Ukuba ufuna ukwazi ukuba zeziphi iintlobo zezinto zakudala ze-WhatsApp ezikhoyo kwiinkqubo ezahlukeneyo zokusebenza kwaye zifumaneka phi kanye kanye, le yindawo yakho. Eli nqaku livela kwingcali kwi-Group-IB Computer Forensics Laboratory Igor Mikhailov iqala uthotho lwezithuba malunga ne-WhatsApp forensics kwaye loluphi ulwazi olunokufunyanwa ngokuhlalutya isixhobo.
Masiqaphele ngokukhawuleza ukuba iinkqubo zokusebenza ezahlukeneyo zigcina iintlobo ezahlukeneyo zezinto ze-WhatsApp, kwaye ukuba umphandi unokukhupha iintlobo ezithile zedatha ye-WhatsApp kwisixhobo esinye, oku akuthethi ukuba iindidi ezifanayo zedatha zinokukhutshwa kwesinye isixhobo. Ngokomzekelo, ukuba iyunithi yenkqubo eqhuba i-Windows OS isusiwe, iingxoxo ze-WhatsApp mhlawumbi aziyi kufumaneka kwiidiski zayo (ngaphandle kweekopi zokulondoloza izixhobo ze-iOS, ezinokufumaneka kwiidrive ezifanayo). Ukubanjwa kweelaptops kunye nezixhobo eziphathwayo ziya kuba neempawu zayo. Makhe sithethe ngale nto ngokweenkcukacha.
Iimpawu ze-WhatsApp kwisixhobo se-Android
Ukuze ukhuphe izinto ze-WhatsApp kwisixhobo se-Android, umphandi kufuneka abe namalungelo omsebenzisi ophezulu ('ingcambu') kwisixhobo esiphantsi kophando okanye ube nako ukukhupha enye indawo yokulahla inkumbulo ekhoyo yesixhobo, okanye isixokelelwano sayo sefayile (umzekelo, ukusebenzisa ubuthathaka besoftwe yesixhobo esithile esiphathwayo).
Iifayile zesicelo zibekwe kwimemori yefowuni kwicandelo apho idatha yomsebenzisi igcinwa khona. Njengomthetho, eli candelo libizwa ngegama 'idatha yomsebenzisi'. Oovimba beefayili kunye neefayile zeprogram zibekwe ecaleni kwendlela: '/data/data/com.whatsapp/'.
Iifayile eziphambili eziqulethe i-WhatsApp forensic artifacts kwi-Android OS zi-database 'wa.db' ΠΈ 'msgstore.db'.
Kwisiseko sedatha 'wa.db' iqulethe uluhlu olupheleleyo lomfowunelwa lomsebenzisi we-WhatsApp, kubandakanya inombolo yefowuni, igama lokubonisa, izitampu zexesha, kunye nalo naluphi na olunye ulwazi olunikiweyo ngelixa ubhalisela i-WhatsApp. Ifayile 'wa.db' ibekwe ecaleni kwendlela: '/data/data/com.whatsapp/databases/' kwaye inolwakhiwo olulandelayo:
Iitheyibhile ezinomdla kakhulu kwisiseko sedatha 'wa.db' kuba umphandi zezi:
- 'wa_contacts'
Le theyibhile iqulethe ulwazi loqhagamshelwano: i-ID yoqhagamshelwano ku-WhatsApp, ulwazi lobume, igama lomsebenzisi elibonisayo, izitampu zexesha, njl.Inkangeleko yetafile:
Isakhiwo setafileIgama lommandla Nentsingiselo _id inombolo yolandelelwano lwerekhodi (kwitafile yeSQL) jid I-ID yoqhagamshelwano ye-WhatsApp, ebhalwe ngendlela <inombolo yefowuni>@s.whatsapp.net ngu_whatsapp_umsebenzisi iqulathe '1' ukuba umfowunelwa uhambelana nomsebenzisi we-WhatsApp wokwenyani, '0' ngenye indlela isimo iqulethe umbhalo oboniswe kwimo yomfowunelwa status_timestamp iqulethe isitampu sexesha kwi Unix Epoch Time (ms) fomati inani inombolo yefowuni ehambelana nomqhagamshelwa krwada_contact_id inombolo yoqhagamshelwano igama elibonisiwe igama lokubonisa umqhagamshelwa uhlobo_ lwefowuni uhlobo lwefowuni ifowuni_ileyibhile ileyibhile ehambelana nenombolo yoqhagamshelwano msg_ count engabonwayo inani lemiyalezo ethunyelwe ngumfowunelwa kodwa ayifundwanga ngummkeli iifoto_ts iqulethe isitampu sexesha kwifomati yexesha le Unix Epoch ubhontsi_umzi iqulethe isitampu sexesha kwifomati yexesha le Unix Epoch ifoto_id_isitampu sexesha iqulethe isitampu sexesha kwi Unix Epoch Time (ms) fomati amagama anikezwe lona ixabiso lendawo lihambelana 'negama_lokubonisa' kumfowunelwa ngamnye wa_igama Igama lomfowunelwa ka-WhatsApp (igama elichazwe kwiprofayile yomfowunelwa libonisiwe) hlela_igama Igama lomfowunelwa elisetyenziswe kwimisebenzi yohlobo lesiteketiso isiteketiso somfowunelwa kuWhatsApp (igama lesiqhulo elichazwe kwiprofayile yomfowunelwa liyaboniswa) inkampani inkampani (inkampani echazwe kwiprofayile yoqhagamshelwano ibonisiwe) isihloko isihloko (Ms./Mnu.; isihloko esicwangcisiweyo kwiprofayile yoqhagamshelwano siyaboniswa) ukucinywa umkhethe - 'sqlite_sequence'
Le theyibhile iqulethe ulwazi malunga nenani labafowunelwa; - 'android_metadata'
Le theyibhile iqulethe ulwazi malunga nolwimi lwe-WhatsApp lwasekuhlaleni.
Kwisiseko sedatha 'msgstore.db' iqulethe ulwazi malunga nemiyalezo ethunyelweyo, njengenombolo yomfowunelwa, umbhalo womyalezo, imo yomyalezo, izitampu zexesha, iinkcukacha zeefayile ezigqithisiweyo ezibandakanyiweyo kwimiyalezo, njl.njl. Ifayile 'msgstore.db' ibekwe ecaleni kwendlela: '/data/data/com.whatsapp/databases/' kwaye inolwakhiwo olulandelayo:
Eyona tafile inomdla kwifayile 'msgstore.db' kuba umphandi zezi:
- 'sqlite_sequence'
Le theyibhile iqulethe ulwazi jikelele malunga nale database, njengenani lilonke lemiyalezo egciniweyo, inani elipheleleyo leengxoxo, njl.Inkangeleko yetafile:
- 'umyalezo_fts_umxholo'
Iqulethe okubhaliweyo kwemiyalezo ethunyelweyo.Inkangeleko yetafile:
- 'imiyalezo'
Le theyibhile iqulethe ulwazi olufana nenombolo yoqhagamshelwano, umbhalo womyalezo, imo yomyalezo, izitampu zexesha, ulwazi malunga neefayile ezigqithiselweyo ezibandakanyiweyo kwimiyalezo.Inkangeleko yetafile:
Isakhiwo setafileIgama lommandla Nentsingiselo _id inombolo yolandelelwano lwerekhodi (kwitafile yeSQL) key_remote_jid I-ID ye-WhatsApp yeqabane lonxibelelwano key_ukusuka_kum isalathiso somyalezo: '0' β ongenayo, '1' β ophumayo isitshixo_id isichongi somyalezo esisodwa isimo isimo somyalezo: '0' - zisiwe, '4' - ilindile kumncedisi, '5' - ifunyenwe kwindawo ekuyiwa kuyo, '6' - umyalezo wolawulo, '13' - umyalezo ovulwe ngummkeli (funda) need_tyhala inexabiso '2' ukuba ngumyalezo wosasazo, kungenjalo uqulathe '0' idata umyalezo obhaliweyo (xa i-'media_wa_type' iparameter ingu-'0') simiswe iqulethe isitampu sexesha kwi Unix Epoch Time (ms) fomati, ixabiso lithatyathwe kwiwotshi yesixhobo media_url iqulathe i-URL yefayile egqithiselweyo (xa i-'media_wa_type' iparameter ithi '1', '2', '3') imidiya_mime_uhlobo MIME udidi lwefayile egqithiselweyo (xa i 'media_wa_type' iparamitha ilingana no '1', '2', '3') imidiya_wa_uhlobo uhlobo lomyalezo: '0' - umbhalo, '1' - ifayile yegraphic, '2' - ifayile yomsindo, '3' - ifayile yevidiyo, '4' - ikhadi loqhagamshelwano, '5' - geodata ubungakanani_bemidiya ubungakanani befayile egqithiselweyo (xa i 'media_wa_type' iparamitha ingu '1', '2', '3') imidiya_igama Igama lefayile egqithiselweyo (xa i-'media_wa_type' iparamitha ingu-'1', '2', '3') media_caption Iqulathe amagama 'audio', 'ividiyo' yamaxabiso ahambelanayo 'media_wa_type' iparamitha (xa i-'media_wa_type' iparameter ithi '1', '3') media_hash base64 encoded hash yefayile egqithisiweyo, ibalwe kusetyenziswa i-HAS-256 algorithm (xa i-'media_wa_type' iparameter ilingana no '1', '2', '3') media_ubude ubude bexesha kwimizuzwana yefayile yemidiya (xa i-'media_wa_type' ingu-'1', '2', '3') mvelaphi inexabiso '2' ukuba ngumyalezo wosasazo, kungenjalo uqulathe '0' ububanzi I-geodata: isibanzi (xa i-'media_wa_type' iparamitha ingu-'5') ubude i-geodata: ubude (xa i-'media_wa_type' iparamitha ingu-'5') ubhontsi_umfanekiso ulwazi lwenkonzo kude_umthombo Isazisi somthumeli (yencoko yeqela kuphela) ifunyenwe_isitampu sexesha ixesha lokufumana, iqulathe isitampu sexesha kwi Unix Epoch Time (ms) fomati, ixabiso lithathwa kwikloko yesixhobo (xa i-'key_from_me' iparameter ino-'0', '-1' okanye elinye ixabiso) send_timestamp ayisetyenziswanga, ihlala inexabiso '-1' irisithi_yesitampu_yexesha ixesha elifunyenwe ngumncedisi osembindini, liqulathe isitampu sexesha kwi Unix Epoch Time (ms) fomati, ixabiso lithathwa kwiwotshi yesixhobo (xa iparameter ye 'key_from_me' ine'1', '-1' okanye elinye ixabiso. irisithi_yesixhobo_isitampu sexesha ixesha apho umyalezo ufunyenwe ngomnye umrhumeli, iqulathe isitampu sexesha kwi Unix Epoch Time (ms) fomati, ixabiso lithathwa kwiwotshi yesixhobo (xa iparameter ye 'key_from_me' ine '1', '-1' okanye elinye ixabiso. funda_isixhobo_isitampu sexesha ixesha lokuvula (ukufunda) umyalezo, uqulathe isitampu sexesha kwi Unix Epoch Ixesha (ms) fomati, ixabiso lithathwa kwiwotshi yesixhobo. play_device_timestamp Ixesha lokudlala lomyalezo, liqulathe isitampu sexesha kwi Unix Epoch Ixesha (ms) fomati, ixabiso lithatyathwe kwiwotshi yesixhobo. idatha ekrwada i-thumbnail yefayile egqithiselweyo (xa i-'media_wa_type' iparamitha ingu '1' okanye '3') ubalo_labamkeli inani labamkeli (yemiyalezo yosasazo) umthathi-nxaxheba_ihashi isetyenziswa xa uthumela imiyalezo nge-geodata nkwenkwezi ayisetyenziswanga icatshulwe_umqolo_id ayaziwa, idla ngokuqulatha ixabiso '0' ikhankanyiwe_jids ayisetyenziswanga multicast_id ayisetyenziswanga ukucinywa umkhethe Olu luhlu lwemimandla aluphelelanga. Kwiinguqulelo ezahlukeneyo ze-WhatsApp, ezinye iindawo zinokubakho okanye zingabikho. Ukongeza, imimandla ingabakho 'media_enc_hash', 'edit_version', 'payment_transaction_id' njalo njalo.
- 'imiyalezo_imibhobho'
Le theyibhile iqulethe ulwazi malunga nemifanekiso egqithisiweyo kunye nesitampu sexesha. Kuluhlu 'lwesitampu sexesha', ixesha liboniswa ngefomathi ye-Unix Epoch Time (ms). - 'chat_list'
Le theyibhile iqulethe ulwazi malunga neengxoxo.Inkangeleko yetafile:
Kwakhona, xa uphonononga i-WhatsApp kwisixhobo esiphathwayo esisebenzisa i-Android, kuya kufuneka unikele ingqalelo kwezi fayile zilandelayo:
- Ifayile 'msgstore.db.cryptXX' (apho i-XX inedijithi enye okanye ezimbini ukusuka ku-0 ukuya kwi-12, umzekelo, msgstore.db.crypt12). Iqulethe i-backup efihliweyo yemiyalezo ye-WhatsApp (ifayile yokugcina msgstore.db). Iifayile 'msgstore.db.cryptXX' ibekwe ecaleni kwendlela: '/data/media/0/WhatsApp/Databases/' (ikhadi le-SD elibonakalayo), '/mnt/sdcard/WhatsApp/Databases/ (ikhadi le-SD lomzimba)'.
- Ifayile 'isitshixo'. Iqulethe isitshixo se-cryptographic. Ibekwe ecaleni kwendlela: '/data/data/com.whatsapp/files/'. Isetyenziselwa ukucima iifayile ze-WhatsApp ezifihliweyo.
- Ifayile 'com.whatsapp_preferences.xml'. Iqulethe ulwazi malunga neprofayile yakho ye-akhawunti ye-WhatsApp. Ifayile ibekwe ecaleni kwendlela: '/data/data/com.whatsapp/shared_prefs/'.
Isiqwenga somxholo wefayile
<?xml version="1.0" encoding="ISO-8859-1"?> β¦ <string name="ph">9123456789</string> (Π½ΠΎΠΌΠ΅Ρ ΡΠ΅Π»Π΅ΡΠΎΠ½Π°, Π°ΡΡΠΎΡΠΈΠΈΡΠΎΠ²Π°Π½Π½ΡΠΉ Ρ Π°ΠΊΠΊΠ°ΡΠ½ΡΠΎΠΌ WhatsApp) β¦ <string name="version">2.17.395</string> (Π²Π΅ΡΡΠΈΡ WhatsApp) β¦ <string name="my_current_status">Hey there! I am using WhatsApp.</string> (ΡΠΎΠΎΠ±ΡΠ΅Π½ΠΈΠ΅, ΠΎΡΠΎΠ±ΡΠ°ΠΆΠ°Π΅ΠΌΠΎΠ΅ Π² ΡΡΠ°ΡΡΡΠ΅ Π°ΠΊΠΊΠ°ΡΠ½ΡΠ°) β¦ <string name="push_name">Alex</string> (ΠΈΠΌΡ Π²Π»Π°Π΄Π΅Π»ΡΡΠ° Π°ΠΊΠΊΠ°ΡΠ½ΡΠ°) β¦ - Ifayile 'registration.RegisterPhone.xml'. Iqulethe ulwazi malunga nenombolo yefowuni ehambelana neakhawunti ye-WhatsApp. Ifayile ibekwe ecaleni kwendlela: '/data/data/com.whatsapp/shared_prefs/'.
Imixholo yefayile
<?xml version="1.0" encoding="ISO-8859-1"?> <map> <string name="com.whatsapp.registration.RegisterPhone.phone_number">9123456789</string> <int name="com.whatsapp.registration.RegisterPhone.verification_state" value="0"/> <int name="com.whatsapp.registration.RegisterPhone.country_code_position" value="-1"/> <string name="com.whatsapp.registration.RegisterPhone.input_phone_number">912 345-67-89</string> <int name="com.whatsapp.registration.RegisterPhone.phone_number_position" value="10"/> <string name="com.whatsapp.registration.RegisterPhone.input_country_code">7</string> <string name="com.whatsapp.registration.RegisterPhone.country_code">7</string> </map> - Ifayile 'axolotl.db'. Iqulethe izitshixo ze-cryptographic kunye nezinye iinkcukacha eziyimfuneko ukuchonga umnini-akhawunti. Ibekwe ecaleni kwendlela: '/data/data/com.whatsapp/databases/'.
- Ifayile 'chatsettings.db'. Iqulethe ulwazi loqwalaselo lwesicelo.
- Ifayile 'wa.db'. Iqulethe iinkcukacha zoqhagamshelwano. I-database enika umdla kakhulu (ukusuka kwinkalo ye-forensic) kunye nedatha enolwazi. Ingaqulatha ulwazi oluneenkcukacha malunga nabafowunelwa abacinyiweyo.
Kufuneka kwakhona unike ingqwalasela kula maxwebhu alandelayo:
- ulawulo '/data/media/0/WhatsApp/Media/WhatsApp Imifanekiso/'. Iqulethe iifayile zegraphic ezikhutshelweyo.
- ulawulo '/data/media/0/WhatsApp/Media/WhatsApp Voice Notes/'. Iqulethe imiyalezo yelizwi kwi-.OPUS iifayile zefomathi.
- ulawulo '/data/data/com.whatsapp/cache/Imifanekiso yeProfayile/'. Iqulethe iifayile zegraphic β imifanekiso yabafowunelwa.
- ulawulo '/data/data/com.whatsapp/files/Avatars/'. Iqulethe iifayile zegraphic - imifanekiso ye-thumbnail yabafowunelwa. Ezi fayile zinolwandiso lwe '.j' kodwa nangona kunjalo ziyiJPEG (JPG) iifayile zomfanekiso.
- ulawulo '/data/data/com.whatsapp/files/Avatars/'. Iqulethe iifayile zegraphic - umfanekiso kunye ne-thumbnail yomfanekiso omiswe njenge-avatar ngumnini-akhawunti.
- ulawulo '/data/data/com.whatsapp/files/Logs/'. Iqulethe ushicilelo lwenkqubo yokusebenza (ifayile 'whatsapp.log') kunye neekopi zogcino lwenkqubo yokusebenza (iifayile ezinamagama kwifomathi whatsapp-yyyy-mm-dd.1.log.gz).
Iifayile ze-WhatsApp Log:
Isiqwenga sejenali2017-01-10 09:37:09.757 LL_I D [524:WhatsApp Worker #1] missedcallnotification/init count:0 timestamp:0
2017-01-10 09:37:09.758 LL_I D [524:WhatsApp Worker #1] missedcallnotification/update delete true
2017-01-10 09:37:09.768 LL_I D [1: main] app-init/load-me
2017-01-10 09:37:09.772 LL_I D [1: main] ifayile yephasiwedi ayikho okanye ayifundeki
2017-01-10 09:37:09.782 LL_I D [1: main] izibalo Imiyalezo yombhalo: 59 ithunyelwe, 82 ifunyenwe / Imiyalezo yemidiya: 1 ithunyelwe (0 bytes), 0 ifunyenwe (9850158 bytes) / Imiyalezo engaxhunyiwe kwi-intanethi: 81 ifunyenwe ( 19522 msec umndilili wokulibaziseka) / Inkonzo yoMyalezo: 116075 bytes ithunyelwe, 211729 bytes ezifunyenweyo / Voip Iminxeba: 1 iminxeba ephumayo, 0 iminxeba engenayo, 2492 bytes ithunyelwe, 1530 bytes efunyenwe / Google Drive: 0 bytes ithunyelwe, 0 bytes zifunyenwe / 1524 Ukuzulazula: iibytes ezithunyelweyo, 1826 bytes ezifunyenweyo / Itotali yeDatha: 118567 bytes ezithunyelweyo, 10063417 bytes ezifunyenweyo
2017-01-10 09:37:09.785 LL_I D [1: main] media-state-manager/refresh-media-state/writable-media
2017-01-10 09:37:09.806 LL_I D [1: main] app-init/initialize/timer/ stop: 24
2017-01-10 09:37:09.811 LL_I D [1: main] msgstore/checkhealth
2017-01-10 09:37:09.817 LL_I D [1: main] msgstore/checkhealth/journal/cima ubuxoki
2017-01-10 09:37:09.818 LL_I D [1: main] msgstore/checkhealth/back/cima ubuxoki
2017-01-10 09:37:09.818 LL_I D [1: main] msgstore/checkdb/data/data/com.whatsapp/databases/msgstore.db
2017-01-10 09:37:09.819 LL_I D [1: main] msgstore/checkdb/list _jobqueue-WhatsAppJobManager 16384 drw=011
2017-01-10 09:37:09.820 LL_I D [1: main] msgstore/checkdb/list _jobqueue-WhatsAppJobManager-journal 21032 drw=011
2017-01-10 09:37:09.820 LL_I D [1:main] msgstore/checkdb/list axolotl.db 184320 drw=011
2017-01-10 09:37:09.821 LL_I D [1:main] msgstore/checkdb/list axolotl.db-wal 436752 drw=011
2017-01-10 09:37:09.821 LL_I D [1:main] msgstore/checkdb/list axolotl.db-shm 32768 drw=011
2017-01-10 09:37:09.822 LL_I D [1: main] msgstore/checkdb/list msgstore.db 540672 drw=011
2017-01-10 09:37:09.823 LL_I D [1: main] msgstore/checkdb/list msgstore.db-wal 0 drw=011
2017-01-10 09:37:09.823 LL_I D [1: main] msgstore/checkdb/list msgstore.db-shm 32768 drw=011
2017-01-10 09:37:09.824 LL_I D [1: main] msgstore/checkdb/luhlu wa.db 69632 drw=011
2017-01-10 09:37:09.825 LL_I D [1: main] msgstore/checkdb/uluhlu wa.db-wal 428512 drw=011
2017-01-10 09:37:09.825 LL_I D [1: main] msgstore/checkdb/luhlu wa.db-shm 32768 drw=011
2017-01-10 09:37:09.826 LL_I D [1: main] msgstore/checkdb/list chatsettings.db 4096 drw=011
2017-01-10 09:37:09.826 LL_I D [1: main] msgstore/checkdb/list chatsettings.db-wal 70072 drw=011
2017-01-10 09:37:09.827 LL_I D [1: main] msgstore/checkdb/list chatsettings.db-shm 32768 drw=011
2017-01-10 09:37:09.838 LL_I D [1: main] msgstore/checkdb/version 1
2017-01-10 09:37:09.839 LL_I D [1: main] msgstore/canquery
2017-01-10 09:37:09.846 LL_I D [1: main] msgstore/canquery/count 1
2017-01-10 09:37:09.847 LL_I D [1: main] msgstore/canquery/timer/ stop: 8
2017-01-10 09:37:09.847 LL_I D [1: main] msgstore / canquery 517 | ixesha elichithiweyo:8
2017-01-10 09:37:09.848 LL_I D [529:WhatsApp Worker #3] media-state-manager/refresh-media-state/internal-storage available:1,345,622,016 total:5,687,922,688
- ulawulo '/data/media/0/WhatsApp/Media/WhatsApp Audio/'. Iqulethe iifayile zeaudio ezifunyenweyo.
- ulawulo '/data/media/0/WhatsApp/Media/WhatsApp Audio/Thunyelwe/'. Iqulethe iifayile zeaudio ezithunyelweyo.
- ulawulo '/data/media/0/WhatsApp/Media/WhatsApp Imifanekiso/'. Iqulathe iziphumo zefayile zegraphic.
- ulawulo '/data/media/0/WhatsApp/Media/WhatsApp Imifanekiso/Thunyelwe/'. Iqulethe iifayile zegraphic ezithunyelweyo.
- ulawulo '/data/media/0/WhatsApp/Media/WhatsApp Video/'. Iqulethe iifayile zevidiyo ezifunyenweyo.
- ulawulo '/data/media/0/WhatsApp/Media/WhatsApp Video/Thunyelwe/'. Iqulethe iifayile zevidiyo ezithunyelweyo.
- ulawulo '/data/media/0/WhatsApp/Media/WhatsApp Profile Profile Photos/'. Iqulethe iifayile zegraphic ezinxulumene nomnini-akhawunti ka-WhatsApp.
- Ukugcina indawo yememori kwi-smartphone yakho ye-Android, enye idatha ye-WhatsApp inokugcinwa kwikhadi le-SD. Kwikhadi le-SD, kulawulo lweengcambu, kukho uvimba weefayili 'WhatsApp', apho ezi zinto zilandelayo zoludweliso lwenkqubo zinokufunyanwa:
- ulawulo '.Yabelana' ('/mnt/sdcard/WhatsApp/.Yabelana/'). Iqulethe iikopi zeefayile ekwabelwana ngazo nabanye abasebenzisi be-WhatsApp.
- ulawulo '.udoti' ('/mnt/sdcard/WhatsApp/.trash/'). Iqulethe iifayile ezicinyiweyo.
- ulawulo 'IiDatabases' ('/mnt/sdcard/WhatsApp/Databases/'). Iqulethe iikopi ezifihliweyo. Zinokukhutshwa xa ifayile ikhona 'isitshixo', ikhutshwe kwimemori yesixhobo esihlalutyiweyo.
Iifayile ezibekwe kwindawo engaphantsi 'IiDatabases':
- ulawulo 'Isiqingatha' ('/mnt/sdcard/WhatsApp/Media/'). Iqulathe oovimba beefayili 'Iphepha lodonga', 'WhatsApp Audio', 'Imifanekiso kaWhatsApp', 'Iifoto zeProfayile kaWhatsApp', 'Ividiyo kaWhatsApp', 'Amanqaku elizwi le-WhatsApp', eziqulethe iifayile zemultimedia ezifunyenweyo kunye nokuhanjiswa (iifayile zegraphic, iifayile zevidiyo, imiyalezo yelizwi, iifoto ezinxulumene neprofayili yomnini weakhawunti ye-WhatsApp, amaphephadonga).
- ulawulo 'Imifanekiso yeProfayile' ('/mnt/sdcard/WhatsApp/Imifanekiso yeProfayile/'). Iqulethe iifayile zegraphic ezinxulumene neprofayile yomnini-akhawunti ka-WhatsApp.
- Ngamanye amaxesha kunokubakho uluhlu olukhoyo kwikhadi le-SD 'iifayile' ('/mnt/sdcard/WhatsApp/Files/'). Olu luhlu luqulathe iifayile ezigcina useto lwenkqubo kunye nezinto ezikhethwa ngumsebenzisi.
Iimpawu zokugcinwa kwedatha kwezinye iimodeli zezixhobo eziphathwayo
Ezinye iimodeli zezixhobo eziphathwayo ezisebenzisa i-Android OS zinokugcina izinto zakudala ze-WhatsApp kwindawo eyahlukileyo. Oku kungenxa yotshintsho kwindawo yokugcina idatha yesicelo ngenkqubo yesoftware yesixhobo esiphathwayo. Ngokomzekelo, izixhobo eziphathwayo ze-Xiaomi zinomsebenzi wokudala indawo yokusebenza yesibini ("SecondSpace"). Xa lo msebenzi uvuliwe, indawo yedatha iyatshintsha. Ke, ukuba kwisixhobo esiphathwayo esisebenza rhoqo kwi-Android OS data yomsebenzisi igcinwa kulawulo '/data/umsebenzisi/0/' (esingisele kwisiqhelo '/idatha/idatha/'), emva koko kwindawo yesibini yesicelo idatha igcinwe kulawulo '/data/umsebenzisi/10/'. Oko kukuthi, usebenzisa umzekelo wendawo yefayile 'wa.db':
- kwi-smartphone eqhelekileyo eqhuba i-Android OS: /data/user/0/com.whatsapp/databases/wa.db' (elinganayo '/data/data/com.whatsapp/databases/wa.db');
- kwindawo yesibini yokusebenza ye-smartphone ye-Xiaomi: '/data/user/10/com.whatsapp/databases/wa.db'.
Iimpawu ze-WhatsApp kwisixhobo se-iOS
Ngokungafaniyo ne-Android OS, kwi-iOS WhatsApp idatha yesicelo ikhutshelwa kwikopi yogcino (ugcino lwe-iTunes). Ngoko ke, ukukhupha idatha kwesi sicelo akufuni ukukhupha inkqubo yefayile okanye ukudala ukulahlwa kwememori yesixhobo phantsi kophando. Uninzi lweenkcukacha ezifanelekileyo ziqulethwe kuvimba weenkcukacha 'ChatStorage.sqlite', ebekwe ecaleni kwendlela: '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/' (kwezinye iinkqubo le ndlela ivela njenge 'AppDomainGroup-group.net.whatsapp.WhatsApp.shared').
ulwakhiwo 'ChatStorage.sqlite':
Iitheyibhile ezinolwazi kakhulu kwi-database ye-'ChatStorage.sqlite' 'ZWAMESSAGE' ΠΈ 'ZWAMEDIAITEM'.
Imbonakalo yetafile 'ZWAMESSAGE':
Ubume betafile 'ZWAMESSAGE'
| Igama lommandla | Nentsingiselo |
|---|---|
| Z_PK | inombolo yolandelelwano lwerekhodi (kwitafile yeSQL) |
| Z_ENT | isichongi setafile, sinexabiso '9' |
| Z_OPT | ayaziwa, idla ngokuqulatha amaxabiso ukusuka '1' ukuya '6' |
| ZCHILDMESSAGESDELIVEREDCOUNT | ayaziwa, idla ngokuqulatha ixabiso '0' |
| ZCHILDMESSAGESPLAYEDCOUNT | ayaziwa, idla ngokuqulatha ixabiso '0' |
| ZCHILDMESSAGESREADCOUNT | ayaziwa, idla ngokuqulatha ixabiso '0' |
| ZDATAITEMVERSION | ayaziwa, ngesiqhelo iqulathe ixabiso '3', mhlawumbi isalathisi somyalezo obhaliweyo |
| ZDOCID | ayaziwa |
| ZENCRETRYCOUNT | ayaziwa, idla ngokuqulatha ixabiso '0' |
| ZFILTEREDRECIPIENTCOUNT | ayaziwa, idla ngokuqulatha amaxabiso '0', '2', '256' |
| ZISFROMME | isalathiso somyalezo: '0' β ongenayo, '1' β ophumayo |
| ZMESSAGEERRORSATUS | isimo sothumelo lomyalezo. Ukuba umyalezo uthunyelwe/ufunyenwe, ngoko unexabiso '0' |
| ZMESSAGETYPE | uhlobo lomyalezo othunyelwayo |
| ZSORT | ayaziwa |
| ZSPOTLIGHTSTATUS | ayaziwa |
| ZSTARRED | ayaziwa, ayisetyenziswa |
| ZCHATSESSION | ayaziwa |
| ZGROUPMEMBER | ayaziwa, ayisetyenziswa |
| ZLASTSESSION | ayaziwa |
| ZMEDIAITEM | ayaziwa |
| ZMESSAGEINFO | ayaziwa |
| ZPARENTMESSAGE | ayaziwa, ayisetyenziswa |
| ZMESSAGEDATE | isitampu sexesha kwi-OS X Epoch Time format |
| ZSENTDATE | ixesha apho umyalezo wathunyelwa kwi-OS X Epoch Time format |
| ZFROMJID | WhatsApp Umthumeli ID |
| ZMEDIASECTIONID | iqulethe unyaka kunye nenyanga ifayile yemidiya ethunyelweyo |
| ZPHASH | ayaziwa, ayisetyenziswa |
| ZPUSHPAME | Igama lomfowunelwa othumele ifayile yemidiya ngefomathi ye-UTF-8 |
| ZSTANZID | isichongi somyalezo esisodwa |
| ZTEXT | Umyalezo obhaliweyo |
| ZTOJID | I-ID ye-WhatsApp yomamkeli |
| OFFSET | umkhethe |
Imbonakalo yetafile 'ZWAMEDIAITEM':
Ubume betafile 'ZWAMEDIAITEM'
| Igama lommandla | Nentsingiselo |
|---|---|
| Z_PK | inombolo yolandelelwano lwerekhodi (kwitafile yeSQL) |
| Z_ENT | isichongi setafile, sinexabiso '8' |
| Z_OPT | ayaziwa, ihlala iqulathe amaxabiso ukusuka '1' ukuya '3'. |
| ZCLOUDSTATUS | iqulathe ixabiso '4' ukuba ifayile ilayishiwe. |
| ZFILESIZE | iqulethe ubude befayile (ngee-bytes) zeefayile ezikhutshelweyo |
| ZMEDIAORIGIN | ayaziwa, ihlala inexabiso '0' |
| ZMOVIEDURATION | Ubude befayile yemidiya, kwiifayile ze-pdf zinokuqulatha inani lamaphepha oxwebhu |
| ZMESSAGE | iqulethe inombolo yothotho (inani lahlukile kweli liboniswe kuluhlu lwe-'Z_PK') |
| ZASPECTRATIO | Umlinganiselo wembonakalo, awusetyenziswanga, uhlala umiselwe ku-'0' |
| UZHACURACY | ayaziwa, ihlala inexabiso '0' |
| UMOYA | ububanzi kwiipikseli |
| I-ZLONGTITUDE | ubude kwiipikseli |
| ZMEDIAURLDATE | isitampu sexesha kwi-OS X Epoch Time format |
| ZAUTHORNAME | umbhali (kumaxwebhu, angaqulatha igama lefayile) |
| ZCOLLECTIONNAME | ayisetyenziswanga |
| ZMEDIALOCALPATH | Igama lefayile (kuquka indlela) kwisixokelelwano sefayile yesixhobo |
| ZMEDIAURL | I-URL apho ifayile yemidiya ibekwe khona. Ukuba ifayile idluliselwe ukusuka kumrhumeli omnye ukuya komnye, ibifihliwe kwaye ulwandiso lwayo luya kuboniswa njengolwandiso lwefayile egqithiselweyo - .enc |
| ZTHUMBNAILLOCALPATH | Indlela eya kwi thumbnail yefayile kwisixokelelwano sefayile yesixhobo |
| ZTITLE | iheader yefayile |
| ZVCARDNAME | I-hash yefayile yemidiya xa udlulisela ifayile kwiqela, inokuba nesazisi somthumeli |
| ZVCARDSTRING | iqulethe ulwazi malunga nohlobo lwefayile egqithiselwayo (umzekelo, umfanekiso/jpeg xa ugqithisela ifayile kwiqela, inokuqulatha isazisi somamkeli). |
| ZXMPPTHUMBPATH | Indlela eya kwi thumbnail yefayile kwisixokelelwano sefayile yesixhobo |
| ZMEDIAKEY | ayaziwa, mhlawumbi iqulathe isitshixo sokususa ukuntsonkotha kwefayile efihliweyo. |
| ZMETADATA | imetadata yomyalezo ogqithisiweyo |
| Ukucinywa | umkhethe |
Ezinye iitafile zedatha enomdla 'ChatStorage.sqlite' zezi:
- 'ZWAPROFILEPUSHNAME'. Idibanisa i-ID ye-WhatsApp kunye negama loqhagamshelwano;
- 'ZWAPROFILEPICTUREITEM'. Idibanisa i-ID ye-WhatsApp kunye ne-avatar yoqhagamshelwano;
- 'Z_PRIMARYKEY'. Itheyibhile iqulethe ulwazi olubanzi malunga nale database, njengenani elipheleleyo lemiyalezo egciniweyo, inani elipheleleyo leengxoxo, njl.
Kwakhona, xa uphonononga i-WhatsApp kwisixhobo esiphathwayo esisebenzisa i-iOS, kufuneka unikele ingqalelo kwezi fayile zilandelayo:
- Ifayile 'BackedUpKeyValue.sqlite'. Iqulethe izitshixo ze-cryptographic kunye nezinye iinkcukacha eziyimfuneko ukuchonga umnini-akhawunti. Ibekwe ecaleni kwendlela: /yabucala/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- Ifayile 'ContactsV2.sqlite'. Iqulethe ulwazi malunga nabafowunelwa bomsebenzisi, njengegama elipheleleyo, inombolo yefowuni, isimo soqhagamshelwano (kwifom yombhalo), i-ID ye-WhatsApp, njl. Ibekwe ecaleni kwendlela: /yabucala/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- Ifayile 'uguqulelo_ lwabathengi'. Iqulethe inombolo yenguqulo yesicelo esifakiweyo se-WhatsApp. Ibekwe ecaleni kwendlela: /yabucala/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/.
- Ifayile 'current_wallpaper.jpg'. Iqulethe i-wallpaper yangoku ye-WhatsApp. Ibekwe ecaleni kwendlela: /yabucala/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/. Iinguqulelo ezindala zesicelo zisebenzisa ifayile 'iphepha lodonga', ebekwe ecaleni kwendlela: '/yabucala/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/'.
- Ifayile 'blockedcontacts.dat'. Iqulethe ulwazi malunga nabafowunelwa abavaliweyo. Ibekwe ecaleni kwendlela: /yabucala/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/.
- Ifayile 'pw.dat'. Iqulethe igama eliyimfihlo elifihliweyo. Ibekwe ecaleni kwendlela: '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/'.
- Ifayile 'net.whatsapp.WhatsApp.plist' (okanye ifayile 'iqela.net.whatsapp.WhatsApp.kwabelwana.plist'). Iqulethe ulwazi malunga neprofayile yakho ye-akhawunti ye-WhatsApp. Ifayile ibekwe ecaleni kwendlela: '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Library/Preferences/'.
Imixholo yefayile 'group.net.whatsapp.WhatsApp.shared.plist'
Kufuneka kwakhona unike ingqwalasela kula maxwebhu alandelayo:
- ulawulo '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Media/Profile/'. Iqulethe i-thumbnails yabafowunelwa, amaqela (iifayile ezinolwandiso .ubhontsi), ii-avatars zoqhagamshelwano, i-avatar yomnini weakhawunti ye-WhatsApp (ifayile 'Ifoto.jpg').
- ulawulo '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/Message/Media/'. Iqulathe iifayile zemultimedia kunye ne-thumbnails yazo
- ulawulo '/yabucala/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/'. Iqulethe ushicilelo lwenkqubo yokusebenza (ifayile 'calls.log') kunye neekopi ezigciniweyo zelog yokusebenza kwenkqubo (ifayile 'calls.backup.log').
- ulawulo '/private/var/mobile/Applications/group.net.whatsapp.WhatsApp.shared/stickers/'. Iqulethe izincamathelisi (iifayile ezikwifomathi '.webp').
- ulawulo '/private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/Logs/'. Iqulethe iilog zokusebenza zeprogram.
Iimpawu ze-WhatsApp kwiWindows
Izinto ze-WhatsApp kwiWindows zinokufumaneka kwiindawo ezininzi. Okokuqala, ezi zizikhokelo eziqulathe iifayile zeprogram eziphunyeziweyo nezincedisayo (kwiWindows 8/10):
- 'C: Iifayile zeNkqubo (x86)WhatsApp'
- 'C:Abasebenzisi%Iprofayile yoMsebenzisi% AppDataLocalWhatsApp'
- 'C:Abasebenzisi%Iprofayile yoMsebenzisi% AppDataLocalVirtualStore Programme Files (x86)WhatsApp'
Kwikhathalogu 'C:Abasebenzisi%Iprofayile yoMsebenzisi% AppDataLocalWhatsApp' ifayile yelog ikhona 'SquirrelSetup.log', equlethe ulwazi malunga nokujonga uhlaziyo kunye nokufaka inkqubo.
Kwikhathalogu 'C:Abasebenzisi%Iprofayile yoMsebenzisi% AppDataRoamingWhatsApp' Kukho oovimba bolawulo abaliqela:
Ifayile 'main-process.log' iqulethe ulwazi malunga nokusebenza kwenkqubo kaWhatsApp.
Uvimba weefayili onganeno 'iziseko zolwazi' iqulathe ifayile 'Iinkcukacha zedatha.db', kodwa le fayile ayinalwazi malunga neencoko okanye abafowunelwa.
Eyona nto inika umdla kwimboniselo yeforensikhi ziifayile ezibekwe kulawulo 'Cache'. Ezi ziifayile ezinegama 'f_*******' (apho * linani ukusuka ku-0 ukuya kwi-9) equlathe iifayile zemultimedia ezifihliweyo kunye namaxwebhu, kodwa kukho neefayile ezingafihlwanga phakathi kwazo. Eyona nto inomdla kakhulu ziifayile 'idatha_0', 'idatha_1', 'idatha_2', 'idatha_3', ibekwe kuluhlu olungaphantsi olufanayo. Iifayile 'idatha_0', 'idatha_1', 'idatha_3' ziqulathe amakhonkco angaphandle kwiifayile ezifihliweyo zemultimedia kunye namaxwebhu.
Umzekelo wolwazi oluqulethwe kwifayile 'data_1'
Kwakhona ifayile 'idatha_3' inokuba neefayile zegraphic.
Ifayile 'idatha_2' iqulethe ii-avatars zoqhagamshelwano (inokubuyiselwa ngokukhangela ngeeheader zefayile).
Ii-avatar eziqulethwe kwifayile 'idatha_2':
Ke, iincoko ngokwazo azinakufunyanwa kwimemori yekhompyuter, kodwa unokufumana:
- iifayile zemultimedia;
- amaxwebhu athunyelwa nge-WhatsApp;
- ulwazi malunga nabafowunelwa bomnini-akhawunti.
Iimpawu zeWhatsApp kwiMacOS
Kwi-MacOS unokufumana iintlobo ze-WhatsApp izinto zakudala ezifanayo nezo zifumaneka kwiWindows OS.
Iifayile zeprogram zikolu luhlu lulandelayo:
- 'C:IziceloWhatsApp.app'
- 'C:Izicelo._WhatsApp.app'
- 'C:Abasebenzisi%Iprofayile yoMsebenzisi% Izikhethwa zeThala leeNcwadi'
- 'C:Abasebenzisi%Iprofayile yoMsebenzisi%LibraryLogsWhatsApp'
- 'C:Abasebenzisi%Iprofayile yoMsebenzisi%Ithala leencwadi leSicelo esiGciniweImeko WhatsApp.savedState'
- 'C:Abasebenzisi%Iprofayile yoMsebenzisi% Izishicileli zeSicelo seThala leeNcwadi'
- 'C:Abasebenzisi%Iprofayile yoMsebenzisi%%Thala lesicelo seNkxasoCloudDocs'
- 'C:Abasebenzisi%Iprofayile yoMsebenzisi%iNkxaso yeSicelo seThala leeNcwadi kwiWhatsApp.ShipIt'
- 'C:Abasebenzisi%Iprofayile yoMsebenzisi%LibraryContainerscom.rockysandstudio.app-for-whatsapp'
- 'C:Abasebenzisi%Iprofayile yoMsebenzisi% Amaxwebhu eThala leeNcwadi eziSetyenziswayo zeThala leeNcwadi <ukutshintsha okubhaliweyo> Iiakhawunti zikaWhatsApp'
Olu luhlu luqulathe oovimba bolawulo abamagama aziinombolo zefowuni ezinxulumene nomnini weakhawunti kaWhatsApp. - 'C:Abasebenzisi%Iprofayile yoMsebenzisi%LibraryCachesWhatsApp.ShipIt'
Olu luhlu luneenkcukacha malunga nokuhlohla inkqubo. - 'C:Abasebenzisi%Iprofayile yoMsebenzisi%MfanekisoIthala leencwadi.photolibraryMasters', 'C:Abasebenzisi%Iprofayile yoMsebenzisi%Imifanekiso yeThala leeNcwadi.Ithala leefotoIziThupha'
Ezi nkcukacha ziqulethe iifayile zenkonzo yeprogram, kubandakanywa iifoto kunye nezithonjana zabafowunelwa be-WhatsApp. - 'C:Abasebenzisi%Iprofayile yoMsebenzisi%LibraryCachesWhatsApp'
Olu lawulo luqulathe oovimba beenkcukacha ezininzi beSQLite ezisetyenziselwa ukugcinwa kwedatha. - 'C:Abasebenzisi%Iprofayile yoMsebenzisi%Inkxaso yesicelo seThala leencwadi'
Olu luhlu luqulathe oovimba beefayili abaliqela:
Kwikhathalogu 'C:Abasebenzisi%Iprofayile yoMsebenzisi%Inkxaso yeSicelo seThala leeNcwadi kwiWhatsAppCache' kukho iifayile 'idatha_0', 'idatha_1', 'idatha_2', 'idatha_3' kunye neefayile ezinamagama 'f_*******' (apho * linani ukusuka ku-0 ukuya ku-9). Ngolwazi malunga nokuba loluphi ulwazi oluqulathwe zezi fayile, bona i-WhatsApp Artifacts kwiWindows.Kwikhathalogu 'C:Abasebenzisi%Iprofayile yoMsebenzisi%Inkxaso yeSicelo seThala leeNcwadiI-WhatsAppIndexedDB' inokuba neefayile zemultimedia (iifayile azinasongezo).
Ifayile 'main-process.log' iqulethe ulwazi malunga nokusebenza kwenkqubo kaWhatsApp.
Imithombo
- Uhlalutyo lwe-forensic lwe-WhatsApp Messenger kwii-smartphones ze-Android, nguCosimo Anglano, ngo-2014.
- I-Whatsapp Forensics: Uluhlu lwenkqubo lwesiseko kunye nesiseko sedatha yesicelo se-Android kunye ne-iOS ngu-Ahmad Pratama, ngo-2014.
Kumanqaku alandelayo kolu ngcelele:
Ukucinywa kwekhowudi yolwazi ye-WhatsApp efihliweyoInqaku eliza kunika ulwazi malunga nendlela iqhosha le-encryption le-WhatsApp lenziwa ngayo kunye nemizekelo ebonakalayo ebonisa indlela yokususa uguqulelo lweenkcukacha ezifihliweyo zesi sicelo.
Ukutsalwa kwedatha ye-WhatsApp kwindawo yokugcina ilifuInqaku apho siza kukuxelela ukuba yeyiphi idatha ye-WhatsApp egcinwe emafini kwaye ichaze iindlela zokufumana le datha kwi-stocks yefu.
Ukutsalwa kweDatha ye-WhatsApp: Imizekelo EsebenzayoInqaku eliza kuchaza inyathelo ngenyathelo zeziphi iinkqubo kunye nendlela yokukhupha idatha ye-WhatsApp kwizixhobo ezahlukeneyo.
umthombo: www.habr.com