±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36317
New Yesterday: 0 Visitors: 178

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

WeChat Android Phone Missing Attachments

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

cs1337
Senior Member
 

WeChat Android Phone Missing Attachments

Post Posted: Nov 15, 19 18:29

I have been asked by a client to find out answers to some of the following questions. We performed collection of WeChat data using APK Downgrade via Cellebrite on an Android device and we weren’t able to get any attachments to the messages. I reached out to Cellebrite Support but I figured it couldn't hurt to see if you all have any experience with it and can provide some answers/guidance.


1. If we used some method/tool other than Cellebrite, could we get attachments from Android phones?
2. Could we open this users account on an iPhone to get the missing attachments?
3. Do attachments expire/disappear from the phones after a period of time?

Appreciate any insight you all have. I believe Belkasoft has a WeChat module so i reached out to them for more information.  
 
  

dandaman_24
Senior Member
 

Re: WeChat Android Phone Missing Attachments

Post Posted: Nov 15, 19 21:53

Whats to say the attachments were stored on the phone.

1. Always dual tool to see the differences in tools
2. Always manually verify the download against the handset. I would recommend opening the Wechat app on the phone and looking at the settings for storage values and also the chats to see if the attachments are present. Then you will get your answer.
3. It is possible, but i doubt it with this app.

Its more than likely that attachments were not stored to the device.  
 
  

cs1337
Senior Member
 

Re: WeChat Android Phone Missing Attachments

Post Posted: Nov 19, 19 16:20

Thanks Dan for those curious i did some testing and found some answers

1. If we used something other than cellbrite, could we get attachments from Android phones? Checked with Belkasoft and it requires a physical image (root). Cellebrite doesn’t have a solution. Also reached out to MSAB (XRY) if they have a solution (haven’t heard back yet)
2. Could we open this users account on an IPhone to get the missing attachments? Logging into another iPhone doesn’t transfer the conversations
3. Do attachments expire/disappear from the phones after a period of time? I don’t see any option within the GUI to set an attachment disappear or expire.

My team has come up with a proposed solution that seems promising. Use the WeChat desktop APP and create a backup local to the PC of all messages/attachments on the android. You can then restore the data to a brand new iPhone and then use Cellebrite to collect. You will then have all the decoded messages / attachments.

You can also restore this to an Android device that you can either perform a physical extraction on / already rooted in order to do so.

Hope this helps someone in the future.  
 

Page 1 of 1