Hi Kbertens
Thanks a lot for the reply. Can you share your email id ? You can mail me at harsh_behl@live.com
Droopy
I will surely have a look. Can you suggest one that can work with USB debugging enabled and an unrooted phone ??
Sure use
Is free for 30 days, you could buy it or use the cracked version free.
Droopie thanks for the recommendation.
but I am very sorry for the incorrect information as the phone is not usb debugging enabled. The usb debbuging is disabled. As I know that if it was enabled there were several ways.
Hey,
The key is *usually* stored in /data/data/com.whatsapp/files/key
The encryption method used in crypt8 is AES with a 256bit key and a 128bit Initialisation Vector (IV)
Offsets are here
Offset 0x6E size 0x10 (IV 128bit)
Offset 0x7E size 0x20 (AES Key 256bit)
If you want to decrypt the data yourself you can do using these keys. You'll need to remove some header data from the crypt8 file and use openssl to decrypt.
The password (password.key) or pattern (gesture.key) file is in the userdata partition.
Depends on your case but it is possible to replace the recovery partition with a custom build one, mount the userdata partition and remove these keys.
With the files removed you can access the device. Maybe not the best forensic solution, but it works.
So you have a copy of the data on the SD card but no copy of the phone?
YES. I only have the copy of the SD Card. Kindly reply.
Hi
I too have the same challenges as harshbehl. Have imaged a laptop and noted it contained crypt8 whatsapp database. However, we do not have the suspect's phone. Hope can provide some insight and help on this.
Much appreciated.
//SheZZaR
Without the key, is difficult.
If you are goverment based forensic, you will need to know real phone number and create a new registration and redirect the new registration reply digits by ss7 interception to the new sim to register.
Not easy for average forensic.
Cracking the key needs a supercomputer access and it is also expensive.
I have decompiled whatsapp to plain source code and key is generated using phone number (maybe on next updates they added an imei or device fixed key)
Belkasoft Evidence Center (https://
@droopy - SS7 LI, is AnyTimeInterrogation required? Some operators actually block this cmd