Join Us!

WhatsApp folder str...
 
Notifications
Clear all

WhatsApp folder structure UFED Extraction iOS  

  RSS
jjcardiff
(@jjcardiff)
New Member

I have extracted WhatsApp conversation images from an iPhone 7 Plus running iOS 12.1.4.

Displayed in Cellebrite UFED Analyzer the folder structure for the devices's Images are as follows

Joe Blogs iPhone
Applications
group.net.whatsapp.WhatsApp.shared
Messages/Media
*contactnumber*@s.whatsapp.net (13 items)
c/8 (2 items)
d/c (2 items)
7/8 (2 items)
8/c (2 items)
6 (3 items)
0/7 (1 item)

When I come to create a report I notice that every image is duplicated due to it having a .thumb copy, however this .thumb duplicate is not contained within the same file as the original image or all of the other .thumb photos.

Does anyone know
1. What all of the above various folders mean within the overall contact number folder
2. How or why images are put into these titled folders (I can't see any obvious reasoning from the metadata)
3. A quick way to not report all .thumb files

Many thanks in advance

Quote
Posted : 04/04/2019 12:20 pm
Share: