Viber Messenger Extraction In Oxygen Forensic Detective

Viber is a cross-platform voice over IP and instant messaging software operated by Rakuten. The software app is provided as freeware for Android, Apple iOS, Microsoft Windows, macOS and Linux platforms. Initially the messenger was developed in 2010 by the Israel-based Viber Media, which was then bought by Rakuten in 2014. According to Statista, there were over 1.1 billion registered users as of March 2019.

Viber’s official website states the app offers end-to-end encryption and the encryption keys only exist on user’s devices. Additionally, they state no data is stored on the Viber server and that messages are only temporarily stored when they cannot be delivered to the mobile device.Public chats on Viber are not encrypted at all. However, in comparison with WhatsApp, Viber offers secret chats. This method of communication allows users to chat in an encrypted channel that will not be synchronized with the cloud service or with Viber Desktop. Secure, right? There is more. Secret chats offer self-destruct messages and also screenshot notifications. Unfortunately, once a message is self-destructed it cannot be recovered by forensic software, even if a physical extraction is done.

Almost every Messenger used today offers the ability to delete a chat for everyone within the sent messages. If a message was deleted for everyone in Viber only partial recovery is obtainable. We will show you what artifacts can be retrieved in the second part of our post.

Now let’s look into one more interesting Viber feature that is really unique. Viber offers users the ability to hide any chat by setting a PIN code for it in the Viber settings. Once a chat is hidden you need to enter a PIN code in the messenger search field to unhide it. What does this mean for investigators? Even if you have an unlocked phone this does not mean you will see all the conversations in Viber. This will also be covered in the second part of our blog.

Get The Latest DFIR News!

Top DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

Oxygen Forensic® Detective offers the most comprehensive Viber data extraction from all possible sources.

Viber extraction from mobile devices

We currently support Viber for Apple iOS and Android devices. Extraction from Apple devices is as easy as a simple iTunes backup with no need to jailbreak the device. As for Android we recommend a physical extraction or and if the device happens to be a Huawei, import the backup to get at the Viber data.

No matter what phone operating type you are dealing with you will be able to collect the same evidence set: account info, contacts (both Viber and the phonebook copied to its database), private and group chats with all the shared data. Also, secret chats are extracted and decrypted in full.

Messages that have been deleted for everyone will be partially recovered – there will be time stamps, remote party but no texts. Great news – hidden chats are fully extracted in our software.

Viber extraction from cloud

A user may also create a Viber message backup and send it to cloud storage (iCloud or Google Drive depending on the device OS). Unlike WhatsApp backups that can be locally stored on an Android device Viber does not store any backups on the device.

Moreover, unlike WhatsApp backups in the cloud, Viber’s cloud backups are not encrypted. You can access them in iCloud or Google Drive simply by inserting the credentials in our Oxygen Forensic® Cloud Extractor. The extracted evidence set will include contacts and chats but no secret or hidden chats since they are not saved to the backup.

Fast QR code extraction

Our QR code method has already proved to be efficient on WhatsApp and Line Messengers so we have also implemented it for Viber. This method can be a lifesaver when you have a phone unlocked, the extraction fails or the created image is encrypted. It is easy, simply open Viber in a mobile device and start our Cloud Extractor. You will need to scan a Viber QR code in our software to receive the account information, contacts and messages. Access via QR code can be also obtained via Viber QR token found by our innovative, and included, KeyScout utility.

Viber from PC

Viber Messenger can also be installed to desktops and synced when you scan the QR code from the Viber mobile app. Viber data on a PC is not encrypted and Oxygen Forensic® KeyScout utility can collect Viber contacts and chats with the exception of secret and hidden chats which are not saved to the PC.

As outlined Viber appears to not be positioned as a secure messenger but offers users a couple of features that enhance their privacy. No matter what functions are used Oxygen Forensic® Detective extracts the maximum amount of data possible from all available sources.

Leave a Comment

Latest Videos

Quantifying Data Volatility for IoT Forensics With Examples From Contiki OS

Forensic Focus 22nd June 2022 5:00 am

File timestamps are used by forensics practitioners as a fundamental artifact. For example, the creation of user files can show traces of user activity, while system files, like configuration and log files, typically reveal when a program was run. 

Despite timestamps being ubiquitous, the understanding of their exact meaning is mostly overlooked in favor of fully-automated, correlation-based approaches. Existing work for practitioners aims at understanding Windows and is not directly applicable to Unix-like systems. 

In this paper, we review how each layer of the software stack (kernel, file system, libraries, application) influences MACB timestamps on Unix systems such as Linux, OpenBSD, FreeBSD and macOS.

We examine how POSIX specifies the timestamp behavior and propose a framework for automatically profiling OS kernels, user mode libraries and applications, including compliance checks against POSIX.

Our implementation covers four different operating systems, the GIO and Qt library, as well as several user mode applications and is released as open-source.

Based on 187 compliance tests and automated profiling covering common file operations, we found multiple unexpected and non-compliant behaviors, both on common operations and in edge cases.

Furthermore, we provide tables summarizing timestamp behavior aimed to be used by practitioners as a quick-reference.

Learn more: https://dfrws.org/presentation/a-systematic-approach-to-understanding-macb-timestamps-on-unixlike-systems/

File timestamps are used by forensics practitioners as a fundamental artifact. For example, the creation of user files can show traces of user activity, while system files, like configuration and log files, typically reveal when a program was run.

Despite timestamps being ubiquitous, the understanding of their exact meaning is mostly overlooked in favor of fully-automated, correlation-based approaches. Existing work for practitioners aims at understanding Windows and is not directly applicable to Unix-like systems.

In this paper, we review how each layer of the software stack (kernel, file system, libraries, application) influences MACB timestamps on Unix systems such as Linux, OpenBSD, FreeBSD and macOS.

We examine how POSIX specifies the timestamp behavior and propose a framework for automatically profiling OS kernels, user mode libraries and applications, including compliance checks against POSIX.

Our implementation covers four different operating systems, the GIO and Qt library, as well as several user mode applications and is released as open-source.

Based on 187 compliance tests and automated profiling covering common file operations, we found multiple unexpected and non-compliant behaviors, both on common operations and in edge cases.

Furthermore, we provide tables summarizing timestamp behavior aimed to be used by practitioners as a quick-reference.

Learn more: https://dfrws.org/presentation/a-systematic-approach-to-understanding-macb-timestamps-on-unixlike-systems/

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_i0zd7HtluzY

A Systematic Approach to Understanding MACB Timestamps on Unixlike Systems

Forensic Focus 21st June 2022 5:00 am

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.

Latest Articles

Share to...