±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 34200
New Yesterday: 1 Visitors: 118

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Forensic Focus - Forensics on WhatsApp - Digital Forensics Forums General Discussion - Forensics on WhatsApp

Forensic Focus

Go to page 1, 2  Next  :| |:

General Discussion

Forensics on WhatsApp

Forensics on WhatsApp

Posted: Sun Mar 03, 2013 6:49 am
Author: CopyRight Location: Oman
The images that are sent and received using the APP "Whatsapp" have thier EXIF details stripped off. Is there a way where we can analyze the photos and know stuff like when it was taken and where and so on?

Or the EXIF info are permanently stripped off by WhatsApp?
We'de like to track the original sender of the picture.

Re: Forensics on WhatsApp

Posted: Sun Mar 03, 2013 1:20 pm
Author: keydet89 Location: NoVA
- CopyRight
The images that are sent and received using the APP "Whatsapp" have thier EXIF details stripped off.


I'd think that you pretty much answered your own question.

If you have the source device from which the images were sent, you may find copies of the images before they were run through WhatsApp.

Re: Forensics on WhatsApp

Posted: Sun Mar 03, 2013 4:11 pm
Author: bsc.Smith19 Location: Derby Univeristy
If the EXIF data has been stripped off of the photos then it is highly doubtful you will find the original sender.

Unless as mentioned above you happen to come across the source device then you might find the original images.

Re: Forensics on WhatsApp

Posted: Sun Mar 03, 2013 7:09 pm
Author: DaveAllen Location: Waveland, MS.
I'm not sure about WhatsApp, but I've been told in training that although Facebook removes EXIF data on the site, they retain the originals which can be retrieved with a warrant. Maybe WhatsApp still has what you need. Happy Hunting.

-Dave

Re: Forensics on WhatsApp

Posted: Mon Mar 04, 2013 6:05 am
Author: CopyRight Location: Oman
Thanks Folks..

Yeah we do have the device and there aren't any original photos on the device itself.

EXIF details are stripped off for higher uploading speeds or protecting privacy, what do you think?

All i know is that its making our lives harder =P!!

Re: Forensics on WhatsApp

Posted: Mon Mar 04, 2013 9:53 am
Author: Passmark Location: Sydney
I assume you looked for deleted files that can be recovered on the original device?

Did you confirm that it really does strip all the data and not overwrite it with nulls or something?

Did you try searching the net for a second copy of the same image without the data stripped. See,
images.google.com/imghp?hl=en

Re: Forensics on WhatsApp

Posted: Mon Mar 04, 2013 10:21 am
Author: CopyRight Location: Oman
Passmark thats right, and yes i have searched on google images, nothing similar.
Please check your Personal Messages Inbox .

All times are GMT - 6 Hours
Page 1 of 2 Go to page 1, 2  Next  :| |:
https://www.forensicfocus.com/