WhatsApp folder str...
Clear all

WhatsApp folder structure UFED Extraction iOS

New Member

I have extracted WhatsApp conversation images from an iPhone 7 Plus running iOS 12.1.4.

Displayed in Cellebrite UFED Analyzer the folder structure for the devices's Images are as follows

Joe Blogs iPhone
*contactnumber*@s.whatsapp.net (13 items)
c/8 (2 items)
d/c (2 items)
7/8 (2 items)
8/c (2 items)
6 (3 items)
0/7 (1 item)

When I come to create a report I notice that every image is duplicated due to it having a .thumb copy, however this .thumb duplicate is not contained within the same file as the original image or all of the other .thumb photos.

Does anyone know
1. What all of the above various folders mean within the overall contact number folder
2. How or why images are put into these titled folders (I can't see any obvious reasoning from the metadata)
3. A quick way to not report all .thumb files

Many thanks in advance

Topic starter Posted : 04/04/2019 12:20 pm