Whatsapp Key for Wi...
 
Notifications
Clear all

Whatsapp Key for Windows phone

12 Posts
6 Users
0 Likes
1,436 Views
(@harshbehl)
Posts: 67
Trusted Member
Topic starter
 

Hi
Does anyone have an idea, where to find the whatsapp key from a dump of windows phone. I have dump of Nokia Lumia 520 but i am looking for the whatsapp key file.
Replies will be appreciated. Thanks in advance.

 
Posted : 30/01/2015 11:14 am
(@ashishsingh)
Posts: 29
Eminent Member
 

Hi Dear,

Did you have a look at this very location? -

/data/data/com.whatsapp/files/key file

Make sure that you have root installed on your phone. You can make use of Root Explorer as well.

I guess this will work for you.

Thanks and Regards

 
Posted : 02/02/2015 9:19 am
(@harshbehl)
Posts: 67
Trusted Member
Topic starter
 

Ashish this location is found in android OS. The file structure in windows phone is totally different.

 
Posted : 02/02/2015 10:05 am
OxygenForensics
(@oxygenforensics)
Posts: 143
Estimable Member
 

You can check this location for the files /Data/Users/DefApps/APPDATA/Local/Packages/

 
Posted : 06/02/2015 1:21 pm
(@rampage)
Posts: 354
Reputable Member
 

Hi, i know it's off topic, but i was wondering how did you dump the phone, and what are you using for analyzing the filesystem?

 
Posted : 16/02/2015 3:53 am
(@harshbehl)
Posts: 67
Trusted Member
Topic starter
 

Hi, i know it's off topic, but i was wondering how did you dump the phone, and what are you using for analyzing the filesystem?

Hi
I am using Cellebrite's UFED to image the phone and UFED PA or you can use R-Studio to analyze the contents.

 
Posted : 16/02/2015 3:48 pm
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

Hi, i know it's off topic, but i was wondering how did you dump the phone, and what are you using for analyzing the filesystem?

You can use Belkasoft for extract data from the dump.

 
Posted : 16/02/2015 3:56 pm
(@rampage)
Posts: 354
Reputable Member
 

Hi, i know it's off topic, but i was wondering how did you dump the phone, and what are you using for analyzing the filesystem?

Hi
I am using Cellebrite's UFED to image the phone and UFED PA or you can use R-Studio to analyze the contents.

it's a windows phone 8 right?

my scenario is pretty different, as my dump is a windows 7, and the partition doesn't seem to be formatted with any well known filesystem.

R-studio in this case is good only for carving and doesn't find sqlite databases for whatsapp, and if whatsapp is encrypted, finding the relevant keys for decoding is gonna be troublesome.

I've tried to get in touch with the UFED support to check with them if physical analyzer can decode windows phone 7.x dumps.

 
Posted : 16/02/2015 5:59 pm
(@agolding)
Posts: 31
Eminent Member
 

Hi, i know it's off topic, but i was wondering how did you dump the phone, and what are you using for analyzing the filesystem?

Hi
I am using Cellebrite's UFED to image the phone and UFED PA or you can use R-Studio to analyze the contents.

it's a windows phone 8 right?

my scenario is pretty different, as my dump is a windows 7, and the partition doesn't seem to be formatted with any well known filesystem.

R-studio in this case is good only for carving and doesn't find sqlite databases for whatsapp, and if whatsapp is encrypted, finding the relevant keys for decoding is gonna be troublesome.

I've tried to get in touch with the UFED support to check with them if physical analyzer can decode windows phone 7.x dumps.

X-Ways recover lost partitions should get you a file system. From there I dont believe the database was encrypted.

 
Posted : 16/02/2015 8:59 pm
(@rampage)
Posts: 354
Reputable Member
 

i've tried r-studio which can also recover lost partitions, but it failed badly, i think the problem is more related to the fact that the partition is not of any well known filesystem we are used to see on desktop computers.

 
Posted : 16/02/2015 9:47 pm
Page 1 / 2
Share: