WhatsApp sent and r...
 
Notifications
Clear all

WhatsApp sent and received images path  

  RSS
giuseppem
(@giuseppem)
New Member

Dear all,

as the subject, I was wondering which is the path for sent and received images. I have an advanced logical extraction of an iPhone 6 s Plus, done with UFED Touch and report generated with UFED Physical Analyzer. I found a picture of interest and it is located in the following path

iPhone/Applications/net.whatsapp.WhatsApp/Library/Media/
[email protected]/
2/7/NNNNllNN-NNNN-NNNL-NNNN-LNNNLNllnL.jpg

"TELEPHONE_NUMBER" is not the phone number of the iphone's owner and "NNNNllNN-NNNN-NNNL-NNNN-LNNNLNllnL.jpg" is the disguised name of the picture which, actually, is a sequence of numbers and letters.
I think that what I found is a sent image.
Am I right?

Quote
Posted : 04/02/2017 11:54 pm
Azarius
(@azarius)
New Member

View the hex data… does it have the proper headers? Exif data present?

ReplyQuote
Posted : 16/02/2017 7:53 pm
mobileforensicswales
(@mobileforensicswales)
Active Member

The data you want is all in the DB, I would look there first

ReplyQuote
Posted : 18/02/2017 7:13 pm
giuseppem
(@giuseppem)
New Member

Thank you Azarius and mobileforensicswales. I found lot of images, organized inside directory with the telephone number of the whatsapp contacts. For example Jane has the telephone number 2222222222 and is a whatsapp contact of mine. I have an iPhone (actually, I haven't) an I sent lot of images to Jane, the same does Jane with me. On my phone, all these media are in the same directory [email protected]
So, @mobileforensicswales, as you are saying, the only way is to look inside the DB. Do you know the path of the DB? Can I explore it, also with an advanced logical extraction (it's not physical)?
Isn't it encrypted??

ReplyQuote
Posted : 20/02/2017 4:42 pm
mobileforensicswales
(@mobileforensicswales)
Active Member

https://forum.xda-developers.com/showthread.php?t=1583021

ReplyQuote
Posted : 20/02/2017 6:25 pm
Share: