Hello Everyone,
I am looking to collect WeChat data that is synced from a PC.
From what I was able to find is that the data is stored under
Temporary data folder (Isolated storage) – Modern apps save their data at the following location – C\Users\<username>\AppData\Local\Packages.
I'm not seeing anything indicating the name of my backup file and the APP isn't helpful at telling you where is it saving the backup. Is anyone familiar with this? Are there any tools that can decode the data in a user friendly format?
Appreciate any assistance you can provide.
WeChat data is stored in EnMicroMsg.db which can be decrypted relatively easily.
What kind of image have you obtained? Logical/Physical? How have you identified the app is installed? Can you open it on the machine itself, or is it only a backup of app data?
Try to use Belkasoft for extracting the chats.
Try to use Belkasoft for extracting the chats.
Why not suggest a vendor-agnostic approach in the first instance?
Install the app, generate your own test data, generate a backup and identify the app's default storage location.
Try to use Belkasoft for extracting the chats.
Why not suggest a vendor-agnostic approach in the first instance?
Install the app, generate your own test data, generate a backup and identify the app's default storage location.
Well, the question was "are there any tools" and indeed, there are.