Haeba u batla ho tseba hore na ke mefuta efe ea li-artifact tsa WhatsApp tse teng lits'ebetsong tse fapaneng tsa ts'ebetso le hore na li ka fumanoa hokae, joale ke sebaka sa hau. Sengoliloeng sena se tsoa ho setsebi sa Sehlopha sa IB Computer Forensics Laboratory Igor Mikhailov e qala letoto la lipehelo mabapi le forensics ea WhatsApp le hore na ke tlhahisoleseling efe e ka fumanoang ha ho hlahlojoa sesebelisoa.
Ha re hlokomele hang-hang hore lits'ebetso tse fapaneng tsa ts'ebetso li boloka mefuta e fapaneng ea lintho tsa khale tsa WhatsApp, 'me haeba mofuputsi a ka ntša mefuta e itseng ea data ea WhatsApp sesebelisoa se le seng, sena ha se bolele hore mefuta e tšoanang ea data e ka ntšoa sesebelisoa se seng. Mohlala, haeba yuniti ea sistimi e sebelisang Windows OS e tlosoa, lipuisano tsa WhatsApp mohlomong li ke ke tsa fumanoa ho li-disk tsa eona (ntle le likopi tsa "backup" tsa lisebelisoa tsa iOS, tse ka fumanoang ho li-drive tse tšoanang). Ho ts'oaroa ha lilaptop le lisebelisoa tsa mehala ho tla ba le litšobotsi tsa eona. A re ke re bue ka taba ena ka botlalo.
Lisebelisoa tsa WhatsApp ho sesebelisoa sa Android
Bakeng sa ho ntša lintho tsa khale tsa WhatsApp ho sesebelisoa sa Android, mofuputsi o tlameha ho ba le litokelo tsa superuser ('motso') sesebelisoa se ntseng se etsoa lipatlisiso kapa se khona ho ntša thotobolo ea mohopolo oa sesebelisoa, kapa sistimi ea sona ea faele (mohlala, ho sebelisa bofokoli ba software ea sesebelisoa se itseng sa mohala).
Lifaele tsa ts'ebeliso li fumaneha memoring ea mohala sebakeng seo data ea mosebelisi e bolokiloeng ho sona. E le molao, karolo ena e bitsoa 'database'. Li-subdirectories le lifaele tsa lenaneo li fumaneha tseleng: '/data/data/com.whatsapp/'.
Lifaele tsa mantlha tse nang le li-artifacts tsa WhatsApp tsa forensic ho Android OS ke li-database 'wa.db' и 'msgstore.db'.
Ka polokelongtshedimosetso 'wa.db' e na le lethathamo le felletseng la mabitso a mosebelisi oa WhatsApp, ho kenyeletsoa nomoro ea mohala, lebitso la ponts'o, litempe tsa linako le tlhaiso-leseling efe kapa efe e fanoeng ha u ntse u ingolisa bakeng sa WhatsApp. Faele 'wa.db' e lutseng tseleng: '/data/data/com.whatsapp/databases/' mme e na le sebopeho se latelang:
Litafole tse khahlisang haholo polokelong ea litaba 'wa.db' hobane bafuputsi ke:
- 'wa_contacts'
Tafole ena e na le lintlha tsa mabitso: ID ea mabitso a WhatsApp, lintlha tsa boemo, lebitso la mosebelisi, litempe tsa linako, jj.Ponahalo ea tafole:
Sebopeho sa tafoleLebitso la tšimo boleng _id nomoro ea tatellano ea rekoto (tafoleng ea SQL) jid ID ea mabitso a WhatsApp, e ngotsoeng ka mokhoa oa <phone number>@s.whatsapp.net ke_mosebelisi_wa_whatsapp e na le '1' haeba lebitso le lumellana le mosebelisi oa nnete oa WhatsApp, '0' ho seng joalo boemo e na le mongolo o bontshitsweng boemong ba lebitso status_timestamp e na le setempe sa nako ka sebopeho sa Unix Epoch Time (ms). palo nomoro ea mohala e amanang le lebitso raw_contact_id nomoro ea mohala oa mohala lebitso le hlahang lebitso la pontsho ya mabitso mohala_mofuta mofuta oa fono phone_label label e amanang le nomoro ea ho ikopanya sa bonahale_msg_count palo ea melaetsa e rometsoeng ke motho eo u leng ho eona empa e sa baloe ke moamoheli foto_ts e na le setempe sa nako ka sebopeho sa Unix Epoch Time monoana_ts e na le setempe sa nako ka sebopeho sa Unix Epoch Time foto_id_setempe sa nako e na le setempe sa nako ka sebopeho sa Unix Epoch Time (ms). lebitso le fanoeng boleng ba sebaka bo tsamaisana le 'display_name' bakeng sa lebitso le leng le le leng lebitso la_le Lebitso la motho ea amanang le WhatsApp (lebitso le boletsoeng profaeleng ea lebitso le hlaha) mofuta_lebitso lebitso la lebitso le sebelisitsoeng ho hlophisa lebitso la bosoalo lebitso la bosoasoi la lebitso ho WhatsApp (lebitso la bosoasoi le boletsoeng profaeleng ea lebitso le a hlaha) khampani khamphani (k'hamphani e boletsoeng profilaneng ea lebitso e bonts'itsoe) tlotla sehlooho (Mof./Mong.; sehlooho se hlophisitsoeng profaeleng ea mabitso se a hlaha) khaotsa leeme - 'sqlite_sequence'
Tafole ena e na le tlhahisoleseling mabapi le palo ea mabitso; - 'android_metadata'
Tafole ena e na le tlhahisoleseling mabapi le tlhahiso ea puo ea WhatsApp.
Ka polokelongtshedimosetso 'msgstore.db' e na le tlhahisoleseling mabapi le melaetsa e rometsoeng, joalo ka nomoro ea mohala, mongolo oa molaetsa, boemo ba molaetsa, litempe tsa nako, lintlha tsa lifaele tse fetisitsoeng tse kenyellelitsoeng melaetsa, joalo-joalo. Faele 'msgstore.db' e lutseng tseleng: '/data/data/com.whatsapp/databases/' mme e na le sebopeho se latelang:
Litafole tse khahlisang haholo faeleng 'msgstore.db' hobane bafuputsi ke:
- 'sqlite_sequence'
Tafole ena e na le tlhaiso-leseling e akaretsang mabapi le database ena, joalo ka palo eohle ea melaetsa e bolokiloeng, palo eohle ea lipuisano, jj.Ponahalo ea tafole:
- 'message_fts_content'
E na le mongolo oa melaetsa e rometsoeng.Ponahalo ea tafole:
- 'melaetsa'
Tafole ena e na le tlhahisoleseling joalo ka nomoro ea mohala, mongolo oa molaetsa, boemo ba molaetsa, litempe tsa linako, tlhahisoleseling mabapi le lifaele tse fetisitsoeng tse kenyellelitsoeng melaetsa.Ponahalo ea tafole:
Sebopeho sa tafoleLebitso la tšimo boleng _id nomoro ea tatellano ea rekoto (tafoleng ea SQL) key_remote_jid ID ea WhatsApp ea molekane oa puisano key_ho tswa_ho nna tsela ea molaetsa: '0' - e kenang, '1' - e tsoang key_id sekhetho sa molaetsa se ikhethileng boemo boemo ba molaetsa: '0' - e filwe, '4' - e emetse seva, '5' - e amohetswe moo o yang teng, '6' - molaetsa wa taolo, '13' - molaetsa o butsweng ke moamohedi (bala) hloka_sututsa e na le boleng ba '2' haeba e le molaetsa oa phatlalatso, ho seng joalo e na le '0' ya data mongolo oa molaetsa (ha parameter ea 'media_wa_type' e le '0') timestamp e na le setempe sa nako ka sebopeho sa Unix Epoch Time (ms), boleng bo nkuoa oacheng ea sesebelisoa media_url e na le URL ea faele e fetisitsoeng (ha paramethara ea 'media_wa_type' e le '1', '2', '3') media_mime_mofuta Mofuta oa MIME oa faele e fetisitsoeng (ha paramethara ea 'media_wa_type' e lekana le '1', '2', '3') media_wa_mofuta mofuta oa molaetsa: '0' - mongolo, '1' - faele ea setšoantšo, '2' - faele ea molumo, '3' - faele ea video, '4' - karete ea ho ikopanya, '5' - geodata media_size boholo ba faele e fetisitsoeng (ha parameter ea 'media_wa_type' e le '1', '2', '3') media_lebitso Lebitso la faele e fetisitsoeng (ha paramethara ea 'media_wa_type' e le '1', '2', '3') media_caption E na le mantsoe 'audio', 'video' bakeng sa boleng bo tsamaisanang ba paramethara ea 'media_wa_type' (ha paramethara ea 'media_wa_type' e le '1', '3') media_hash base64 encoded hash ea faele e fetisoang, e baloang ho sebelisoa algorithm ea HAS-256 (ha parameter ea 'media_wa_type' e lekana le '1', '2', '3') media_duration nako ka metsotsoana bakeng sa faele ea media (ha 'media_wa_type' e le '1', '2', '3') tsoalo e na le boleng ba '2' haeba e le molaetsa oa phatlalatso, ho seng joalo e na le '0' latitude geodata: latitude (ha parameter ea 'media_wa_type' e le '5') bolelele geodata: longitude (ha parameter ea 'media_wa_type' e le '5') setšoantšo_sa monoana lintlha tsa tšebeletso remote_resource ID ea moromeli (bakeng sa lipuisano tsa sehlopha feela) receive_timestamp nako ea ho fumana, e na le setempe sa nako ka sebopeho sa Unix Epoch Time (ms), boleng bo nkuoa ho tsoa ho sesupa-nako sa sesebelisoa (ha paramethara ea 'key_from_me' e na le '0', '-1' kapa boleng bo bong) send_timestamp ha e sebelisoe, hangata e na le boleng '-1' receipt_server_timestamp nako e amohetsoeng ke seva e bohareng, e na le setempe sa nako ka sebopeho sa Unix Epoch Time (ms), boleng bo nkuoa oacheng ea sesebelisoa (ha paramethara ea 'key_from_me' e na le '1', '-1' kapa boleng bo bong. receipt_device_timestamp nako eo molaetsa o amohetsoeng ke motho e mong ea ngolisitseng, e na le setempe sa nako ka sebopeho sa Unix Epoch Time (ms), boleng bo nkuoa oacheng ea sesebelisoa (ha "key_from_me" parameter e na le '1', '-1' kapa boleng bo bong. bala_device_timestamp nako ea ho bula (ho bala) molaetsa, e na le setempe sa nako ka sebopeho sa Unix Epoch Time (ms), boleng bo nkuoa oacheng ea sesebelisoa. play_device_timestamp nako ea ho bapala molaetsa, e na le setempe sa nako ka sebopeho sa Unix Epoch Time (ms), boleng bo nkuoa oacheng ea sesebelisoa. data_e tala setšoantšo sa faele e fetisitsoeng (ha paramethara ea 'media_wa_type' e le '1' kapa '3') palo_moamohedi palo ea baamoheli (bakeng sa melaetsa e hasoang) morupeluoa_hash se sebedisoang ha o fetisa melaetsa ka geodata e na le linaleli ha e sebelisoe qotsitsoeng_row_id ha e tsejoe, hangata e na le boleng ba '0' boletsoeng_jids ha e sebelisoe multicast_id ha e sebelisoe khaotsa leeme Lethathamo lena la masimo ha le feletse. Bakeng sa mefuta e fapaneng ea WhatsApp, likarolo tse ling li kanna tsa ba teng kapa li le sieo. Ho feta moo, libaka li ka ba teng 'media_enc_hash', 'edit_version', 'payment_transaction_id' joalo-joalo.
- 'melaetsa_li-thumbnails'
Tafole ena e na le leseli mabapi le litšoantšo tse fetisitsoeng le litempe tsa linako. Kholomong ea 'setempe sa nako', nako e hlahisoa ka sebopeho sa Unix Epoch Time (ms). - 'chat_list'
Tafole ena e na le lintlha mabapi le lipuisano.Ponahalo ea tafole:
Hape, ha u hlahloba WhatsApp sesebelisoa sa mohala se sebelisang Android, u lokela ho ela hloko lifaele tse latelang:
- faele 'msgstore.db.cryptXX' (moo XX e leng palo e le 'ngoe kapa tse peli ho tloha ho 0 ho ea ho 12, mohlala, msgstore.db.crypt12). E na le "backup" ea melaetsa ea WhatsApp (backup file msgstore.db). Lifaele 'msgstore.db.cryptXX' e lutseng tseleng: '/data/media/0/whatsapp/database/' (karete ea SD ea sebele), '/mnt/sdcard/whatsapp/database/ (karete ea SD ea 'mele)'.
- faele 'key'. E na le senotlolo sa "cryptographic". E lutse tseleng: '/data/data/com.whatsapp/files/'. E sebelisetsoa ho hlakola li-backups tsa WhatsApp tse patiloeng.
- faele 'com.whatsapp_preferences.xml'. E na le tlhahisoleseling mabapi le profaele ea akhaonto ea hau ea WhatsApp. Faele e fumaneha haufi le tsela: '/data/data/com.whatsapp/shared_prefs/'.
Sekhechana sa litaba tsa faele
<?xml version="1.0" encoding="ISO-8859-1"?> … <string name="ph">9123456789</string> (номер телефона, ассоциированный с аккаунтом WhatsApp) … <string name="version">2.17.395</string> (версия WhatsApp) … <string name="my_current_status">Hey there! I am using WhatsApp.</string> (сообщение, отображаемое в статусе аккаунта) … <string name="push_name">Alex</string> (имя владельца аккаунта) … - faele 'ngodiso.RegisterPhone.xml'. E na le leseli mabapi le nomoro ea mohala e amanang le ak'haonte ea WhatsApp. Faele e fumaneha haufi le tsela: '/data/data/com.whatsapp/shared_prefs/'.
Likahare tsa faele
<?xml version="1.0" encoding="ISO-8859-1"?> <map> <string name="com.whatsapp.registration.RegisterPhone.phone_number">9123456789</string> <int name="com.whatsapp.registration.RegisterPhone.verification_state" value="0"/> <int name="com.whatsapp.registration.RegisterPhone.country_code_position" value="-1"/> <string name="com.whatsapp.registration.RegisterPhone.input_phone_number">912 345-67-89</string> <int name="com.whatsapp.registration.RegisterPhone.phone_number_position" value="10"/> <string name="com.whatsapp.registration.RegisterPhone.input_country_code">7</string> <string name="com.whatsapp.registration.RegisterPhone.country_code">7</string> </map> - faele 'axolotl.db'. E na le linotlolo tsa cryptographic le lintlha tse ling tse hlokahalang ho tsebahatsa mong'a akhaonto. E lutse tseleng: '/data/data/com.whatsapp/databases/'.
- faele 'chatsettings.db'. E na le lintlha tsa tlhophiso ea sesebelisoa.
- faele 'wa.db'. E na le lintlha tsa mabitso. Sebaka se khahlisang haholo (ho tsoa karolong ea forensic) le database e rutang. E ka ba le lintlha tse qaqileng mabapi le hlakolwa mabitso.
U boetse u hloka ho ela hloko li-directory tse latelang:
- dibaka '/data/media/0/WhatsApp/Media/Litšoantšo tsa WhatsApp/'. E na le lifaele tsa litšoantšo tse fetisitsoeng.
- dibaka '/data/media/0/WhatsApp/Media/WhatsApp Voice Notes/'. E na le melaetsa ea lentsoe ka lifaele tsa sebopeho sa .OPUS.
- dibaka '/data/data/com.whatsapp/cache/Profile Pictures/'. E na le lifaele tsa litšoantšo - litšoantšo tsa mabitso.
- dibaka '/data/data/com.whatsapp/files/Avatars/'. E na le lifaele tsa litšoantšo - litšoantšo tse nyane tsa mabitso. Lifaele tsena li na le katoloso ea '.j' empa leha ho le joalo ke lifaele tsa litšoantšo tsa JPEG (JPG).
- dibaka '/data/data/com.whatsapp/files/Avatars/'. E na le lifaele tsa litšoantšo - setšoantšo le senepe sa setšoantšo se behiloeng e le avatar ke mong'a akhaonto.
- dibaka '/data/data/com.whatsapp/files/Logs/'. E na le tlaleho ea ts'ebetso ea lenaneo (faele 'whatsapp.log') le likopi tsa bekapo tsa lintlha tsa ts'ebetso ea lenaneo (lifaele tse nang le mabitso ka sebopeho sa whatsapp-yyyy-mm-dd.1.log.gz).
Lifaele tsa WhatsApp Log:
Sekhechana sa koranta2017-01-10 09:37:09.757 LL_I D [524:WhatsApp Worker #1] missedcallnotification/init count:0 timestamp:0
2017-01-10 09:37:09.758 LL_I D [524:WhatsApp Worker #1] missedcallnotification/update hlakola true
2017-01-10 09:37:09.768 LL_I D [1:main] app-init/load-me
2017-01-10 09:37:09.772 LL_I D [1:main] faele ea password e sieo kapa ha e baloe
2017-01-10 09:37:09.782 LL_I D [1:main] lipalo-palo Melaetsa ea Sengoloa: 59 e rometsoe, e amohetse 82 / Melaetsa ea Media: 1 e rometsoe (0 li-byte), 0 e amohetse (9850158 bytes) / Melaetsa ea Offline: 81 e amohetse ( 19522 msec average delay) / Message Service: 116075 bytes sent, 211729 bytes received / Voip Calls: 1 di-call tse tswang, 0 tse kenang, 2492 byte tse rometsweng, 1530 bytes / Google Drive: 0 bytes e rometswe, 0 byte e amohetse / 1524: li-byte tse rometsoeng, li-byte tse 1826 li amohetse / Kakaretso ea data: 118567 byte e rometsoe, 10063417 byte e amohetse
2017-01-10 09:37:09.785 LL_I D [1:main] media-state-manager/refresh-media-state/writable-media
2017-01-10 09:37:09.806 LL_I D [1:main] app-init/initialize/timer/stop: 24
2017-01-10 09:37:09.811 LL_I D [1:main] msgstore/checkhealth
2017-01-10 09:37:09.817 LL_I D [1:main] msgstore/checkhealth/journal/hlakola bohata
2017-01-10 09:37:09.818 LL_I D [1:main] msgstore/checkhealth/back/hlakola bohata
2017-01-10 09:37:09.818 LL_I D [1:main] msgstore/checkdb/data/data/com.whatsapp/databases/msgstore.db
2017-01-10 09:37:09.819 LL_I D [1:main] msgstore/checkdb/list _jobqueue-WhatsAppJobManager 16384 drw=011
2017-01-10 09:37:09.820 LL_I D [1:main] msgstore/checkdb/list _jobqueue-WhatsAppJobManager-journal 21032 drw=011
2017-01-10 09:37:09.820 LL_I D [1:main] msgstore/checkdb/list axolotl.db 184320 drw=011
2017-01-10 09:37:09.821 LL_I D [1:main] msgstore/checkdb/list axolotl.db-wal 436752 drw=011
2017-01-10 09:37:09.821 LL_I D [1:main] msgstore/checkdb/list axolotl.db-shm 32768 drw=011
2017-01-10 09:37:09.822 LL_I D [1:main] msgstore/checkdb/list msgstore.db 540672 drw=011
2017-01-10 09:37:09.823 LL_I D [1:main] msgstore/checkdb/list msgstore.db-wal 0 drw=011
2017-01-10 09:37:09.823 LL_I D [1:main] msgstore/checkdb/list msgstore.db-shm 32768 drw=011
2017-01-10 09:37:09.824 LL_I D [1:main] msgstore/checkdb/lenane la wa.db 69632 drw=011
2017-01-10 09:37:09.825 LL_I D [1:main] msgstore/checkdb/lenane la wa.db-wal 428512 drw=011
2017-01-10 09:37:09.825 LL_I D [1:main] msgstore/checkdb/lenane la wa.db-shm 32768 drw=011
2017-01-10 09:37:09.826 LL_I D [1:main] msgstore/checkdb/list chatsettings.db 4096 drw=011
2017-01-10 09:37:09.826 LL_I D [1:main] msgstore/checkdb/list chatsettings.db-wal 70072 drw=011
2017-01-10 09:37:09.827 LL_I D [1:main] msgstore/checkdb/list chatsettings.db-shm 32768 drw=011
2017-01-10 09:37:09.838 LL_I D [1:main] msgstore/checkdb/version 1
2017-01-10 09:37:09.839 LL_I D [1:main] msgstore/canquery
2017-01-10 09:37:09.846 LL_I D [1:main] msgstore/canquery/count 1
2017-01-10 09:37:09.847 LL_I D [1:main] msgstore/canquery/timer/stop: 8
2017-01-10 09:37:09.847 LL_I D [1:main] msgstore/canquery 517 | nako e sebelisitsoeng:8
2017-01-10 09:37:09.848 LL_I D [529:WhatsApp Worker #3] media-state-manager/refresh-media-state/internal-storage available:1,345,622,016 total:5,687,922,688
- dibaka '/data/media/0/WhatsApp/Media/WhatsApp Audio/'. E na le lifaele tsa audio tse amohetsoeng.
- dibaka '/data/media/0/WhatsApp/Media/WhatsApp Audio/E rometswe/'. E na le lifaele tsa audio tse rometsoeng.
- dibaka '/data/media/0/WhatsApp/Media/Litšoantšo tsa WhatsApp/'. E na le lifaele tsa litšoantšo tse hlahisitsoeng.
- dibaka '/data/media/0/whatsapp/Media/WhatsApp Images/Rometswe/'. E na le lifaele tsa litšoantšo tse rometsoeng.
- dibaka '/data/media/0/WhatsApp/Media/WhatsApp Video/'. E na le lifaele tsa video tse amohetsoeng.
- dibaka '/data/media/0/WhatsApp/Media/WhatsApp Video/E rometswe/'. E na le lifaele tsa video tse rometsoeng.
- dibaka '/data/media/0/WhatsApp/Media/Linepe tsa Boemo ba WhatsApp/'. E na le lifaele tsa litšoantšo tse amanang le mong'a akhaonto ea WhatsApp.
- Ho boloka sebaka sa memori ho smartphone ea hau ea Android, lintlha tse ling tsa WhatsApp li ka bolokoa kareteng ea SD. Ka karete ea SD, bukeng ea motso, ho na le directory 'WhatsApp', moo lisebelisoa tse latelang tsa lenaneo lena li ka fumanoang:
- dibaka '.Arolelana' ('/mnt/sdcard/WhatsApp/.Share/'). E na le likopi tsa lifaele tse arolelanoeng le basebelisi ba bang ba WhatsApp.
- dibaka '.litšila' ('/mnt/sdcard/WhatsApp/.trash/'). E na le lifaele tse hlakotsoeng.
- dibaka "databases" ('/mnt/sdcard/whatsapp/database/'). E na le li-backups tse kentsoeng. Li ka hlakoloa haeba faele e le teng 'key', e nkiloeng mohopolong oa sesebelisoa se hlahlobiloeng.
Lifaele tse fumanehang bukeng e nyane "databases":
- dibaka 'Halofo' ('/mnt/sdcard/WhatsApp/Media/'). E na le subdirectories 'WallPaper', 'WhatsApp Audio', 'Litšoantšo tsa WhatsApp', 'Lifoto tsa WhatsApp Profile, 'Video ea WhatsApp', 'Lintlha tsa WhatsApp Voice', e nang le lifaele tsa multimedia tse amoheloang le tse fetisoang (lifaele tsa litšoantšo, lifaele tsa video, melaetsa ea lentsoe, linepe tse amanang le profil ea mong'a ak'haonte ea WhatsApp, liwallpaper).
- dibaka 'Litšoantšo tsa Boemo' ('/mnt/sdcard/whatsapp/Profile Pictures/'). E na le lifaele tsa litšoantšo tse amanang le profil ea mong'a akhaonto ea WhatsApp.
- Ka linako tse ling ho ka 'na ha e-ba le directory e teng kareteng ea SD 'lifaele' ('/mnt/sdcard/WhatsApp/Files/'). Lenane lena le na le lifaele tse bolokang litlhophiso tsa lenaneo le likhetho tsa basebelisi.
Likarolo tsa polokelo ea data mefuteng e meng ea lisebelisoa tsa mehala
Mefuta e meng ea lisebelisoa tsa mohala tse sebelisang Android OS e ka boloka lintho tsa khale tsa WhatsApp sebakeng se fapaneng. Sena se bakoa ke liphetoho sebakeng sa polokelo ea data ea kopo ka software ea sistimi ea sesebelisoa sa mehala. Ka mohlala, lisebelisoa tsa mohala tsa Xiaomi li na le mosebetsi oa ho theha sebaka sa bobeli sa mosebetsi ("SecondSpace"). Ha ts'ebetso ena e kentsoe, sebaka sa data sea fetoha. Kahoo, haeba sesebelisoa se tloaelehileng sa mohala se sebelisang data ea mosebelisi oa Android OS se bolokiloe bukeng '/data/user/0/' (e leng sesupo sa se tloaelehileng '/data/data/'), ebe sebakeng sa bobeli sa ts'ebetso data e bolokiloe bukeng '/data/user/10/'. Ke hore, ho sebelisa mohlala oa sebaka sa faele 'wa.db':
- ho smartphone e tloaelehileng e sebelisang Android OS: /data/user/0/com.whatsapp/databases/wa.db' (e lekanang '/data/data/com.whatsapp/databases/wa.db');
- sebakeng sa bobeli sa mosebetsi sa Xiaomi smartphone: '/data/user/10/com.whatsapp/databases/wa.db'.
Lisebelisoa tsa WhatsApp ho sesebelisoa sa iOS
Ho fapana le Android OS, ho iOS WhatsApp data e fetisetsoa ho kopi ea bekapo (bekapo ea iTunes). Ka hona, ho ntša data ho tsoa ho sesebelisoa sena ha ho hloke ho ntša sistimi ea faele kapa ho theha thotobolo ea mohopolo ea sesebelisoa se ntseng se etsoa lipatlisiso. Bongata ba lintlha tse amehang bo teng polokelong ea litaba 'ChatStorage.sqlite', e haufi le tsela: '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/' (ho mananeo a mang tsela ena e hlaha joalo ka 'AppDomainGroup-group.net.whatsapp.WhatsApp.shared').
sebopeho sa 'ChatStorage.sqlite':
Litafole tse rutang haholo polokelong ea 'ChatStorage.sqlite' ke 'ZWAMESSAGE' и 'ZWAMEDIAITEM'.
Ponahalo ya tafole 'ZWAMESSAGE':
Sebopeho sa tafole 'ZWAMESSAGE'
| Lebitso la tšimo | boleng |
|---|---|
| Z_PK | nomoro ea tatellano ea rekoto (tafoleng ea SQL) |
| Z_ENT | sekhetho sa tafole, se na le boleng ba '9' |
| Z_OPT | ha e tsejoe, hangata e na le boleng ho tloha ho '1' ho ea ho '6' |
| ZCHILDMESAGESDELIVEREDCOUNT | ha e tsejoe, hangata e na le boleng ba '0' |
| ZCHILDMESSAGESPLAYEDCOUNT | ha e tsejoe, hangata e na le boleng ba '0' |
| MOLAETSA TSA NGWANABANE | ha e tsejoe, hangata e na le boleng ba '0' |
| ZDATAITEMVERSION | ha e tsejoe, hangata e na le boleng ba '3', mohlomong sesupo sa molaetsa oa mongolo |
| ZDOCID | ha e tsejoe |
| ZENCRETRYCOUNT | ha e tsejoe, hangata e na le boleng ba '0' |
| ZFILTEREDRECIPIENTCOUNT | ha e tsejoe, hangata e na le litekanyetso tsa '0', '2', '256' |
| ZISFROMME | tsela ea molaetsa: '0' - e kenang, '1' - e tsoang |
| ZMESSAGEERRORSTATUS | boemo ba ho fetisa molaetsa. Haeba molaetsa o rometsoe/o amohetsoe, joale o na le boleng ba '0' |
| ZMESSAGETYPE | mofuta wa molaetsa o fetisoang |
| ZSORT | ha e tsejoe |
| ZSPOTLIGHSTATUS | ha e tsejoe |
| TSOHLE | e sa tsejoeng, ha e sebelisoe |
| TS'ELISO TS'OANE | ha e tsejoe |
| ZGROUPMEMBER | e sa tsejoeng, ha e sebelisoe |
| TS'ELISITSOE | ha e tsejoe |
| ZMEDIAITEM | ha e tsejoe |
| ZMESSAGEINFO | ha e tsejoe |
| ZPARENTMOLAETSA | e sa tsejoeng, ha e sebelisoe |
| ZMESSAGEDATE | timestamp ka mokhoa oa OS X Epoch Time |
| ZSENTDATE | nako eo molaetsa o rometsoeng ka mokhoa oa OS X Epoch Time |
| ZFROMJID | ID ea moromeli oa WhatsApp |
| ZMEDIASECTIONID | e na le selemo le khoeli faele ea media e rometsoeng |
| TSOHLE | e sa tsejoeng, ha e sebelisoe |
| ZPUSHPAME | lebitso la lebitso la motho ea rometseng faele ea media ka sebopeho sa UTF-8 |
| ZSTANZID | sekhetho sa molaetsa se ikhethileng |
| ZTEXT | Mongolo oa molaetsa |
| ZTOJID | ID ea WhatsApp ea moamoheli |
| OFFSET | leeme |
Ponahalo ya tafole 'ZWAMEDIAITEM':
Sebopeho sa tafole 'ZWAMEDIAITEM'
| Lebitso la tšimo | boleng |
|---|---|
| Z_PK | nomoro ea tatellano ea rekoto (tafoleng ea SQL) |
| Z_ENT | sekhetho sa tafole, se na le boleng ba '8' |
| Z_OPT | ha e tsejoe, hangata e na le boleng ho tloha ho '1' ho ea ho '3'. |
| ZCLOUDSTATUS | e na le boleng '4' haeba faele e kentsoe. |
| ZFILESISE | e na le bolelele ba faele (ka li-byte) bakeng sa lifaele tse jarollotsoeng |
| ZMEDIAORIGIN | ha e tsejoe, hangata e na le boleng ba '0' |
| ZMOVIEDURATION | nako ea faele ea media, bakeng sa lifaele tsa pdf li ka ba le palo ea maqephe a tokomane |
| MOLAETSA | e na le nomoro ea serial (nomoro e fapane le e bontšitsoeng kholumong ea 'Z_PK') |
| ZASPECTRATIO | Aspect ratio, ha e sebelisoe, hangata e behiloe ho '0' |
| TSOHLE | ha e tsejoe, hangata e na le boleng ba '0' |
| TS'OANELO TS'OANE | bophara ka dipikselse |
| TŠEBELETSO | bophahamo ka dipikselse |
| ZMEDIAURLDATE | timestamp ka mokhoa oa OS X Epoch Time |
| ZAUTHORNAME | sengoli (bakeng sa litokomane, e kanna ea ba le lebitso la faele) |
| ZCOLLECTIONNAME | ha e sebelisoe |
| ZMEDIALOCALPATH | lebitso la faele (ho kenyeletsoa le tsela) ho sistimi ea faele ea sesebelisoa |
| ZMEDIAURL | URL moo faele ea media e neng e le teng. Haeba faele e fetisitsoe ho tloha ho motho e mong ho ea ho e mong, e ne e ngotsoe ka mokhoa o patiloeng 'me katoloso ea eona e tla bontšoa e le katoloso ea faele e fetisitsoeng - .enc. |
| ZTHUMBNAILLOCALPATH | tsela ea ho thumbnail ea faele tsamaisong ea faele ea sesebelisoa |
| ZTITLE | sehlooho sa faele |
| ZVCARDNAME | hash ea faele ea media; ha o fetisetsa faele ho sehlopha, e kanna ea ba le sets'oants'o sa motho ea e rometseng |
| ZVCARDSTRING | e na le tlhahisoleseding mabapi le mofuta oa faele e fetisetsoang (mohlala, setšoantšo/jpeg); ha o fetisetsa faele ho sehlopha, e ka 'na ea e-ba le sekhetho sa moamoheli. |
| ZXMPPTHUMBPATHO | tsela ea ho thumbnail ea faele tsamaisong ea faele ea sesebelisoa |
| ZMEDIAKEY | ha e tsejoe, mohlomong e na le senotlolo sa ho hlakola faele e patiloeng. |
| ZMETADATA | metadata ya molaetsa o fetisoang |
| Offset | leeme |
Litafole tse ling tse khahlisang tsa database 'ChatStorage.sqlite' ke:
- 'ZWAPROFILEPUSHNAME'. E bapisa ID ea WhatsApp le lebitso la lebitso;
- 'ZWAPROFILEPICTUREITEM'. E bapisa ID ea WhatsApp le avatar ea mabitso;
- 'Z_PRIMARYKEY'. Tafole e na le lintlha tse akaretsang mabapi le database ena, joalo ka palo eohle ea melaetsa e bolokiloeng, palo eohle ea lipuisano, joalo-joalo.
Hape, ha u hlahloba WhatsApp sesebelisoa sa mohala se sebelisang iOS, u lokela ho ela hloko lifaele tse latelang:
- faele 'BackedUpKeyValue.sqlite'. E na le linotlolo tsa cryptographic le lintlha tse ling tse hlokahalang ho tsebahatsa mong'a akhaonto. E lutse tseleng: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- faele 'ContactsV2.sqlite'. E na le tlhahisoleseling mabapi le mabitso a mosebelisi, joalo ka lebitso le felletseng, nomoro ea mohala, boemo ba mabitso (ka mongolo), ID ea WhatsApp, jj. E lutse tseleng: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- faele 'consumer_version'. E na le nomoro ea mofuta oa sesebelisoa sa WhatsApp se kentsoeng. E lutse tseleng: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- faele 'current_wallpaper.jpg'. E na le Wallpaper ea morao-rao ea WhatsApp. E lutse tseleng: /private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/. Liphetolelo tsa khale tsa ts'ebeliso li sebelisa faele 'pampitšana', e haufi le tsela: '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/'.
- faele 'blockedcontacts.dat'. E na le lintlha mabapi le mabitso a thibetsoeng. E lutse tseleng: /private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/.
- faele 'pw.dat'. E na le phasewete e patiloeng. E lutse tseleng: '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/'.
- faele 'net.whatsapp.WhatsApp.plist' (kapa faele 'group.net.whatsapp.WhatsApp.shared.plist'). E na le tlhahisoleseling mabapi le profaele ea akhaonto ea hau ea WhatsApp. Faele e fumaneha haufi le tsela: '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Library/Preferences/'.
Likahare tsa faele 'group.net.whatsapp.WhatsApp.shared.plist'
U boetse u hloka ho ela hloko li-directory tse latelang:
- dibaka '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Media/Profile/'. E na le linepe tsa mabitso, lihlopha (lifaele tse nang le katoloso .monwana o motona), li-avatar tsa mabitso, avatar ea mong'a ak'haonte ea WhatsApp (faele 'Photo.jpg').
- dibaka '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Message/Media/'. E na le lifaele tsa multimedia le li-thumbnails tsa tsona
- dibaka '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/'. E na le tlaleho ea ts'ebetso ea lenaneo (file 'calls.log') le likopi tsa "backup" tsa lits'ebetso tsa ts'ebetso ea lenaneo (file 'calls.backup.log').
- dibaka '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/stickers/'. E na le lithupa (lifaele ka sebopeho '.webp').
- dibaka '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/Logs/'. E na le litlaleho tsa ts'ebetso ea lenaneo.
Lisebelisoa tsa WhatsApp ho Windows
Lintho tsa khale tsa WhatsApp ho Windows li ka fumaneha libakeng tse 'maloa. Pele ho tsohle, tsena ke li-directory tse nang le lifaele tsa lenaneo tse sebetsang le tse thusang (bakeng sa Windows 8/10):
- 'C: Lifaele tsa Lenaneo (x86)WhatsApp'
- 'C:Basebelisi% Boemo ba mosebelisi% AppDataLocalWhatsApp'
- 'C:Basebelisi% Boemo ba mosebelisi% AppDataLocalVirtualStore Program Files (x86)WhatsApp'
Lenaneng 'C:Basebelisi% Boemo ba mosebelisi% AppDataLocalWhatsApp' faele ea log e teng 'SquirrelSetup.log', e nang le tlhahisoleseling mabapi le ho hlahloba liapdeite le ho kenya lenaneo.
Lenaneng 'C:Basebelisi% Boemo ba mosebelisi% AppDataRoamingWhatsApp' Ho na le li-subdirectory tse 'maloa:
faele 'main-process.log' e na le leseli mabapi le ts'ebetso ea lenaneo la WhatsApp.
Subdirectory "databases" e na le faele 'Li-database.db', empa faele ena ha e na tlhahisoleseling efe kapa efe mabapi le meqoqo kapa mabitso.
Ntho e khahlang ka ho fetesisa ho tsoa ponong ea forensic ke lifaele tse fumanehang bukeng 'Cache'. Tsena ke lifaele tse nang le mabitso 'f_*******' (moo * e leng palo ho tloha ho 0 ho isa ho 9) e nang le lifaele le litokomane tsa multimedia tse patiloeng, empa ho boetse ho na le lifaele tse sa ngolisoang har'a tsona. Tse khahlang haholo ke lifaele 'data_0', 'data_1', 'data_2', 'data_3', e fumanehang bukeng e nyenyane e tšoanang. Lifaele 'data_0', 'data_1', 'data_3' e na le likhokahano tsa kantle tsa lifaele le litokomane tsa multimedia tse fetisoang.
