Kana iwe uchida kuziva kuti ndeapi marudzi eWhatsApp forensic artifacts aripo pane akasiyana masisitimu anoshanda uye kupi chaizvo kwaanogona kuwanikwa, saka ino ndiyo nzvimbo yako. Ichi chinyorwa chinobva kuna nyanzvi kuBoka-IB Computer Forensics Laboratory Igor Mikhailov inotanga nhevedzano yezvinyorwa nezve WhatsApp forensics uye ndeupi ruzivo runogona kuwanikwa kubva pakuongorora mudziyo.
Ngationei nekukurumidza kuti masisitimu akasiyana ekushandisa anochengeta mhando dzakasiyana dzeWhatsApp artifacts, uye kana muongorori achigona kuburitsa mamwe marudzi eWhatsApp data kubva kune imwe mudziyo, izvi hazvireve kuti mhando dze data dzinogona kutorwa kubva kune imwe mudziyo. Semuenzaniso, kana system unit inoshandisa Windows OS ikabviswa, WhatsApp chats ingangove isingawanikwe pamadhisiki ayo (kunze kwemakopi ekuchengetedza emidziyo yeIOS, inogona kuwanikwa pamadhiraivha mamwe chete). Kubatwa kwemalaptops uye nharembozha kuchave nehunhu hwayo. Ngatitaurei pamusoro peizvi zvakadzama.
WhatsApp zvigadzirwa muAroid device
Kuti abudise maWhatsApp artifacts kubva kune Android mudziyo, muongorori anofanira kunge aine kodzero dze superuser ('mudzi') pamudziyo uri kuferefetwa kana kukwanisa kuburitsa chiyeuchidzo chekurasa chemudziyo, kana faira yayo (semuenzaniso, kushandisa kusadzivirirwa kwesoftware yeimwe nharembozha).
Mafaira ekushandisa ari mundangariro dzefoni muchikamu chinochengetwa data remushandisi. Sezvo mutemo, chikamu ichi chinotumidzwa 'userdata'. Subdirectories uye mafaera echirongwa ari munzira: '/data/data/com.whatsapp/'.
Iwo makuru mafaera ane WhatsApp forensic artifacts mu Android OS idatabase 'wa.db' ΠΈ 'msgstore.db'.
Mu database 'wa.db' ine runyorwa rwakakwana rwemushandisi weWhatsApp, kusanganisira nhamba yefoni, zita rekuratidzira, zvitambi zvenguva, uye chero rumwe ruzivo rwakapihwa uchinyoresa kuWhatsApp. File 'wa.db' iri munzira: '/data/data/com.whatsapp/databases/' uye ine chimiro chinotevera:
Matafura anonyanya kunakidza mudura re database 'wa.db' nokuti muongorori ndeiyi:
- 'wa_contacts'
Iri tafura rine ruzivo rwekusangana: WhatsApp yekuonana id, ruzivo rwechimiro, zita rekuratidzira mushandisi, timestamps, nezvimwe.Kuonekwa kwetafura:
Tafura chimiroField name ukoshi _id rekodhi nhamba yekutevedzana (muSQL tafura) jid WhatsApp yekuonana ID, yakanyorwa nefomati <nhamba yefoni>@s.whatsapp.net ndiye_whatsapp_mushandisi ine '1' kana iyo yekubata ichienderana neyechokwadi WhatsApp mushandisi, '0' neimwe nzira chinzvimbo ine mavara anoratidzwa muchimiro chekubata status_timestamp ine chidhindo chenguva muUnix Epoch Time (ms) fomati nhamba nhamba yefoni yakabatana neanobata raw_contact_id contact serial number display_name zita rekuratidza zita phone_type mhando yefoni phone_label label yakabatana nenhamba yekubata zvisingaonekwi_msg_count nhamba yemameseji akatumirwa nemunhu anobatwa asi asina kuverengwa neanotambira photo_ts ine chitambi chenguva muUnix Epoch Time fomati chigunwe_ts ine chitambi chenguva muUnix Epoch Time fomati photo_id_timestamp ine chidhindo chenguva muUnix Epoch Time (ms) fomati zita rekupihwa Kukosha kwenzvimbo kunoenderana ne'display_name' kune yega yega wa_name WhatsApp zita rekuonana (zita rakatsanangurwa munhoroondo yemunhu anoratidzwa) sort_name zita rekuonana rinoshandiswa mukuronga mabasa nickname zita remadunhurirwa remunhu muWhatsApp (zita remadunhurirwa rinotsanangurwa muprofile yemunhu anoratidzwa) kambani kambani (iyo kambani inotsanangurwa muhuwandu hwemunhu inoratidzwa) musoro wenyaya zita (Ms./Mr.; zita rakagadzirirwa mune yekuonana mbiri inoratidzwa) offset kusarura - 'sqlite_sequence'
Tafura iyi ine ruzivo nezve nhamba yevanobatika; - 'android_metadata'
Iyi tafura ine ruzivo nezve WhatsApp mitauro yenzvimbo.
Mu database 'msgstore.db' ine ruzivo nezve mameseji akatumirwa, senge nhamba yekuonana, meseji meseji, meseji mamiriro, timestamps, ruzivo rwemafaera akatamiswa akabatanidzwa mumameseji, nezvimwe. File 'msgstore.db' iri munzira: '/data/data/com.whatsapp/databases/' uye ine chimiro chinotevera:
Matafura anonyanya kunakidza mufaira 'msgstore.db' nokuti muongorori ndeiyi:
- 'sqlite_sequence'
Tafura iyi ine ruzivo rwakakwana nezve database iyi, senge huwandu hwemeseji akachengetwa, huwandu hwese hwekutaura, nezvimwe.Kuonekwa kwetafura:
- 'message_fts_content'
Ine zvinyorwa zvemameseji akatumirwa.Kuonekwa kwetafura:
- 'meseji'
Iyi tafura ine ruzivo senge nhamba yekuonana, meseji meseji, meseji mamiriro, timestamps, ruzivo nezve akatamiswa mafaera akabatanidzwa mumameseji.Kuonekwa kwetafura:
Tafura chimiroField name ukoshi _id rekodhi nhamba yekutevedzana (muSQL tafura) key_remote_jid WhatsApp ID yekutaurirana shamwari kiyi_kubva_ kwandiri meseji nzira: '0' - iri kuuya, '1' - inobuda key_id yakasarudzika meseji identifier chinzvimbo meseji mamiriro: '0' - yaunzwa, '4' - yakamirira pane sevha, '5' - inogamuchirwa kwainoenda, '6' - control meseji, '13' - meseji yakavhurwa neanogamuchira (verenga) need_push ine kukosha '2' kana iri meseji yekutepfenyura, neimwe nzira ine '0' dhata meseji meseji (kana 'media_wa_type' parameter iri '0') timestamp ine timestamp mu Unix Epoch Time (ms) fomati, kukosha kunotorwa kubva kuchigadzirwa wachi media_url ine URL yefaira rakatamiswa (kana iyo 'media_wa_type' parameter iri '1', '2', '3') media_mime_type MIME mhando yefaira rakatamiswa (kana iyo 'media_wa_type' parameter yakaenzana ne '1', '2', '3') media_wa_type rudzi rwemeseji: '0' - zvinyorwa, '1' - graphic faira, '2' - audio faira, '3' - vhidhiyo faira, '4' - kadhi yekubata, '5' - geodata media_size saizi yefaira rakatamiswa (kana iyo 'media_wa_type' parameter iri '1', '2', '3') media_name zita refaira rakatamiswa (kana iyo 'media_wa_type' parameter iri '1', '2', '3') media_caption Iine mazwi ekuti 'audio', 'vhidhiyo' yezvikoshero zvinoenderana zve'media_wa_type' parameter (apo 'media_wa_type' parameter iri '1', '3') media_hash base64 encoded hashi yefaira rakatumirwa, rakaverengerwa uchishandisa HAS-256 algorithm (apo 'media_wa_type' parameter yakaenzana ne '1', '2', '3') media_duration nguva mumasekonzi efaira remedia (kana 'media_wa_type' iri '1', '2', '3') zvakabva ine kukosha '2' kana iri meseji yekutepfenyura, neimwe nzira ine '0' latitude geodata: latitude (kana 'media_wa_type' parameter iri '5') kureba geodata: longitude (kana 'media_wa_type' parameter iri '5') chigunwe_chifananidzo ruzivo rwebasa remote_resource Sender ID (yeboka rehurukuro chete) receive_timestamp nguva yekutambirwa, ine chidhindo chenguva muUnix Epoch Time (ms) fomati, kukosha kunotorwa kubva kuchigadzirwa wachi (kana iyo 'key_from_me' parameter ine '0', '-1' kana imwe kukosha) send_timestamp isina kushandiswa, kazhinji ine kukosha '-1' receipt_server_timestamp nguva inotambirwa nepakati server, ine chidhindo chenguva muUnix Epoch Time (ms) fomati, kukosha kunotorwa kubva kuchishandiso wachi (kana iyo 'key_from_me' parameter ine '1', '-1' kana imwe kukosha. receipt_device_timestamp nguva iyo meseji yakagamuchirwa nemumwe munhu anyoresa, ine chidhindo chenguva muUnix Epoch Time (ms) fomati, kukosha kunotorwa kubva kuchichichichi (kana iyo 'key_from_me' parameter ine '1', '-1' kana imwe kukosha. read_device_timestamp nguva yekuvhura (kuverenga) iyo meseji, ine timestamp muUnix Epoch Nguva (ms) fomati, kukosha kunotorwa kubva kuchigadzirwa wachi. play_device_timestamp nguva yekutamba meseji, ine chitambi chenguva muUnix Epoch Nguva (ms) fomati, kukosha kunotorwa kubva kuchichichiro. raw_data thumbnail yefaira rakatamiswa (kana iyo 'media_wa_type' parameter iri '1' kana '3') recipient_count nhamba yevanogamuchira (yekutepfenyura mameseji) participant_hash inoshandiswa pakutumira mameseji negeodata nyeredzi kwete kushandiswa quoted_row_id hazvizivikanwe, kazhinji zvine kukosha '0' zvataurwa_jids kwete kushandiswa multicast_id kwete kushandiswa offset kusarura Rondedzero yeminda iyi haina kukwana. Kune akasiyana vhezheni eWhatsApp, mamwe minda anogona kunge aripo kana kusavapo. Mukuwedzera, minda inogona kuvapo 'media_enc_hash', 'edit_version', 'payment_transaction_id' uye zvakadaro.
- 'messages_thumbnails'
Tafura iyi ine ruzivo nezve yakatamiswa mifananidzo uye zvitambi zvenguva. Muchikamu che'timestamp', nguva inoratidzwa muUnix Epoch Time (ms) fomati. - 'chat_list'
Tafura iyi ine ruzivo nezve chats.Kuonekwa kwetafura:
Zvakare, kana uchiongorora WhatsApp pane nharembozha inoshandisa Android, unofanirwa kuterera kune anotevera mafaera:
- faira 'msgstore.db.cryptXX' (apo XX iri manhamba kana maviri kubva pa0 kusvika pa12, semuenzaniso, msgstore.db.crypt12). Iine yakavharidzirwa backup yeWhatsApp mameseji (backup file msgstore.db) Mafaira 'msgstore.db.cryptXX' iri munzira: '/data/media/0/WhatsApp/Database/' (chaiyo SD kadhi), '/mnt/sdcard/WhatsApp/Databases/ (yemuviri SD kadhi)'.
- faira 'kiyi'. Ine cryptographic key. Inowanikwa munzira: '/data/data/com.whatsapp/files/'. Inoshandiswa kubvisa encrypted WhatsApp backups.
- faira 'com.whatsapp_preferences.xml'. Iine ruzivo nezve yako WhatsApp account profile. Iyo faira iri munzira: '/data/data/com.whatsapp/shared_prefs/'.
Faira zvemukati chidimbu
<?xml version="1.0" encoding="ISO-8859-1"?> β¦ <string name="ph">9123456789</string> (Π½ΠΎΠΌΠ΅Ρ ΡΠ΅Π»Π΅ΡΠΎΠ½Π°, Π°ΡΡΠΎΡΠΈΠΈΡΠΎΠ²Π°Π½Π½ΡΠΉ Ρ Π°ΠΊΠΊΠ°ΡΠ½ΡΠΎΠΌ WhatsApp) β¦ <string name="version">2.17.395</string> (Π²Π΅ΡΡΠΈΡ WhatsApp) β¦ <string name="my_current_status">Hey there! I am using WhatsApp.</string> (ΡΠΎΠΎΠ±ΡΠ΅Π½ΠΈΠ΅, ΠΎΡΠΎΠ±ΡΠ°ΠΆΠ°Π΅ΠΌΠΎΠ΅ Π² ΡΡΠ°ΡΡΡΠ΅ Π°ΠΊΠΊΠ°ΡΠ½ΡΠ°) β¦ <string name="push_name">Alex</string> (ΠΈΠΌΡ Π²Π»Π°Π΄Π΅Π»ΡΡΠ° Π°ΠΊΠΊΠ°ΡΠ½ΡΠ°) β¦ - faira 'kunyoresa.RegisterPhone.xml'. Iine ruzivo nezve nhamba yefoni yakabatana neiyo WhatsApp account. Iyo faira iri munzira: '/data/data/com.whatsapp/shared_prefs/'.
Zvinyorwa zvemafaira
<?xml version="1.0" encoding="ISO-8859-1"?> <map> <string name="com.whatsapp.registration.RegisterPhone.phone_number">9123456789</string> <int name="com.whatsapp.registration.RegisterPhone.verification_state" value="0"/> <int name="com.whatsapp.registration.RegisterPhone.country_code_position" value="-1"/> <string name="com.whatsapp.registration.RegisterPhone.input_phone_number">912 345-67-89</string> <int name="com.whatsapp.registration.RegisterPhone.phone_number_position" value="10"/> <string name="com.whatsapp.registration.RegisterPhone.input_country_code">7</string> <string name="com.whatsapp.registration.RegisterPhone.country_code">7</string> </map> - faira 'axolotl.db'. Iine cryptographic kiyi uye imwe data inodiwa kuti uone muridzi weakaundi. Inowanikwa munzira: '/data/data/com.whatsapp/databases/'.
- faira 'chatsettings.db'. Ine ruzivo rwekugadzirisa application.
- faira 'wa.db'. Rine zvekutaura. Iyo inonakidza kwazvo (kubva kune forensic chikamu) uye inodzidzisa dhatabhesi. Inogona kuve neruzivo rwakadzama nezve dzakadzimwa contacts.
Iwe zvakare unofanirwa kutarisisa kune anotevera madhairekitori:
- dhairetori '/data/media/0/WhatsApp/Media/WhatsApp Mifananidzo/'. Ine graphic mafaira akatamiswa.
- dhairetori '/data/media/0/WhatsApp/Media/WhatsApp Voice Notes/'. Ine mameseji ezwi mu.OPUS mafaira efomati.
- dhairetori '/data/data/com.whatsapp/cache/Profile Pictures/'. Iine graphic mafaira - mifananidzo yevanobatika.
- dhairetori '/data/data/com.whatsapp/files/Avatars/'. Iine graphic mafaira - thumbnail mifananidzo yevanobatika. Mafaira aya ane '.j' yekuwedzera asi zvakadaro ari maJPEG (JPG) mafaira emifananidzo.
- dhairetori '/data/data/com.whatsapp/files/Avatars/'. Iine graphic mafaira - mufananidzo uye thumbnail yemufananidzo wakaiswa seavatar nemuridzi weakaundi.
- dhairetori '/data/data/com.whatsapp/files/Logs/'. Iine chirongwa chekushanda kwechirongwa (faira 'whatsapp.log') uye makopi ekuchengetedza ehurongwa hwekushandisa (mafaira ane mazita ari mufomati whatsapp-yyyy-mm-dd.1.log.gz).
WhatsApp Log Mafaira:
Journal fragment2017-01-10 09:37:09.757 LL_I D [524:WhatsApp Worker #1] missedcallnotification/init count:0 timestamp:0
2017-01-10 09:37:09.758 LL_I D [524:WhatsApp Worker #1] missedcallnotification/update kanzura chokwadi
2017-01-10 09:37:09.768 LL_I D [1:main] app-init/load-me
2017-01-10 09:37:09.772 LL_I D [1:main] password file isipo kana kuverengeka
2017-01-10 09:37:09.782 LL_I D [1:main] nhamba Mameseji Mameseji: 59 akatumirwa, 82 akagamuchirwa / Media Messages: 1 yakatumirwa (0 bytes), 0 yakagamuchirwa (9850158 bytes) / Offline Messages: 81 yakagamuchirwa ( 19522 msec average delay) / Message Service: 116075 bytes sent, 211729 bytes received / Voip Calls: 1 inobuda nhare, 0 nhare dzinopinda, 2492 bytes dzakatumirwa, 1530 bytes yakagamuchirwa / Google Drive: 0 bytes yakatumirwa, 0 bytes yakagamuchirwa / 1524 Kutenderera 1826: mabhaiti akatumirwa, 118567 bytes akagamuchirwa / Yese Dhata: 10063417 bytes yakatumirwa, XNUMX bytes yakagamuchirwa
2017-01-10 09:37:09.785 LL_I D [1:main] media-state-manager/refresh-media-state/writable-media
2017-01-10 09:37:09.806 LL_I D [1:main] app-init/initialize/timer/stop: 24
2017-01-10 09:37:09.811 LL_I D [1:main] msgstore/checkhealth
2017-01-10 09:37:09.817 LL_I D [1:main] msgstore/checkhealth/journal/delete nhema
2017-01-10 09:37:09.818 LL_I D [1:main] msgstore/checkhealth/back/delete nhema
2017-01-10 09:37:09.818 LL_I D [1:main] msgstore/checkdb/data/data/com.whatsapp/databases/msgstore.db
2017-01-10 09:37:09.819 LL_I D [1:main] msgstore/checkdb/list _jobqueue-WhatsAppJobManager 16384 drw=011
2017-01-10 09:37:09.820 LL_I D [1:main] msgstore/checkdb/list _jobqueue-WhatsAppJobManager-journal 21032 drw=011
2017-01-10 09:37:09.820 LL_I D [1:main] msgstore/checkdb/list axolotl.db 184320 drw=011
2017-01-10 09:37:09.821 LL_I D [1:main] msgstore/checkdb/list axolotl.db-wal 436752 drw=011
2017-01-10 09:37:09.821 LL_I D [1:main] msgstore/checkdb/list axolotl.db-shm 32768 drw=011
2017-01-10 09:37:09.822 LL_I D [1:main] msgstore/checkdb/list msgstore.db 540672 drw=011
2017-01-10 09:37:09.823 LL_I D [1:main] msgstore/checkdb/list msgstore.db-wal 0 drw=011
2017-01-10 09:37:09.823 LL_I D [1:main] msgstore/checkdb/list msgstore.db-shm 32768 drw=011
2017-01-10 09:37:09.824 LL_I D [1:main] msgstore/checkdb/list wa.db 69632 drw=011
2017-01-10 09:37:09.825 LL_I D [1:main] msgstore/checkdb/list wa.db-wal 428512 drw=011
2017-01-10 09:37:09.825 LL_I D [1:main] msgstore/checkdb/list wa.db-shm 32768 drw=011
2017-01-10 09:37:09.826 LL_I D [1:main] msgstore/checkdb/list chatsettings.db 4096 drw=011
2017-01-10 09:37:09.826 LL_I D [1:main] msgstore/checkdb/list chatsettings.db-wal 70072 drw=011
2017-01-10 09:37:09.827 LL_I D [1:main] msgstore/checkdb/list chatsettings.db-shm 32768 drw=011
2017-01-10 09:37:09.838 LL_I D [1:main] msgstore/checkdb/version 1
2017-01-10 09:37:09.839 LL_I D [1:main] msgstore/canquery
2017-01-10 09:37:09.846 LL_I D [1:main] msgstore/canquery/count 1
2017-01-10 09:37:09.847 LL_I D [1:main] msgstore/canquery/timer/stop: 8
2017-01-10 09:37:09.847 LL_I D [1:main] msgstore/canquery 517 | nguva yakashandiswa:8
2017-01-10 09:37:09.848 LL_I D [529:WhatsApp Worker #3] media-state-manager/refresh-media-state/internal-storage iripo:1,345,622,016 total:5,687,922,688
- dhairetori '/data/media/0/WhatsApp/Media/WhatsApp Audio/'. Iine mafaira ekuteerera akagamuchirwa.
- dhairetori '/data/media/0/WhatsApp/Media/WhatsApp Audio/Sent/'. Iine mafaira ekuteerera akatumirwa.
- dhairetori '/data/media/0/WhatsApp/Media/WhatsApp Mifananidzo/'. Ine graphic mafaira anobuda.
- dhairetori '/data/media/0/WhatsApp/Media/WhatsApp Images/Sent/'. Ine graphic mafaira akatumirwa.
- dhairetori '/data/media/0/WhatsApp/Media/WhatsApp Vhidhiyo/'. Iine mafaira evhidhiyo akagamuchirwa.
- dhairetori '/data/media/0/WhatsApp/Media/WhatsApp Vhidhiyo/Sent/'. Ine mavhidhiyo mafaira akatumirwa.
- dhairetori '/data/media/0/WhatsApp/Media/WhatsApp Profile Photos/'. Ine graphic mafaira ane hukama nemuridzi weWhatsApp account.
- Kuti uchengetedze nzvimbo yekuyeuka pane yako Android smartphone, imwe WhatsApp data inogona kuchengetwa pane SD kadhi. Pakadhi re SD, mumudziyo wedhairekitori, pane dhairekitori 'WhatsApp', uko zvinotevera zvigadzirwa zvechirongwa ichi zvinogona kuwanikwa:
- dhairetori '.Share' ('/mnt/sdcard/WhatsApp/.Share/') Iine makopi emafaira akagovaniswa nevamwe vashandisi veWhatsApp.
- dhairetori '.marara' ('/mnt/sdcard/WhatsApp/.trash/') Ine mafaira akadzimwa.
- dhairetori 'Databases' ('/mnt/sdcard/WhatsApp/Databases/') Ine encrypted backups. Vanogona kucheneswa kana faira iripo 'kiyi', yakatorwa mundangariro yechigadzirwa chakaongororwa.
Mafaira ari mune subdirectory 'Databases':
- dhairetori 'Hafu' ('/mnt/sdcard/WhatsApp/Media/') Ine subdirectories 'WallPaper', 'WhatsApp Audio', 'WhatsApp Mifananidzo', 'WhatsApp Profile Photos', 'WhatsApp Vhidhiyo', 'WhatsApp Voice Notes', iyo ine yakagamuchirwa uye yakafambiswa multimedia mafaera (mafaira emifananidzo, mavhidhiyo mafaera, mameseji ezwi, mapikicha ane hukama neprofile yemuridzi weWhatsApp account, mapikicha).
- dhairetori 'Profile Pictures' ('/mnt/sdcard/WhatsApp/Profile Pictures/') Iine graphic mafaera ane hukama neiyo mbiri yeWhatsApp account muridzi.
- Dzimwe nguva panogona kunge paine dhairekitori iripo pane SD kadhi 'mafaira' ('/mnt/sdcard/WhatsApp/Files/') Iri dhairekitori rine mafaera anochengeta marongero echirongwa uye zvido zvevashandisi.
Zvimiro zvekuchengetedza data mune mamwe mamodheru enharembozha
Mamwe mamodheru emidziyo mbozha inoshandisa Android OS inogona kuchengeta WhatsApp zvigadzirwa munzvimbo yakasiyana. Izvi zvinokonzerwa neshanduko munzvimbo yekuchengetera data rekushandisa nesoftware system yenharembozha. Semuenzaniso, Xiaomi nharembozha ine basa rekugadzira yechipiri nzvimbo yekushandira ("SecondSpace"). Kana basa iri raitwa, nzvimbo ye data inoshanduka. Saka, kana mune yenguva dzose nharembozha inoshandisa Android OS mushandisi data inochengetwa mudhairekitori '/data/mushandisi/0/' (inova inonongedza kune zvakajairwa '/data/data/'), ipapo mune yechipiri workspace application data inochengetwa mudhairekitori '/data/mushandisi/10/'. Ndiko, kushandisa muenzaniso wenzvimbo yefaira 'wa.db':
- mune yenguva dzose smartphone inoshandisa Android OS: /data/user/0/com.whatsapp/databases/wa.db' (izvo zvakaenzana '/data/data/com.whatsapp/databases/wa.db');
- mune yechipiri nzvimbo yekushanda yeXiaomi smartphone: '/data/user/10/com.whatsapp/databases/wa.db'.
WhatsApp zvigadzirwa mune iOS mudziyo
Kusiyana neAroid OS, muIOS WhatsApp data data inoendeswa kune kopi yekuchengetedza (iTunes backup). Naizvozvo, kubvisa data kubva kuchishandiso ichi hakudi kuburitsa iyo faira system kana kugadzira yemuviri yekurasa yekurangarira kwechishandiso chiri kuferefetwa. Ruzhinji rweruzivo rwakakodzera rwuri mudhatabhesi 'ChatStorage.sqlite', iyo iri munzira: '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/' (mune mamwe mapurogiramu nzira iyi inoratidzika se 'AppDomainGroup-group.net.whatsapp.WhatsApp.shared').
mamiriro 'ChatStorage.sqlite':
Iwo anonyanya kudzidzisa matafura mu 'ChatStorage.sqlite' dhatabhesi ndeaya 'ZWAMESSAGE' ΠΈ 'ZWAMEDIAITEM'.
Tafura kuonekwa 'ZWAMESSAGE':
Chimiro chetafura 'ZWAMESSAGE'
| Field name | ukoshi |
|---|---|
| Z_PK | rekodhi nhamba yekutevedzana (muSQL tafura) |
| Z_ENT | tafura identifier, ine kukosha '9' |
| Z_OPT | isingazivikanwe, kazhinji ine kukosha kubva '1' kusvika '6' |
| ZCHILDMESSAGESDELIVEREDCOUNT | hazvizivikanwe, kazhinji zvine kukosha '0' |
| ZCHILDMESSAGESPLAYEDCOUNT | hazvizivikanwe, kazhinji zvine kukosha '0' |
| ZCHILDMESSAGESREADCOUNT | hazvizivikanwe, kazhinji zvine kukosha '0' |
| ZDATAITEMVERSION | isingazivikanwe, kazhinji ine kukosha '3', pamwe chiratidzo chemeseji |
| ZDOCID | hazvizivikanwe |
| ZENCRETRYCOUNT | hazvizivikanwe, kazhinji zvine kukosha '0' |
| ZFILTEREDRECIPIENTCOUNT | isingazivikanwe, kazhinji ine kukosha '0', '2', '256' |
| ZISFROMME | meseji nzira: '0' - iri kuuya, '1' - inobuda |
| ZMESSAGEERRORSATUS | mamiriro ekutumira meseji. Kana meseji ikatumirwa/yakagamuchirwa, saka ine kukosha kwe'0' |
| ZMESSAGETYPE | mhando yemeseji iri kufambiswa |
| ZSORT | hazvizivikanwe |
| ZSPOTLIGHTATUS | hazvizivikanwe |
| ZSTARRED | hazvizivikanwe, kwete kushandiswa |
| ZCHATSESSION | hazvizivikanwe |
| ZGROUPMEMBER | hazvizivikanwe, kwete kushandiswa |
| ZLASTSESSION | hazvizivikanwe |
| ZMEDIAITEM | hazvizivikanwe |
| ZMESSAGEINFO | hazvizivikanwe |
| ZPARENTMESSAGE | hazvizivikanwe, kwete kushandiswa |
| ZMESSAGEDATE | timestamp mu OS X Epoch Nguva fomati |
| ZSENTDATE | nguva iyo meseji yakatumirwa muOS X Epoch Nguva fomati |
| ZFROMJID | WhatsApp Sender ID |
| ZMEDIASECTIONID | ine gore nemwedzi iyo faira yenhau yakatumirwa |
| ZPHASH | hazvizivikanwe, kwete kushandiswa |
| ZPUSHPAME | zita remunhu atumira iyo media faira muUTF-8 fomati |
| ZSTANZID | yakasarudzika meseji identifier |
| ZTEXT | Message text |
| ZTOJID | Chitupa cheWhatsApp cheanogamuchira |
| OFFSET | kusarura |
Tafura kuonekwa 'ZWAMEDIAITEM':
Chimiro chetafura 'ZWAMEDIAITEM'
| Field name | ukoshi |
|---|---|
| Z_PK | rekodhi nhamba yekutevedzana (muSQL tafura) |
| Z_ENT | tafura identifier, ine kukosha '8' |
| Z_OPT | isingazivikanwe, kazhinji ine kukosha kubva '1' kusvika '3'. |
| ZCLOUDSTATUS | ine kukosha '4' kana iyo faira yakatakurwa. |
| ZFILESIZE | ine hurefu hwefaira (mumabhayiti) emafaira akatorwa |
| ZMEDIAORIGIN | isingazivikanwe, kazhinji ine kukosha '0' |
| ZMOVIEDURATION | Kureba kweiyo midhiya faira, yePDF mafaera anogona kunge aine nhamba yemapeji egwaro |
| ZMESSAGE | ine serial number (nhamba yacho yakasiyana neinotaridzwa mu'Z_PK' column) |
| ZASPECTRATIO | Aspect ratio, isina kushandiswa, inowanzoiswa ku '0' |
| ZHACCURACY | isingazivikanwe, kazhinji ine kukosha '0' |
| ZLATTITUDE | hupamhi mumapikiseli |
| ZLONGTITUDE | kureba mumapikiseli |
| ZMEDIAURLDATE | timestamp mu OS X Epoch Nguva fomati |
| ZAUTHORNAME | munyori (yezvinyorwa, anogona kunge aine zita refaira) |
| ZCOLLECTIONNAME | kwete kushandiswa |
| ZMEDIALOCALPATH | zita refaira (kusanganisira nzira) mune mudziyo faira system |
| ZMEDIAURL | Iyo URL paive ne media file. Kana faira rakatamiswa kubva kune mumwe munyoreri kuenda kune mumwe, iro rakavharidzirwa uye kuwedzera kwaro kucharatidzwa sekuwedzerwa kwefaira rakatamiswa - .enc. |
| ZTHUMBNAILLOCALPATH | nzira kune iyo faira thumbnail mune mudziyo faira system |
| ZTITLE | file header |
| ZVCARDNAME | hash yefaira re media; kana uchiendesa faira kuboka, rinogona kunge riine chinozivisa anotumira |
| ZVCARDSTRING | ine ruzivo rwemhando yefaira iri kutamiswa (semuenzaniso, mufananidzo/jpeg); kana uchiendesa faira kuboka, rinogona kunge riine chiziviso cheari kutambira. |
| ZXMPPTHUMBPATH | nzira kune iyo faira thumbnail mune mudziyo faira system |
| ZMEDIAKEY | isingazivikanwe, pamwe ine kiyi yekubvisa iyo encrypted faira. |
| ZMETADATA | metadata yemeseji inotumirwa |
| Offset | kusarura |
Mamwe matafura edatabase anonakidza 'ChatStorage.sqlite' nde:
- 'ZWAPROFILEPUSHNAME'. Inofananidza WhatsApp ID ine zita rekuonana;
- 'ZWAPROFILEPICTUREITEM'. Inofananidza WhatsApp ID neavatar yekubata;
- 'Z_PRIMARYKEY'. Iyo tafura ine ruzivo rwakakwana nezve database iyi, senge huwandu hwese hwemeseji akachengetwa, huwandu hwese hwekutaura, nezvimwe.
Zvakare, kana uchiongorora WhatsApp pane nharembozha inoshandisa iOS, iwe unofanirwa kuterera kune anotevera mafaera:
- faira 'BackedUpKeyValue.sqlite'. Iine cryptographic kiyi uye imwe data inodiwa kuti uone muridzi weakaundi. Inowanikwa munzira: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- faira 'ContactsV2.sqlite'. Iine ruzivo nezve mameseji emushandisi, senge zita rakazara, nhamba yefoni, mamiriro ekubata (mune mameseji fomu), WhatsApp ID, nezvimwe. Inowanikwa munzira: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- faira 'consumer_version'. Iine nhamba yevhezheni yeiyo yakaiswa WhatsApp application. Inowanikwa munzira: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- faira 'current_wallpaper.jpg'. Iine yazvino WhatsApp yekumashure Wallpaper. Inowanikwa munzira: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/. Shanduro dzekare dzekushandisa dzinoshandisa faira 'wallpaper', iyo iri munzira: '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/'.
- faira 'blockedcontacts.dat'. Rine ruzivo nezve vanhu vakavharirwa contacts. Inowanikwa munzira: /private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/.
- faira 'pw.dat'. Ine password yakavanzika. Inowanikwa munzira: '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/'.
- faira 'net.whatsapp.WhatsApp.plist' (kana faira 'group.net.whatsapp.WhatsApp.shared.plist') Iine ruzivo nezve yako WhatsApp account profile. Iyo faira iri munzira: '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Library/Preferences/'.
Zviri mukati mefaira 'group.net.whatsapp.WhatsApp.shared.plist'
Iwe zvakare unofanirwa kutarisisa kune anotevera madhairekitori:
- dhairetori '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Media/Profile/'. Iine zvigunwe zvevanobatika, mapoka (mafaira ane kuwedzera chigunwe), kubata maavatars, WhatsApp muridzi weakaundi avatar (faira 'Photo.jpg').
- dhairetori '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Message/Media/'. Ine multimedia mafaira uye zvigunwe zvavo
- dhairetori '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/'. Iine chirongwa chekushanda kwepurogiramu (faira 'calls.log') uye makopi ekuchengetedza ehurongwa hwekushandisa matanda (faira 'calls.backup.log').
- dhairetori '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/stickers/'. Iine zvimiti (mafaira ari mufomati '.webp').
- dhairetori '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/Logs/'. Iine zvinyorwa zvekushanda kwepurogiramu.
WhatsApp zvigadzirwa paWindows
WhatsApp artifacts paWindows inogona kuwanikwa munzvimbo dzinoverengeka. Chekutanga pane zvese, aya madhairekitori ane zvinogoneka uye anobatsira ehurongwa mafaera (yeWindows 8/10):
- 'C:Mafaira eChirongwa (x86)WhatsApp'
- 'C:Vashandisi%Mushandisi profile% AppDataLocalWhatsApp'
- 'C:Vashandisi%Mushandisi profile% AppDataLocalVirtualStore Program Files (x86)WhatsApp'
Mutsamba 'C:Vashandisi%Mushandisi profile% AppDataLocalWhatsApp' iyo log file iripo 'SquirrelSetup.log', iyo ine ruzivo rwekutarisa zvigadziriso uye kuisa chirongwa.
Mutsamba 'C:Vashandisi%Mushandisi profile% AppDataRoamingWhatsApp' Kune akati wandei subdirectories:
faira 'main-process.log' ine ruzivo nezve kushanda kweiyo WhatsApp chirongwa.
Subdirectory 'databases' ine faira 'Databases.db', asi faira iri harina chero ruzivo nezve chats kana mazita.
Iyo inonyanya kunakidza kubva kune forensic point yekuona mafaera ari mudhairekitori 'Cache'. Aya ndiwo mafaera ane mazita 'f_*******' (apo * inhamba kubva 0 kusvika 9) ine encrypted multimedia mafaera uye zvinyorwa, asi pane zvakare asina kunyorwa mafaira pakati pawo. Kunyanya kufarira mafaera 'data_0', 'data_1', 'data_2', 'data_3', iri muchikamu chimwe chetecho. Files 'data_0', 'data_1', 'data_3' ine zvekunze zvinongedzo kune akatemerwa encrypted multimedia mafaera uye zvinyorwa.
Muenzaniso weruzivo rwuri mufaira 'data_1'
Uyewo faira 'data_3' inogona kunge iine graphic mafaira.
faira 'data_2' ine mavatars ekusangana (anogona kudzoreredzwa nekutsvaga nemusoro wemafaira).
MaAvatars ari mufaira 'data_2':
Nekudaro, iyo chats pachayo haigone kuwanikwa mundangariro yekombuta, asi unogona kuwana:
- multimedia mafaira;
- zvinyorwa zvinofambiswa neWhatsApp;
- ruzivo nezve macontacts emuridzi weakaundi.
WhatsApp zvigadzirwa paMacOS
MuMacOS unogona kuwana mhando dzeWhatsApp zvigadzirwa zvakafanana neizvo zvinowanikwa muWindows OS.
Mafaira echirongwa ari mune anotevera madhairekitori:
- 'C:ApplicationsWhatsApp.app'
- 'C:Applications._WhatsApp.app'
- 'C:Vashandisi%Mushandisi profile%LibraryPreferences'
- 'C:Vashandisi%Mushandisi profile%LibraryLogsWhatsApp'
- 'C:Vashandisi%Mushandisi profile%LibraryYakachengetedzwa Chikumbiro StateWhatsApp.savedState'
- 'C:Vashandisi%Mushandisi profile%LibraryApplication Scripts'
- 'C:Vashandisi% Mushandisi chimiro%LibraryApplication SupportCloudDocs'
- 'C:Vashandisi%Mushandisi profile%LibraryApplication SupportWhatsApp.ShipIt'
- 'C:Vashandisi%Chimiro chemushandisi%LibraryContainerscom.rockysandstudio.app-for-whatsapp'
- 'C:Vashandisi% Mushandisi chimiro% Raibhurari Nhare Zvinyorwa <text variable> WhatsApp Accounts'
Iri dhairekitori rine subdirectories mazita ane nhamba dzenhare dzine chekuita nemuridzi weWhatsApp account. - 'C:Vashandisi%Mushandisi profile%LibraryCachesWhatsApp.ShipIt'
Iri dhairekitori rine ruzivo rwekuisa chirongwa. - 'C:Vashandisi%Chimiro chemushandisi%Mufananidzo Photo Library.photolibraryMasters', 'C:Vashandisi%Chimiro chemushandisi%MufananidzoMufananidzo Raibhurari.photolibraryZvifananidzo'
Aya madhairekitori ane mafaera esevhisi echirongwa, anosanganisira mafoto uye zvidhori zveWhatsApp contacts. - 'C:Vashandisi%Mushandisi profile%LibraryCachesWhatsApp'
Iri dhairekitori rine akati wandei eSQLite dhatabhesi anoshandiswa kuchengetera data. - 'C:Vashandisi%Mushandisi profile%LibraryApplication SupportWhatsApp'
Iri dhairekitori rine akati wandei subdirectories:
Mutsamba 'C:Vashandisi%Mushandisi profile%LibraryApplication SupportWhatsAppCache' pane mafaira 'data_0', 'data_1', 'data_2', 'data_3' uye mafaira ane mazita 'f_*******' (apo * iri nhamba kubva pa0 kusvika pa9). Kuti uwane ruzivo nezve ruzivo rwune mafaera aya, ona WhatsApp Artifacts paWindows.Mutsamba 'C:Vashandisi%Mushandisi profile%LibraryApplication SupportWhatsAppIndexedDB' inogona kunge iine mafaera emultimedia (mafaira haana ekuwedzera).
faira 'main-process.log' ine ruzivo nezve kushanda kweiyo WhatsApp chirongwa.
Sources
- Forensic ongororo yeWhatsApp Messenger pane Android smartphones, naCosimo Anglano, 2014.
- Whatsapp Forensics: Dzidziso yeSitemu inogadzirwa uye hwaro hwedata pakushandisa Android uye iOS naAhmad Pratama, 2014.
Muzvinyorwa zvinotevera munhevedzano iyi:
Decryption ye encrypted WhatsApp databasesChinyorwa chinozopa ruzivo rwekuti kiyi yeWhatsApp encryption inogadzirwa sei uye mienzaniso inoshanda inoratidza manyorero akavharidzirwa dhatabhesi echishandiso ichi.
Kubvisa WhatsApp data kubva kuchengetwa kwegoreChinyorwa chatichakuudza kuti ndeipi iyo WhatsApp data yakachengetwa mumakore uye kutsanangura nzira dzekudzoreredza iyi data kubva kune cloud storages.
WhatsApp Kubvisa Dhata: Mienzaniso InoshandaChinyorwa chinotsanangura nhanho nhanho izvo zvirongwa uye nzira yekubvisa WhatsApp data kubva kune dzakasiyana siyana.
Source: www.habr.com