WeChat History from...
 
Notifications
Clear all

WeChat History from PC App / Decoding

cs1337
(@cs1337)
Member

Hello Everyone,

I am looking to collect WeChat data that is synced from a PC.

From what I was able to find is that the data is stored under

Temporary data folder (Isolated storage) – Modern apps save their data at the following location – C\Users\<username>\AppData\Local\Packages.

I'm not seeing anything indicating the name of my backup file and the APP isn't helpful at telling you where is it saving the backup. Is anyone familiar with this? Are there any tools that can decode the data in a user friendly format?

Appreciate any assistance you can provide.

Quote
Topic starter Posted : 01/07/2019 10:23 pm
deeFIR
(@deefir)
Junior Member

WeChat data is stored in EnMicroMsg.db which can be decrypted relatively easily.

What kind of image have you obtained? Logical/Physical? How have you identified the app is installed? Can you open it on the machine itself, or is it only a backup of app data?

ReplyQuote
Posted : 15/07/2019 6:38 am
Igor_Michailov
(@igor_michailov)
Senior Member

Try to use Belkasoft for extracting the chats.

ReplyQuote
Posted : 15/07/2019 7:31 pm
deeFIR
(@deefir)
Junior Member

Try to use Belkasoft for extracting the chats.

Why not suggest a vendor-agnostic approach in the first instance?

Install the app, generate your own test data, generate a backup and identify the app's default storage location.

ReplyQuote
Posted : 17/07/2019 8:31 am
Belkasoft
(@belkasoft)
Active Member

Try to use Belkasoft for extracting the chats.

Why not suggest a vendor-agnostic approach in the first instance?

Install the app, generate your own test data, generate a backup and identify the app's default storage location.

Well, the question was "are there any tools" and indeed, there are.

ReplyQuote
Posted : 30/07/2019 3:14 pm
Share:
Share to...