Mohlala oa lintlha tse leng faeleng ea 'data_1'
Hape file 'data_3' e ka ba le lifaele tsa litšoantšo.
faele 'data_2' e na le li-avatars tsa mabitso (e ka khutlisoa ka ho batla ka lihlooho tsa lifaele).
Li-avatar tse teng faeleng 'data_2':
Kahoo, lipuisano ka botsona ha li fumanehe mohopolong oa komporo, empa u ka fumana:
- lifaele tsa multimedia;
- litokomane tse fetisitsoeng ka WhatsApp;
- lintlha tse mabapi le mabitso a mong'a ak'haonte.
Lisebelisoa tsa WhatsApp ho MacOS
Ho MacOS u ka fumana mefuta ea li-artifact tsa WhatsApp tse tšoanang le tse fumanehang ho Windows OS.
Lifaele tsa lenaneo li fumaneha ho li-directory tse latelang:
- 'C:ApplicationsWhatsApp.app'
- 'C:Applications._WhatsApp.app'
- 'C:Basebelisi%Boemo ba mosebelisi%LibraryPreferences'
- 'C:Basebelisi%Profaele ea mosebelisi%LibraryLogsWhatsApp'
- 'C:Basebelisi%Profaele ea mosebelisi%LaebrariE bolokiloe Kopo StateWhatsApp.savedState'
- 'C:Basebelisi%Boemo ba mosebelisi%Lingoloa tsa Kopo ea Library'
- 'C: Basebelisi% Boemo ba mosebelisi%LibraryApplication SupportCloudDocs'
- 'C:Basebelisi%Boemo ba mosebelisi%LibraryApplication SupportWhatsApp.ShipIt'
- 'C:Basebelisi%Boemo ba mosebelisi%LibraryContainerscom.rockysandstudio.app-for-whatsapp'
- 'C:Basebelisi%Boemo ba mosebelisi% Litokomane tsa Laebrari ea Mohala <mongolo o feto-fetohang> Li-account tsa WhatsApp'
Bukana ena e na le li-subdirectories tseo mabitso a tsona e leng linomoro tsa mohala tse amanang le mong'a ak'haonte ea WhatsApp. - 'C:Basebelisi%Boemo ba mosebelisi%LibraryCachesWhatsApp.ShipIt'
Lenane lena le na le tlhahisoleseding mabapi le ho kenya lenaneo. - 'C:Basebelisi%Profaele ea mosebelisi%PicturesiPhoto Library.photolibraryMasters', 'C:Basebelisi%Profaele ea mosebelisi%PicturesiPhoto Library.photolibraryLitšoantšo'
Libuka tsena li na le lifaele tsa lits'ebeletso tsa lenaneo, ho kenyelletsa linepe le linepe tsa mabitso a WhatsApp. - 'C:Basebelisi%Profaele ea mosebelisi%LibraryCachesWhatsApp'
Bukana ena e na le li-database tse 'maloa tsa SQLite tse sebelisetsoang ho boloka boitsebiso. - 'C:Basebelisi%Profaele ea mosebelisi%Library Application SupportWhatsApp'
Lenane lena le na le li-subdirectory tse 'maloa:
Lenaneng 'C:Basebelisi%Profaele ea mosebelisi%Library Application SupportWhatsAppCache' ho na le lifaele 'data_0', 'data_1', 'data_2', 'data_3' le lifaele tse nang le mabitso 'f_*******' (moo * e leng palo ho tloha ho 0 ho isa ho 9). Ho fumana leseli mabapi le hore na lifaele tsena li na le lintlha life, bona WhatsApp Artifacts ho Windows.Lenaneng 'C:Basebelisi%Profaele ea mosebelisi%Library Application SupportWhatsAppIndexedDB' e ka ba le lifaele tsa multimedia (lifaele ha li na likeketso).
faele 'main-process.log' e na le leseli mabapi le ts'ebetso ea lenaneo la WhatsApp.
Mohloli
- Tlhahlobo ea forensic ea WhatsApp Messenger ho li-smartphones tsa Android, ka Cosimo Anglano, 2014.
- Whatsapp Forensics: Ts'ebetso ea Sistimi e hlophisitsoe le data ea motheo bakeng sa lisebelisoa tsa Android le iOS ka Ahmad Pratama, 2014.
Lihloohong tse latelang letotong lena:
Decryption ea li-database tsa WhatsApp tse patiloengSengoloa se tla fana ka leseli mabapi le hore na senotlolo sa encryption sa WhatsApp se hlahisoa joang le mehlala e sebetsang e bonts'ang mokhoa oa ho hlakola li-database tse patiloeng tsa sesebelisoa sena.
E ntša data ea WhatsApp ho tloha polokelong ea leruSengoloa seo ho sona re tla u joetsa hore na data ea WhatsApp e bolokiloe marung le ho hlalosa mekhoa ea ho khutlisa data ena ho tsoa ho polokelo ea leru.
Tlhahiso ea data ea WhatsApp: Mehlala e sebetsangSengoloa se tla hlalosa mohato ka mohato hore na ke mananeo afe le mokhoa oa ho ntša data ea WhatsApp ho lisebelisoa tse fapaneng.
Source: www.habr.com