Viber is a cross-platform voice over IP and instant messaging software operated by Rakuten. The software app is provided as freeware for Android, Apple iOS, Microsoft Windows, macOS and Linux platforms. Initially the messenger was developed in 2010 by the Israel-based Viber Media, which was then bought by Rakuten in 2014. According to Statista, there were over 1.1 billion registered users as of March 2019.
Viber’s official website states the app offers end-to-end encryption and the encryption keys only exist on user’s devices. Additionally, they state no data is stored on the Viber server and that messages are only temporarily stored when they cannot be delivered to the mobile device.Public chats on Viber are not encrypted at all. However, in comparison with WhatsApp, Viber offers secret chats. This method of communication allows users to chat in an encrypted channel that will not be synchronized with the cloud service or with Viber Desktop. Secure, right? There is more. Secret chats offer self-destruct messages and also screenshot notifications. Unfortunately, once a message is self-destructed it cannot be recovered by forensic software, even if a physical extraction is done.
Almost every Messenger used today offers the ability to delete a chat for everyone within the sent messages. If a message was deleted for everyone in Viber only partial recovery is obtainable. We will show you what artifacts can be retrieved in the second part of our post.
Now let’s look into one more interesting Viber feature that is really unique. Viber offers users the ability to hide any chat by setting a PIN code for it in the Viber settings. Once a chat is hidden you need to enter a PIN code in the messenger search field to unhide it. What does this mean for investigators? Even if you have an unlocked phone this does not mean you will see all the conversations in Viber. This will also be covered in the second part of our blog.
Oxygen Forensic® Detective offers the most comprehensive Viber data extraction from all possible sources.
Viber extraction from mobile devices
We currently support Viber for Apple iOS and Android devices. Extraction from Apple devices is as easy as a simple iTunes backup with no need to jailbreak the device. As for Android we recommend a physical extraction or and if the device happens to be a Huawei, import the backup to get at the Viber data.
No matter what phone operating type you are dealing with you will be able to collect the same evidence set: account info, contacts (both Viber and the phonebook copied to its database), private and group chats with all the shared data. Also, secret chats are extracted and decrypted in full.
Messages that have been deleted for everyone will be partially recovered – there will be time stamps, remote party but no texts. Great news – hidden chats are fully extracted in our software.
Viber extraction from cloud
A user may also create a Viber message backup and send it to cloud storage (iCloud or Google Drive depending on the device OS). Unlike WhatsApp backups that can be locally stored on an Android device Viber does not store any backups on the device.
Moreover, unlike WhatsApp backups in the cloud, Viber’s cloud backups are not encrypted. You can access them in iCloud or Google Drive simply by inserting the credentials in our Oxygen Forensic® Cloud Extractor. The extracted evidence set will include contacts and chats but no secret or hidden chats since they are not saved to the backup.
Fast QR code extraction
Our QR code method has already proved to be efficient on WhatsApp and Line Messengers so we have also implemented it for Viber. This method can be a lifesaver when you have a phone unlocked, the extraction fails or the created image is encrypted. It is easy, simply open Viber in a mobile device and start our Cloud Extractor. You will need to scan a Viber QR code in our software to receive the account information, contacts and messages. Access via QR code can be also obtained via Viber QR token found by our innovative, and included, KeyScout utility.
Viber from PC
Viber Messenger can also be installed to desktops and synced when you scan the QR code from the Viber mobile app. Viber data on a PC is not encrypted and Oxygen Forensic® KeyScout utility can collect Viber contacts and chats with the exception of secret and hidden chats which are not saved to the PC.
As outlined Viber appears to not be positioned as a secure messenger but offers users a couple of features that enhance their privacy. No matter what functions are used Oxygen Forensic® Detective extracts the maximum amount of data possible from all available sources.
