WeChat History from...
 
Notifications
Clear all

WeChat History from PC App / Decoding

5 Posts
4 Users
0 Likes
1,842 Views
(@cs1337)
Posts: 83
Trusted Member
Topic starter
 

Hello Everyone,

I am looking to collect WeChat data that is synced from a PC.

From what I was able to find is that the data is stored under

Temporary data folder (Isolated storage) – Modern apps save their data at the following location – C\Users\<username>\AppData\Local\Packages.

I'm not seeing anything indicating the name of my backup file and the APP isn't helpful at telling you where is it saving the backup. Is anyone familiar with this? Are there any tools that can decode the data in a user friendly format?

Appreciate any assistance you can provide.

 
Posted : 01/07/2019 9:23 pm
(@deefir)
Posts: 49
Eminent Member
 

WeChat data is stored in EnMicroMsg.db which can be decrypted relatively easily.

What kind of image have you obtained? Logical/Physical? How have you identified the app is installed? Can you open it on the machine itself, or is it only a backup of app data?

 
Posted : 15/07/2019 5:38 am
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

Try to use Belkasoft for extracting the chats.

 
Posted : 15/07/2019 6:31 pm
(@deefir)
Posts: 49
Eminent Member
 

Try to use Belkasoft for extracting the chats.

Why not suggest a vendor-agnostic approach in the first instance?

Install the app, generate your own test data, generate a backup and identify the app's default storage location.

 
Posted : 17/07/2019 7:31 am
(@belkasoft)
Posts: 169
Estimable Member
 

Try to use Belkasoft for extracting the chats.

Why not suggest a vendor-agnostic approach in the first instance?

Install the app, generate your own test data, generate a backup and identify the app's default storage location.

Well, the question was "are there any tools" and indeed, there are.

 
Posted : 30/07/2019 2:14 pm
Share: