I did the backup of an android it with Android tools. Now I am analyzing the backup with Autopsy. I need to find the key of the db crypt8. But I don't found com.whatsapp. Someone can help me?
thanks
can you tell which phone you are using? and os version?
and is the phone rooted??
mostly the location is /com.whatsapp/files/key
mostly the location is /com.whatsapp/files/key
The phone is Samsung s3. Not rooted. I don't find the path /com.whatsapp/files/key
I think someone removed whatsapp
ok.
if You know the phone number by which the whatsApp was installed on the phone and if you have encrypted whatsapp files with you, you can install whatsapp and enter the same number, the whatsapp will try to restore the messages from encrypted backups ( only if same number is entered).
I tried it and got success.
Also, if the whatsApp is uninstalled and the Android os is latest, then there is a possibility that the Com.Whatsapp folder is deleted automatically while uninstallation process.
If phone is rooted you extracted it easy.
Else, use ADB and extract without root.
There are plenty of tutorials on internet, just google them