Notifications
Clear all

Wickr iOS iPhone FS

10 Posts
7 Users
0 Reactions
2,516 Views
(@dandaman_24)
Estimable Member
Joined: 11 years ago
Posts: 172
Topic starter  

I have a FS dump of iPhone, when parsed in latest version of PA it asks for the password to decode the Wickr app, I have entered the password, but it appears it was incorrect as no Wickr chat messages has been reported in PA report.

Is there a way to attempt to retry passwords for Wickr after the data has been parsed in PA ?

I have multiple passwords to try, but i dont want to re parse the data for each attempt, it doesnt seem logical to me.

Thanks


   
Quote
(@stefspvq)
Active Member
Joined: 10 years ago
Posts: 14
 

I done a graykey extraction of my own iphone with Wicker on it. So i know the password. When i put the FS extraction of the graykey on PA, i ask me for the Wicker password. I entered my password and didnt decode the Wicker message. I see the database, try to use with SQL software but didnt decrypt that. I think on Cellebrite web site you can have a list of supported apps and also the version that is supported by Cellebrite. Maybe our case is that the version of Wicker didnt support by Cellebrite.

Anybody have a clue or solution i will take it! thks!


   
ReplyQuote
(@dandaman_24)
Estimable Member
Joined: 11 years ago
Posts: 172
Topic starter  

PM'd you


   
ReplyQuote
(@zeroonezero)
Active Member
Joined: 7 years ago
Posts: 16
 

I done a graykey extraction of my own iphone with Wicker on it. So i know the password. When i put the FS extraction of the graykey on PA, i ask me for the Wicker password. I entered my password and didnt decode the Wicker message. I see the database, try to use with SQL software but didnt decrypt that. I think on Cellebrite web site you can have a list of supported apps and also the version that is supported by Cellebrite. Maybe our case is that the version of Wicker didnt support by Cellebrite.

Anybody have a clue or solution i will take it! thks!

I do not understand why so many PM users information when we have a forum for the purpose of sharing information so that others can make use of it. I do not mean to step on any toes. I just love the community we have here and I often see posts addressing an issue I have encountered, only for the solution to be trapped in someones inbox.

With that said, what was the solution to this, if there was one?


   
ReplyQuote
(@dave_akko)
New Member
Joined: 7 years ago
Posts: 1
 

PM'd you

Please can your solution be shared? We have exactly the same issue as mentioned above.

PA asks for the password - enter and nothings displayed.

Databases checkec etc..

Many thnaks


   
ReplyQuote
(@sempiternal94)
New Member
Joined: 7 years ago
Posts: 1
 

I have a FS dump of iPhone, when parsed in latest version of PA it asks for the password to decode the Wickr app, I have entered the password, but it appears it was incorrect as no Wickr chat messages has been reported in PA report.

Is there a way to attempt to retry passwords for Wickr after the data has been parsed in PA ?

I have multiple passwords to try, but i dont want to re parse the data for each attempt, it doesnt seem logical to me.

Thanks

I've encountered the same issue with physical extractions from Android devices too, a solution would be helpful


   
ReplyQuote
(@dandaman_24)
Estimable Member
Joined: 11 years ago
Posts: 172
Topic starter  

once the data is parsed in PA, there is now a plugin you can run to re attempt to decrypt the Wickr App.


   
ReplyQuote
(@jjh2320)
Eminent Member
Joined: 11 years ago
Posts: 21
 

Good Morning All,

Can anyone point me in the direction of running this plugin without having to re-decode the whole extraction. No references made to an existing plugin within PA itself?

Thank you in advance.

J


   
ReplyQuote
(@cobb1985)
New Member
Joined: 6 years ago
Posts: 1
 

Hey,

I could also use some assistance with Wickr in PA. I have the application passcode which PA prompted for but then nothing seemed to parse out. If there is a way to avoid using the SQLite wizard I'd love to know it.

Thanks!


   
ReplyQuote
(@dandaman_24)
Estimable Member
Joined: 11 years ago
Posts: 172
Topic starter  

https://thebinaryhick.blog/2019/08/23/wickr-alright-well-call-it-a-draw/


   
ReplyQuote
Share: