WhatsApp sent and r...
 
Notifications
Clear all

WhatsApp sent and received images path

5 Posts
3 Users
0 Likes
1,588 Views
(@giuseppem)
Posts: 24
Eminent Member
Topic starter
 

Dear all,

as the subject, I was wondering which is the path for sent and received images. I have an advanced logical extraction of an iPhone 6 s Plus, done with UFED Touch and report generated with UFED Physical Analyzer. I found a picture of interest and it is located in the following path

iPhone/Applications/net.whatsapp.WhatsApp/Library/Media/
TELEPHONE_NUMBER@s.whatsapp.net/
2/7/NNNNllNN-NNNN-NNNL-NNNN-LNNNLNllnL.jpg

"TELEPHONE_NUMBER" is not the phone number of the iphone's owner and "NNNNllNN-NNNN-NNNL-NNNN-LNNNLNllnL.jpg" is the disguised name of the picture which, actually, is a sequence of numbers and letters.
I think that what I found is a sent image.
Am I right?

 
Posted : 04/02/2017 11:54 pm
(@azarius)
Posts: 8
Active Member
 

View the hex data… does it have the proper headers? Exif data present?

 
Posted : 16/02/2017 7:53 pm
(@mobileforensicswales)
Posts: 274
Reputable Member
 

The data you want is all in the DB, I would look there first

 
Posted : 18/02/2017 7:13 pm
(@giuseppem)
Posts: 24
Eminent Member
Topic starter
 

Thank you Azarius and mobileforensicswales. I found lot of images, organized inside directory with the telephone number of the whatsapp contacts. For example Jane has the telephone number 2222222222 and is a whatsapp contact of mine. I have an iPhone (actually, I haven't) an I sent lot of images to Jane, the same does Jane with me. On my phone, all these media are in the same directory 2222222222@s.whatsapp.net
So, @mobileforensicswales, as you are saying, the only way is to look inside the DB. Do you know the path of the DB? Can I explore it, also with an advanced logical extraction (it's not physical)?
Isn't it encrypted??

 
Posted : 20/02/2017 4:42 pm
(@mobileforensicswales)
Posts: 274
Reputable Member
 

https://forum.xda-developers.com/showthread.php?t=1583021

 
Posted : 20/02/2017 6:25 pm
Share: