±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36595
New Yesterday: 4 Visitors: 123

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

WhatsApp sent and received images path

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

giuseppem
Member
 

WhatsApp sent and received images path

Post Posted: Feb 04, 17 23:54

Dear all,

as the subject, I was wondering which is the path for sent and received images. I have an advanced logical extraction of an iPhone 6 s Plus, done with UFED Touch and report generated with UFED Physical Analyzer. I found a picture of interest and it is located in the following path:

iPhone/Applications/net.whatsapp.WhatsApp/Library/Media/
TELEPHONE_NUMBER @ s.whatsapp.net/
2/7/NNNNllNN-NNNN-NNNL-NNNN-LNNNLNllnL.jpg

"TELEPHONE_NUMBER" is not the phone number of the iphone's owner and "NNNNllNN-NNNN-NNNL-NNNN-LNNNLNllnL.jpg" is the disguised name of the picture which, actually, is a sequence of numbers and letters.
I think that what I found is a sent image.
Am I right?
 
 
  

Azarius
Newbie
 

Re: WhatsApp sent and received images path

Post Posted: Feb 16, 17 19:53

View the hex data... does it have the proper headers? Exif data present?  
 
  

mobileforensicswales
Senior Member
 

Re: WhatsApp sent and received images path

Post Posted: Feb 18, 17 19:13

The data you want is all in the DB, I would look there first  
 
  

giuseppem
Member
 

Re: WhatsApp sent and received images path

Post Posted: Feb 20, 17 16:42

Thank you Azarius and mobileforensicswales. I found lot of images, organized inside directory with the telephone number of the whatsapp contacts. For example: Jane has the telephone number 2222222222 and is a whatsapp contact of mine. I have an iPhone (actually, I haven't) an I sent lot of images to Jane, the same does Jane with me. On my phone, all these media are in the same directory 2222222222 @ s.whatsapp.net
So, @mobileforensicswales, as you are saying, the only way is to look inside the DB. Do you know the path of the DB? Can I explore it, also with an advanced logical extraction (it's not physical)?
Isn't it encrypted??  
 
  

mobileforensicswales
Senior Member
 

Re: WhatsApp sent and received images path

Post Posted: Feb 20, 17 18:25

 

Page 1 of 1