WhatsApp Data Extra...
 
Notifications
Clear all

WhatsApp Data Extraction  

  RSS
rohitdharan
(@rohitdharan)
New Member

Hello Experts.
Hope you all are doing well.

My question is how to extract WhatsApp data with the help of UFED?

Quote
Posted : 21/06/2019 11:36 am
OxygenForensics
(@oxygenforensics)
Active Member

Since nobody has answered your question we would like to say some words about our WhatsApp methods.
Oxygen Forensic Detctive offers complete WhatsApp acquiistion from Apple and Android devices, extraction of WhatsApp backups from iCloud and Google Drive and several exclusive methods - access to the WhatsApp server, WhatsApp backup decryption via phone number and WhatsApp extraction via QR token from PC. If you are interested you can drop us an email to request a demo license.

ReplyQuote
Posted : 27/06/2019 2:13 pm
rohitdharan
(@rohitdharan)
New Member

Since nobody has answered your question we would like to say some words about our WhatsApp methods.
Oxygen Forensic Detctive offers complete WhatsApp acquiistion from Apple and Android devices, extraction of WhatsApp backups from iCloud and Google Drive and several exclusive methods - access to the WhatsApp server, WhatsApp backup decryption via phone number and WhatsApp extraction via QR token from PC. If you are interested you can drop us an email to request a demo license.

Thank you so much !

ReplyQuote
Posted : 28/06/2019 10:46 am
Styers
(@styers)
New Member

Cloud analyzer if they have the password saved, and if the have it set up to save cloud backups.

A lot of "ifs" in that method. But it has worked for me a few times.

ReplyQuote
Posted : 28/06/2019 7:00 pm
matrix4n6
(@matrix4n6)
New Member

To extract WhatsApp-Data in UFED you have to use the option "Android Backup APK Downgrade" (to be found under the "File System" category).
(I don't know if that option is available in all UFED license models.)

ReplyQuote
Posted : 01/07/2019 1:48 pm
cs1337
(@cs1337)
Member

I have been having alot of success with the APK downgrade method in cellebrite UFED 4 PC. Make sure to install the APK Downgrade pack from the portal and install it into UFED 4 PC. one thing to keep in mind it is recommended by Cellebrite support as a "last resort" after jTag or chip-off as it is altering the APP version on the phone in order to extract the data.

ReplyQuote
Posted : 02/07/2019 7:02 pm
obev0098
(@obev0098)
New Member

Was you able to recover deleted data on an IOS device using UFED? We have only had luck on Android devices which we no longer supply.

ReplyQuote
Posted : 06/08/2019 7:28 pm
Hunter
(@hunter)
Junior Member

https://paraben-sticks.com/chat-stick.html

Cheap solution. IDK if it supports whatsapp

ReplyQuote
Posted : 12/08/2019 9:13 pm
skswati
(@skswati)
New Member

To extract WhatsApp-Data in UFED you have to use the option "Android Backup APK Downgrade" (to be found under the "File System" category).
(I don't know if that option is available in all UFED license models.)

When you try this method it warms that use this as last method and in next window it also notify that user credentials might be lost, than how could we try this?

ReplyQuote
Posted : 05/09/2019 5:57 pm
denyzkoo
(@denyzkoo)
New Member

If you have physical exctraction UFED parse whatsapp as well. From advanced logical or filesystem you can get msgstore.db.crypt12 database file but keys to decrypt it are hidden. You need to get root eq get physical extraction to get keys to msgstore.db.crypt12. Its tricky, cuz get root permision of new androids is big problem.

ReplyQuote
Posted : 07/09/2019 7:47 am
EugeneBelk
(@eugenebelk)
New Member

WhatsApp is a must for any digital forensic solution. If you want to try a different solution, you can try Belkasoft. Here is what you could do with us https://www.digitalforensics.com/blog/analyzing-instant-messengers-with-belkasoft/

ReplyQuote
Posted : 10/09/2019 2:56 pm
Share: