Dear all,
I would like to know if in an Apple iPhone exist a general log file. In this all the operation are written included date and time of when I deleted a whatsapp message. This log can be taken with UFED. thanks all
Dear all,
I would like to know if in an Apple iPhone exist a general log file. In this all the operation are written included date and time of when I deleted a whatsapp message. This log can be taken with UFED. thanks all
I am not sure, but if it does exist, but if it does, you'd need to get a full physical extraction vs advanced logical.
There is a general system log (/var/log/system.log), but this won't have the informations about WhatsApp deleted messages.
I think a filesystem dump would do it as well. WhatsApp stores messages in it's database, when a message is deleted, actually it is flagged only, not removed. UFED Physical Analyzer decrypts and will show you the deleted messages as well. The last modification date should be also stored somewhere, if it is not shown by default, try checking manually with some SQLite browser.
Cellebrite should help a bit, since there are differences decrypting the useful data, depending on the WhatsApp version and the encryption generation as well.