Notifications
Clear all

Wickr iOS iPhone FS

10 Posts
7 Users
0 Likes
1,926 Views
(@dandaman_24)
Posts: 172
Estimable Member
Topic starter
 

I have a FS dump of iPhone, when parsed in latest version of PA it asks for the password to decode the Wickr app, I have entered the password, but it appears it was incorrect as no Wickr chat messages has been reported in PA report.

Is there a way to attempt to retry passwords for Wickr after the data has been parsed in PA ?

I have multiple passwords to try, but i dont want to re parse the data for each attempt, it doesnt seem logical to me.

Thanks

 
Posted : 12/09/2018 2:18 pm
(@stefspvq)
Posts: 14
Active Member
 

I done a graykey extraction of my own iphone with Wicker on it. So i know the password. When i put the FS extraction of the graykey on PA, i ask me for the Wicker password. I entered my password and didnt decode the Wicker message. I see the database, try to use with SQL software but didnt decrypt that. I think on Cellebrite web site you can have a list of supported apps and also the version that is supported by Cellebrite. Maybe our case is that the version of Wicker didnt support by Cellebrite.

Anybody have a clue or solution i will take it! thks!

 
Posted : 16/09/2018 3:29 pm
(@dandaman_24)
Posts: 172
Estimable Member
Topic starter
 

PM'd you

 
Posted : 17/09/2018 1:51 pm
(@zeroonezero)
Posts: 16
Active Member
 

I done a graykey extraction of my own iphone with Wicker on it. So i know the password. When i put the FS extraction of the graykey on PA, i ask me for the Wicker password. I entered my password and didnt decode the Wicker message. I see the database, try to use with SQL software but didnt decrypt that. I think on Cellebrite web site you can have a list of supported apps and also the version that is supported by Cellebrite. Maybe our case is that the version of Wicker didnt support by Cellebrite.

Anybody have a clue or solution i will take it! thks!

I do not understand why so many PM users information when we have a forum for the purpose of sharing information so that others can make use of it. I do not mean to step on any toes. I just love the community we have here and I often see posts addressing an issue I have encountered, only for the solution to be trapped in someones inbox.

With that said, what was the solution to this, if there was one?

 
Posted : 26/09/2018 11:52 pm
(@dave_akko)
Posts: 1
New Member
 

PM'd you

Please can your solution be shared? We have exactly the same issue as mentioned above.

PA asks for the password - enter and nothings displayed.

Databases checkec etc..

Many thnaks

 
Posted : 25/10/2018 1:59 pm
(@sempiternal94)
Posts: 1
New Member
 

I have a FS dump of iPhone, when parsed in latest version of PA it asks for the password to decode the Wickr app, I have entered the password, but it appears it was incorrect as no Wickr chat messages has been reported in PA report.

Is there a way to attempt to retry passwords for Wickr after the data has been parsed in PA ?

I have multiple passwords to try, but i dont want to re parse the data for each attempt, it doesnt seem logical to me.

Thanks

I've encountered the same issue with physical extractions from Android devices too, a solution would be helpful

 
Posted : 28/10/2018 9:22 am
(@dandaman_24)
Posts: 172
Estimable Member
Topic starter
 

once the data is parsed in PA, there is now a plugin you can run to re attempt to decrypt the Wickr App.

 
Posted : 17/12/2018 9:30 pm
(@jjh2320)
Posts: 21
Eminent Member
 

Good Morning All,

Can anyone point me in the direction of running this plugin without having to re-decode the whole extraction. No references made to an existing plugin within PA itself?

Thank you in advance.

J

 
Posted : 02/07/2019 10:23 am
(@cobb1985)
Posts: 1
New Member
 

Hey,

I could also use some assistance with Wickr in PA. I have the application passcode which PA prompted for but then nothing seemed to parse out. If there is a way to avoid using the SQLite wizard I'd love to know it.

Thanks!

 
Posted : 01/10/2019 12:32 pm
(@dandaman_24)
Posts: 172
Estimable Member
Topic starter
 

https://thebinaryhick.blog/2019/08/23/wickr-alright-well-call-it-a-draw/

 
Posted : 01/10/2019 12:44 pm
Share: