±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36212
New Yesterday: 0 Visitors: 175

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

WeChat History from PC App / Decoding

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

cs1337
Senior Member
 

WeChat History from PC App / Decoding

Post Posted: Jul 01, 19 21:23

Hello Everyone,

I am looking to collect WeChat data that is synced from a PC.

From what I was able to find is that the data is stored under

Temporary data folder (Isolated storage) – Modern apps save their data at the following location – C:\Users\<username>\AppData\Local\Packages.

I'm not seeing anything indicating the name of my backup file and the APP isn't helpful at telling you where is it saving the backup. Is anyone familiar with this? Are there any tools that can decode the data in a user friendly format?

Appreciate any assistance you can provide.  
 
  

deeFIR
Member
 

Re: WeChat History from PC App / Decoding

Post Posted: Jul 15, 19 05:38

WeChat data is stored in EnMicroMsg.db which can be decrypted relatively easily.

What kind of image have you obtained? Logical/Physical? How have you identified the app is installed? Can you open it on the machine itself, or is it only a backup of app data?  
 
  

Igor_Michailov
Senior Member
 

Re: WeChat History from PC App / Decoding

Post Posted: Jul 15, 19 18:31

Try to use Belkasoft for extracting the chats.
_________________
Computer, Cell Phone & Chip-Off Forensics

linkedin.com/in/igormikhaylovcf 
 
  

deeFIR
Member
 

Re: WeChat History from PC App / Decoding

Post Posted: Jul 17, 19 07:31

- Igor_Michailov
Try to use Belkasoft for extracting the chats.


Why not suggest a vendor-agnostic approach in the first instance?

Install the app, generate your own test data, generate a backup and identify the app's default storage location.  
 
  

Belkasoft
Senior Member
 

Re: WeChat History from PC App / Decoding

Post Posted: Jul 30, 19 14:14

- deeFIR
- Igor_Michailov
Try to use Belkasoft for extracting the chats.


Why not suggest a vendor-agnostic approach in the first instance?

Install the app, generate your own test data, generate a backup and identify the app's default storage location.


Well, the question was "are there any tools" and indeed, there are.
_________________
Computer, Mobile, RAM and Cloud Forensics In a Single Tool
belkasoft.com 
 

Page 1 of 1