaghị, na-enwekarị uru '0'
ZCHILDMESSAGESPLAYEDCOUNT amaghị, na-enwekarị uru '0'
ZCHILDMESSAGESAGE NDỤMỌDỤ amaghị, na-enwekarị uru '0'
ZDATAITEMVERSION amaghị, na-enwekarị uru '3', eleghị anya ihe ngosi ozi ederede
ZDOCID amaghi
ZENCRETRYCOUNT amaghị, na-enwekarị uru '0'
ZFILTEREDRECIPIENTCOUNT amaghị, na-enwekarị ụkpụrụ '0', '2', '256'
ZISFROMME ntụziaka ozi: '0' - mbata, '1' - na-apụ apụ
ZMESSAGEERRORSTATUS ọkwa nnyefe ozi. Ọ bụrụ na ezigara/natara ozi ahụ, ọ nwere uru '0'
ZMESSAGETYPE ụdị ozi a na-ebufe
ZSORT amaghi
ZSPOTLIGHSTATUS amaghi
ZSTARRED amaghị, ejighi ya
ZCHATESSION amaghi
ZGROUPMEMBER amaghị, ejighi ya
ZLASTESSION amaghi
ZMEDIAITEM amaghi
ZMESSAGEINFO amaghi
ZPARENTMESSAGE amaghị, ejighi ya
ZMESSAGEDATE timestamp na OS X Epoch Time format
ZSENTDATE oge ezigara ozi a na OS X Epoch Time usoro
ZFROMJID WhatsApp onye zitere ID
ZMEDIASECTIONID nwere afọ na ọnwa ezigara faịlụ mgbasa ozi
ZPHASH amaghị, ejighi ya
ZPUSSHPAME aha kọntaktị zitere faịlụ mgbasa ozi n'ụdị UTF-8
ZSTANZID ihe nchọpụta ozi pụrụ iche
ZTEXT Ederede ozi
ZTOJID WhatsApp ID nke nnata
OFFSET ele mmadụ anya n'ihu

Ọdịdị okpokoro 'ZWAMEDIAITEM':

WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
Nhazi nke table 'ZWAMEDIAITEM'

Aha ubi uru
Z_PK nọmba ndekọ ndekọ (na SQL table)
Z_ENT ihe nchọpụta tebụl, nwere uru '8'
Z_OPT amaghị, na-enwekarị ụkpụrụ sitere na '1' ruo '3'.
ZCLOUDSTATUS nwere uru '4' ma ọ bụrụ na eburu faịlụ ahụ.
ZFILESIZE nwere ogologo faịlụ (na bytes) maka faịlụ ebudatara
ZMEDIAORIGIN amaghị, na-enwekarị uru '0'
ZMOVIEDURATION ogologo oge faịlụ mgbasa ozi, maka faịlụ pdf nwere ike ịnwe ọnụọgụ peeji nke akwụkwọ ahụ
Ozi nwere nọmba nsonazụ (nọmba ahụ dị iche na nke egosiri na kọlụm 'Z_PK')
ZASPECTRATIO akụkụ akụkụ, ejighị ya, na-emekarị ka ọ bụrụ '0'
ZHACCURACY amaghị, na-enwekarị uru '0'
ZLATTTUDE obosara na pikselụ
ZLONGTITUDE elu na pikselụ
ZMEDIAURLDATE timestamp na OS X Epoch Time format
ZAUTORNAME odee (maka akwụkwọ, nwere ike ịnwe aha faịlụ)
ZCOLLECTIONNAME ejighi ya
ZMEDIALOCALPATH Aha faịlụ (gụnyere ụzọ) na sistemụ faịlụ ngwaọrụ
ZMEDIAURL URL ebe faịlụ mgbasa ozi dị. Ọ bụrụ na ebufere faịlụ site n'otu onye debanyere aha gaa na nke ọzọ, ezoro ezo ya, a ga-egosikwa ndọtị ya dị ka ndọtị nke faịlụ bufere - .enc
ZTHUMBNAILLOCALPATH ụzọ thumbnail faịlụ dị na sistemụ faịlụ ngwaọrụ
ZTITLE nkụnye eji isi mee faịlụ
ZVCARDNAME hash faịlụ mgbasa ozi; mgbe ị na-ebufe faịlụ na otu, ọ nwere ike ịnwe ihe nchọpụta nke izipu
ZVCARDSTRING nwere ozi gbasara ụdị faịlụ a na-ebufe (dịka ọmụmaatụ, onyonyo/jpeg); mgbe ị na-ebufe faịlụ na otu, ọ nwere ike ịnwe njirimara onye nnata.
ZXMPPTHUMBPATH ụzọ thumbnail faịlụ dị na sistemụ faịlụ ngwaọrụ
ZMEDIAKEY amaghị, eleghị anya nwere igodo iji mebie faịlụ ezoro ezo.
ZMETADATA metadata nke ozi ezigara
Mmebi ele mmadụ anya n'ihu

Tebụl nchekwa data ndị ọzọ na-adọrọ mmasị 'ChatStorage.sqlite' bụ:

  • 'ZWAPROFILEPUSHNAME'. Dakọtara WhatsApp ID na aha kọntaktị;
  • 'ZWAPROFILEPICTUREITEM'. Dakọtara ID WhatsApp na avatar kọntaktị;
  • 'Z_PRIMARYKEY'. Tebụlụ ahụ nwere ozi izugbe gbasara nchekwa data a, dị ka mkpokọta ozi echekwara, mkpokọta nkata, wdg.

Ọzọkwa, mgbe ị na-enyocha WhatsApp na ngwaọrụ mkpanaka na-agba iOS, ị kwesịrị ịṅa ntị na faịlụ ndị a:

  • file 'BackedUpKeyValue.sqlite'. Nwere igodo nzuzo na data ndị ọzọ dị mkpa iji chọpụta onye nwe akaụntụ ahụ. Dị n'akụkụ ụzọ: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
  • file 'ContactsV2.sqlite'. Nwere ozi gbasara kọntaktị onye ọrụ, dị ka aha zuru oke, akara ekwentị, ọkwa kọntaktị (n'ụdị ederede), WhatsApp ID, wdg. Dị n'akụkụ ụzọ: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
  • file 'Consumer_version'. Nwere nọmba ụdị nke ngwa WhatsApp arụnyere. Dị n'akụkụ ụzọ: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
  • file 'current_wallpaper.jpg'. Nwere akwụkwọ ahụaja ndabere WhatsApp dị ugbu a. Dị n'akụkụ ụzọ: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/. Ụdị ngwa ochie na-eji faịlụ ahụ 'akwụkwọ ahụaja', nke dị n'akụkụ ụzọ: '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/'.
  • file 'blockedcontacts.dat'. Nwere ozi gbasara kọntaktị akpọchiri. Dị n'akụkụ ụzọ: /private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/.
  • file 'pw.dat'. Nwere paswọọdụ ezoro ezo. Dị n'akụkụ ụzọ: '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/'.
  • file 'net.whatsapp.WhatsApp.plist' (ma ọ bụ faịlụ 'group.net.whatsapp.WhatsApp.shared.plist'). Nwere ozi gbasara profaịlụ akaụntụ WhatsApp gị. Faịlụ a dị n'akụkụ ụzọ: '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Library/Preferences/'.

Ọdịnaya nke faịlụ 'group.net.whatsapp.WhatsApp.shared.plist' WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
I kwesịkwara ịṅa ntị na akwụkwọ ndekọ aha ndị a:

  • Directory '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Media/Profile/'. Nwere thumbnails nke kọntaktị, otu (faịlụ nwere ndọtị .mkpịsị aka), kọntaktị avatars, WhatsApp onye nwe akaụntụ avatar (faịlụ 'Foto.jpg').
  • Directory '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Message/Media/'. Nwere faịlụ mgbasa ozi yana thumbnails ha
  • Directory '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/'. Nwere ndekọ ọrụ mmemme (faịlụ 'calls.log') na nkwado ndabere nke ndekọ ọrụ mmemme (faịlụ 'calls.backup.log').
  • Directory '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/stickers/'. Nwere akwụkwọ mmado (faịlụ n'ụdị '.webp').
  • Directory '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/Logs/'. Nwere ndekọ ọrụ mmemme.

Ngwa ngwa WhatsApp dị na Windows

Enwere ike ịhụ arịa WhatsApp na Windows n'ọtụtụ ebe. Nke mbụ, ndị a bụ akwụkwọ ndekọ aha nwere faịlụ mmemme na mmemme inyeaka (maka Windows 8/10):

  • 'C: faịlụ mmemme (x86)WhatsApp'
  • 'C: Ndị ọrụ% profaịlụ njirimara% AppDataLocalWhatsApp'
  • 'C: Ndị ọrụ% profaịlụ njirimara% AppDataLocalVirtualStore faịlụ faịlụ (x86)WhatsApp'

Na katalọgụ 'C: Ndị ọrụ% profaịlụ njirimara% AppDataLocalWhatsApp' faịlụ ndekọ dị 'SquirrelSetup.log', nke nwere ozi gbasara ịlele mmelite na ịwụnye mmemme.

Na katalọgụ 'C: Ndị ọrụ% profaịlụ njirimara% AppDataRoamingWhatsApp' Enwere ọtụtụ subdirectories:

WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
file 'Main-process.log' nwere ozi gbasara ọrụ nke mmemme WhatsApp.

Akwụkwọ ndekọ aha 'databases' nwere faịlụ 'Ebe nchekwa data.db', mana faịlụ a enweghị ozi ọ bụla gbasara nkata ma ọ bụ kọntaktị.

Ihe kacha adọrọ mmasị site na nlele anya nyocha bụ faịlụ ndị dị na ndekọ 'Cache'. Ndị a bụ faịlụ ndị akpọrọ aha 'f ***' (ebe * bụ nọmba sitere na 0 ruo 9) nwere faịlụ mgbasa ozi na akwụkwọ ezoro ezo, mana enwerekwa faịlụ ezoro ezo n'etiti ha. Nke kacha amasị bụ faịlụ 'data_0', 'data_1', 'data_2', 'data_3', dị n'otu akwụkwọ ndekọ aha. Faịlụ 'data_0', 'data_1', 'data_3' nwere njikọ mpụga na faịlụ mgbasa ozi na akwụkwọ ezoro ezo.

Ọmụmaatụ nke ozi dị na faịlụ 'data_1'WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
Ọzọkwa faịlụ 'data_3' nwere ike ịnwe faịlụ eserese.

file 'data_2' nwere avatars kọntaktị (nwere ike iweghachite site na ịchọ site na nkụnye eji isi mee faịlụ).

Avatars dị na faịlụ ahụ 'data_2':

WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
Yabụ, enweghị ike ịchọta nkata ahụ n'onwe ha na ebe nchekwa kọmputa, mana ị nwere ike ịhụ:

  • multimedia faịlụ;
  • akwụkwọ na-ebufe site na WhatsApp;
  • ozi gbasara kọntaktị onye nwe akaụntụ.

Ngwa ngwa WhatsApp dị na MacOS

Na MacOS ị nwere ike ịhụ ụdị ngwa WhatsApp dị ka nke a na-ahụ na Windows OS.

Faịlụ mmemme dị na akwụkwọ ndekọ aha ndị a:

  • 'C:ApplicationsWhatsApp.app'
  • 'C: Ngwa._WhatsApp.app'
  • 'C: Ndị ọrụ% profaịlụ njirimara%Preferences Library'
  • 'C: Users% Profaịlụ onye ọrụ%LibraryLogsWhatsApp'
  • 'C:Users% Profaịlụ onye ọrụ%LibrarySaved Application StateWhatsApp.savedState'
  • 'C: Users% Profaịlụ njirimara% Scripts Library'
  • 'C: Ndị ọrụ% profaịlụ njirimara% LibraryApplication SupportCloudDocs'
  • 'C: Users% Profaịlụ onye ọrụ%LibraryApplication SupportWhatsApp.ShipIt'
  • 'C: Ndị ọrụ% profaịlụ njirimara%LibraryContainerscom.rockysandstudio.app-for-whatsapp'
  • 'C: Users% Profaịlụ onye ọrụ% Akwụkwọ mkpanaaka Library <text variable> WhatsApp Accounts'
    Akwụkwọ ndekọ aha nwere subdirectories aha ha bụ nọmba ekwentị metụtara onye nwe akaụntụ WhatsApp.
  • 'C: Users% Profaịlụ onye ọrụ%LibraryCachesWhatsApp.ShipIt'
    Akwụkwọ ndekọ a nwere ozi gbasara ịwụnye mmemme.
  • 'C: Users% Profaịlụ njirimara% PicturesiPhoto Library.photolibraryMasters', 'C: Users% Profaịlụ onye ọrụ% PicturesiPhoto Library.photolibraryThumbnails'
    Akwụkwọ ndekọ aha ndị a nwere faịlụ ọrụ nke mmemme ahụ, gụnyere foto na thumbnails nke kọntaktị WhatsApp.
  • 'C: Users% Profaịlụ onye ọrụ%LibraryCachesWhatsApp'
    Akwụkwọ ndekọ aha nwere ọtụtụ ọdụ data SQLite ejiri maka ndochi data.
  • 'C: Users% Profaịlụ onye ọrụ%LibraryApplication SupportWhatsApp'
    Akwụkwọ ndekọ aha nwere ọtụtụ subdirectories:

    WhatsApp n'ọbụ aka gị: kedu na kedu ka ị ga-esi chọta ihe arịa dị egwu?
    Na katalọgụ 'C: Users% Profaịlụ onye ọrụ%LibraryApplication SupportWhatsAppCache' enwere faịlụ 'data_0', 'data_1', 'data_2', 'data_3' na faịlụ nwere aha 'f ***' (ebe * bụ nọmba site na 0 ruo 9). Maka ozi gbasara ozi faịlụ ndị a nwere, lee WhatsApp Artifacts na Windows.

    Na katalọgụ 'C: Users% Profaịlụ onye ọrụ%LibraryApplication SupportWhatsAppIndexedDB' nwere ike ịnwe faịlụ mgbasa ozi (faịlụ enweghị ndọtị).

    file 'Main-process.log' nwere ozi gbasara ọrụ nke mmemme WhatsApp.

Isi mmalite

  1. Nyocha nyocha nke WhatsApp Messenger na ekwentị gam akporo, nke Cosimo Anglano, 2014.
  2. WhatsApp Forensics: Eksplorasi sistemu na ndabere data site na gam akporo na iOS site Ahmad Pratama, 2014.

N'ime akụkọ ndị a n'usoro isiokwu a:

Decryption nke nchekwa data WhatsApp ezoro ezoEdemede ga-enye ozi gbasara otu esi enweta igodo nzuzo WhatsApp yana ọmụmaatụ bara uru na-egosi otu esi ewepụ ọdụ data ezoro ezo nke ngwa a.
Na-ewepụ data WhatsApp na nchekwa igwe ojiiOtu akụkọ nke anyị ga-agwa gị ihe data WhatsApp na-echekwa na igwe ojii wee kọwaa ụzọ maka iweghachite data a na nchekwa igwe ojii.
Mwepụta data WhatsApp: Ọmụmaatụ bara uruOtu isiokwu ga-akọwa nzọụkwụ site nzọụkwụ ihe omume na otú wepụ WhatsApp data si dị iche iche ngwaọrụ.

isi: www.habr.com

Tinye a comment