123ArticleOnline Logo
Welcome to 123ArticleOnline.com!
ALL >> Computers >> View Article

Forensic Guide To Whatsapp Data Acquisition

Profile Picture
By Author: Olga Koksharova
Total Articles: 1
Comment this article
Facebook ShareTwitter ShareGoogle+ ShareTwitter Share

Instant messaging apps have become the de-facto standard of real-time, text-based communications. The acquisition of instant messaging chats and communication histories can be extremely important for an investigation. In this article, we compare the five top instant messaging apps for iOS in the context of their forensic analysis.

Acquisition and Extraction

Speaking of iOS, there are several methods to acquiring communications going through an instant messaging app. The MITM (man-in-the-middle) attack is practically out of the question for most modern instant messaging apps; if there are exceptions, we aren't aware of those. Even on Android devices, a MITM attack would require installing a third-party SSL certificate, and even that may not work for some instant messengers.

The ability to obtain communication histories from the vendor is a great tool in the hands of the law enforcement. The policies of different vendors vary greatly from near-instant full disclosure to flat non-disclosure with stops in between.

Cloud extraction may be possible from several sources, which include iCloud synchronized data (including end-to-end encrypted data), iCloud backups and stand-alone backups in iCloud Drive. It's up to the vendor to decide where and how to store the data; more on that later.

Finally, the data can be extracted from the iPhone device itself. For some messaging apps, logical extraction via iTunes-style backups is enough, while some other messengers don't store anything in local backups. Imaging the file system (and, in some cases, decrypting the keychain) is always enough to gain full access to conversation histories.

Let us see the extraction options available for thetop instant messaging app, WhatsApp.

Today, WhatsApp is one of the most popular (if not the most popular) instant messaging tools worldwide. While WhatsApp communication is based on the Signal protocol employing end-to-end encryption, that fact alone does not make WhatsApp any more secure than other messaging apps as WhatsApp keeps a backup of its conversation histories, making them easily accessible with several acquisition techniques.

Article Image

Legal requests: WhatsApp does not store conversation histories on its servers. As a result, only pending (undelivered) messages can be obtained with a legal request.

Vendor cloud: Facebook does not keep WhatsApp conversations on its servers, and cloud acquisition is not generally possible with one exception. Undelivered (pending) messages are still stored on the server, and can be downloaded with forensic software by authenticating as a new WhatsApp client.

Local backups: More often than not, WhatsApp communication histories show up in both local and cloud iOS backups (there are exceptions).

iCloud backups: Same as above. More often than not, WhatsApp conversation histories can be extracted from iCloud backups.

iCloud Drive: WhatsApp has an option to save stand-alone, proprietary backups in iCloud Drive. While these backups can be easily downloaded, they are protected with end-to-end encryption. As a result, one must authenticate as a WhatsApp client in order to decrypt the backup (e.g. using Elcomsoft Explorer for WhatsApp). This requires access to the user's registered WhatsApp number.

File system: WhatsApp does not feature any additional protection to the working database. Once a file system image is captured from the iPhone, extracting and analyzing WhatsApp conversations is straightforward.

WhatsApp Verdict

The acquisition of the user's WhatsApp communications is easier than average. WhatsApp conversations can be extracted from nearly every available source including local and cloud backups.

Tools required: Elcomsoft iOS Forensic Toolkit and Elcomsoft Phone Viewer; or Elcomsoft Explorer for WhatsApp.

Elcomsoft Explorer for WhatsApp is a tool to download, decrypt and display WhatsApp communication histories. It automatically acquires WhatsApp databases from one or multiple sources, processes information and displays contacts, messages, call history and pictures sent and received. The built-in viewer offers convenient searching and filtering, and allows viewing multiple WhatsApp databases extracted from various sources. Visit Elcomsoft Explorer for WhatsApp official web page to find more information and try it for free.

Total Views: 80Word Count: 624See All articles From Author

Add Comment

Computers Articles

1. How To Extract Telegram Secret Chats From The Iphone
Author: Vladimir Katalov

2. Best External Hard Drives For 2020
Author: Lenoxtons20

3. A Photo Manager And Digital Asset Manager For Creative Photography
Author: Jamie Atkins

4. Why Is Dark The Most Iconic Piece Of Art In Sci-fi Genre?
Author: Abigail Smith

5. Tips And Tricks To Grow Your Instagram Using Pinterest
Author: Abigail Smith

6. Things You Can Follow To Be More Secure Online
Author: Abigail Smith

7. Acronis Universal Restore Ensures Bare-metal Restore Of Dissimilar Hardware
Author: Maria Kurganova

8. Seamless V2p Backup And Restore
Author: Maria Kurganova

9. Top 10 Must-watch Netflix Originals
Author: John Smith

10. Top 3 Itil Emerging Trends To Watch Out For In 2020
Author: Novel Vista

11. #experttalk - Siam? Target Model, Who Comes First - Service Integrator?, Service Provider? Or In Par
Author: Novel Vista

12. Best Mini Laptops For 2020
Author: Lenoxtons20

13. Best Background Erasing Apps For Android & Ios
Author: John Smith

14. Improve Your Drafting With A Multi-purpose Cad Platform
Author: Nick Giles

15. Insignia Ns-50df711se21 50-inch 4k Uhd Tv - Fire Tv Edition
Author: Lenoxtons20

Login To Account
Login Email:
Forgot Password?
New User?
Sign Up Newsletter
Email Address: